Security overview

Avaya Modular Messaging setup

Avaya Modular Messaging is a standards-based messaging system that converges voice and data networks and is a critical system for messaging and communications. Based on the functions, it is divided into two separate components:

• Messaging Application Server (MAS). MAS is a Windows-based system that forms a front end that interfaces with the Private Branch Exchange (PBX) through associated voice ports. Depending on the switch integration, the MAS interfaces with the (Avaya) PBX using Internet Protocol (IP), if so configured. The MAS also provides IP based interfaces for system management and subscriber access. In the Modular Messaging—Message Storage Server (MSS) configuration the MAS communicates with the message store and directory server using a private LAN delivered with the Modular Messaging product.
• Message Storage Server (MSS). MSS is a Linux-based system that forms the back end which provides message storage, message transport, subscriber client access, system management interfaces, directory, and message networking functions.

One or more MAS with one MSS together form a voice mail domain. The MAS and the MSS communicate over a dedicated private LAN. The MAS and the MSS together provide callers with a call-answering interface, subscribers with access to messages and directory, and administrators with access to system and subscriber configuration data. With this setup, Avaya has implemented various features and recommendations to provide users with a system that is secured to the fullest extent possible.

Security elements with Modular Messaging

Security concerns for the Avaya S3400 Message Server include toll fraud, unauthorized reprogramming of computer systems, unauthorized access to telecommunication systems by misusing the call transfer capabilities of the system or through ports meant for remote administration or maintenance, unintended disclosure of confidential information, and virus attacks. These activities may result in huge telephone bills, revenue loss, administrative costs, decreased system performance, and loss of customer confidence.

The various security risks faced by telecommunication systems today are described in the following sections.

Telecommunications fraud

Toll fraud is a significant security concern in traditional voice messaging systems. Unauthorized people use personal computers, random number generators and password cracking programs to break into the most sophisticated systems and commit frauds. Today, with the convergence of voice and data and the advent of IP Telephony, security problems are not limited to toll fraud and unauthorized access. The advances in technology has opened up a wide array of vulnerabilities that can compromise the security of the entire organization. See Telecommunication service thefts for more information on Toll fraud.

Voice messaging features

Voice messaging systems provide a wide variety of applications, such as automated attendants, that operate like an electronic answering machine. Callers can leave messages for employees who have voice mailboxes assigned to them. The system also allows callers to transfer to other extensions which sometimes can be external phone numbers. The Find Me functionality allows subscribers to specify a list of phone numbers that the system can dial out to reach the subscriber. Systems also allow Call Me notification mechanisms and delivery of faxes to outbound numbers. These features allow the transfer of calls out of the voice mailboxes and into the PBX system. Hackers try to connect to the voice mail system and type-in digits to gain an outgoing trunk line. Some hackers gain entry into the voice messaging system and search for unassigned mailboxes. They then use such mailboxes to exchange toll-free messages.

Remote access

Remote access (also known as DISA, Direct Inward System Access) permits callers to access the system from public networks. Callers can dial into the system using Central Office (CO), Foreign Exchange (FX), Direct Inward Dialing (DID) or 800 service trunks to use the features and services of the system. Unprotected remote access numbers are a favorite target for hackers. Hackers attempt to decipher the security code by using automated programs to gain entry into the system and misuse its services. Expert toll hackers also target the administration and maintenance ports of systems to change the system features and parameters to make unauthorized long distance calls.

Internal threats

Securing a system does not begin with the system itself, but with the people and organizations that use it. In deciding who to protect the system against, one must not forget to look internally. A significant number of attacks come from within. Internal security is important to the protection of information and assets. It is easier to misuse or damage the system by physical methods than by hacking the system passwords. Another example would be of improper storage of passwords. If passwords are written on papers lying around on employee desks, other employees can easily use such passwords and access the mailbox of another employee and pass critical and confidential information, or the password itself, to unauthorized people. It is therefore very important to enforce a proper security policy against such internal breaches of communications.

Internet threats

Modular Messaging is deployed into the existing corporate LAN and may therefore be exposed to a variety of threats originating from the Internet. Security is a primary concern when an organization connects its network to the Internet. Network administrators have increasing concerns about the security of their networks when they expose their organization’s private data and networking infrastructure to Internet crackers. Some of the common methods of attacks from the Internet include Internet worms, virus attacks, malicious e-mail attachments, IP spoofing, Password attacks, Network packet sniffers, Denial of Service attacks, and Application layer attacks. These attacks may lead to theft, and to destruction and corruption that may cause irreparable damage to sensitive and confidential information.

What you need to do

It is extremely important that system managers and administrators plan and implement the necessary security measures and ensure that:

• Modular Messaging servers integrate into your existing TCP/IP network in accordance with the corporate networking policies, and these servers also allow the usage of existing firewall and of corporate security policies and practices.

• You carefully consider the security implications of enabling client access to the Modular Messaging system. For example IMAP4 or POP3 standards-based client access, Modular Messaging Web Client access, Subscriber Options.

• You prevent unauthorized use of the server capabilities by protecting the server with administrator and user passwords. Lengthy and random passwords minimize the possibility of hacking. Ensure that you secure these passwords properly.

• The network prevents all well known types of hacker attacks, including denial of service attacks.

• The servers provide sufficient logs, like the Administrator History Log, to facilitate detection of actual and attempted unauthorized usage and identification of sources of unauthorized usage.

Top of page