Security-related maintenance

You cannot have security without security maintenance. If security maintenance is not performed, the system is exposed to several vulnerabilities.

An organization can proactively manage security through security maintenance. Do not underestimate regular system maintenance. Good, timely maintenance procedures can keep your systems in optimal performance. Avaya recommends that you implement proper maintenance procedures according to your corporate security policies and guidelines. For more information about Modular Messaging maintenance procedures, see Monitoring and maintaining the system.

Topics in this section include:

• Responsibility for maintenance

• System backups and restores

• Security patches

• Monitoring and alarming

• Security audits

Responsibility for maintenance

You must define who is responsible for maintaining the security of your system. Security information must be distributed throughout the organization. The information security department communicates and validates that systems are being maintained. The systems administrator tests and applies patches. The systems administrator also maintains the security of the system. A conflict of interest exists when the security department is responsible to maintain security in addition to validate and communicate security policy. The auditor and appraiser is the maintainer.

Security staffs are often faced with limited personnel. Many security departments cannot be responsible to maintain the system security for the entire enterprise. Maintenance must be distributed to all the system and application administrators. The security department communicates and trains the system administrators to secure systems according to the security policies, standards, and procedures of the organization.

The following topics provide guidelines for defining a security maintenance program for your system.

System backups and restores

This topic discusses backups and restores for Modular Messaging systems with Avaya Message Storage Server (MSS).

Data backups and restores are necessary to ensure that critical system data can be recovered when an emergency or a system failure occurs. As part of system maintenance activities, perform the following tasks:

• Perform backup procedures at regular intervals.

  • If you use DVD backup media with the MSS, place new media into the MSS each day. Reuse the media no more frequently than every 15 days. Store the media in a secure place, preferably off-site.
  • If you use local area network based (LAN-based) backup, copy a backup from the LAN storage device to another device regularly, preferably at least every 15 days. Ensure that your LAN storage device uses some fault tolerance to disk failure, such as RAID Level 5.

• Test the system facilities to ensure that critical data can be fully recovered.

If you have a spare system or can plan a service outage, test the restoration procedure regularly to verify the following:

• Procedures are appropriate.

• Restoration systems are adequate.

• Restoration process can be completed within the time allotted in the recovery procedures.

Maintain and review activity logs, and store them in a secure location. Activity logs can trace system activity and errors.

Security patches

System administrators must keep themselves updated on the latest security patches. The frequency of security patch applications depends on the exposure of the system involved and the risk the exposure brings to the business. Before you deploy a patch, test it for stability and reliability.

Apply patches for vulnerabilities that pose a significant risk to the enterprise as soon as possible. System availability is an important security objective. Avaya recommends that you install any security-related upgrades or patches only after consulting with Avaya. For more information, see Patching. You do not want the system to go down because of a patch.

Monitoring and alarming

System monitoring involves ongoing review of system reports and audits of the system and its logs. Review the security configuration of the system regularly. Validate that changes made through maintenance do not weaken system security. Also, scan your system for vulnerabilities on a regular basis. Popular tools include NAI CyberCop Scanner and ISS System Scanner. A free and comparable product is the Nessus scanner.

Avaya Message Servers support a variety of security-monitoring features. The servers disconnect Web sessions after a period of inactivity. Consecutive failed log-in attempts automatically lock out accounts and require administrator intervention. The server logs all failed attempts to login for administration activities.

Avaya Message Servers report security-related, critical events in two ways:

• Log events in the Windows Event Viewer.

• Send a maintenance alarm to an Avaya Maintenance Center through an analog telephone call.

For more information, see Intro - Diagnostic and Reporting Tools. For more information on the logs generated by the Messaging Application Server (MAS), see Overview of MAS Event, Error & Alarm Logs. For more information on the logs generated by the Message Storage Server (MSS) on Modular Messaging systems with Avaya MSS, see Logs.

You can use the Reporting Tool to generate reports for monitoring and tracking system security. The system provides reports on log-in failures, port statistics, and user mailbox statistics. For more information, see Understanding Reports.

Security audits

You can conduct a security audit of your system on a quarterly or an annual basis, as defined in your corporate security policies. Ensure that the security audit addresses the following components:

• Operating systems. Review the security controls and configuration settings of the operating systems.

• Application security. An insecure application can compromise a secure operating environment.

• Third-party application security. Ideally, do not run third-party applications on the Modular Messaging servers. Remove or review all plug-ins, scripts, and third-party components that were installed for security vulnerabilities.

• Content. Review the security of the contents on the system. Often you need to address the security of items, such as passwords stored in HTML files.

• Network security. Review the security configuration of your network on a regular basis.

Top of page