Security

Avaya recognizes that security is a key customer concern for a Cloud Solution - and obtaining accurate and information about our solution security is paramount. Available through an account representative under NDA, the Avaya Experience Platform (AXP) Public Security Playbook illustrates our:

• 360º security visibility  
• Global security intelligence 
• Sophisticated customer-facing controls
• Secure and hardened CCaaS solution 

Yes, and it includes: role-based access control (RBAC), mandatory access control (MAC), and discretionary access control (DAC). Multi-tenant Role Based Access Control (RBAC) provides fine-grained access management of Contact Center resources. Using RBAC, a customer may segregate duties within an organization and grant only the amount of access to Users and Applications needed to perform their role.

Avaya’s AXP solution provides role-based access control (RBAC) for granular control of users. Admin Center uses a unique account/tenant ID across all APIs, events, and data to prevent unauthorized access to the data of a customer. These roles are pre-configured or built-in to cover different job functions related to administration and contact center operations. You can define permissions on the protected resources and map these permissions to built-in roles during installation. Examples of the built-in roles include:

• System administrator
• Auditor
• Security Administrator
• Tenant Administrator
• Supervisor
• Reporting User
• Operations Manager or Analyst

AXP uses encryption to protect all data in transit and at rest. Data in transit use Transport Layer Security (TLS) version 1.2+. The cloud platform aligns with National Institute of Standards and Technology (NIST) standards to underpin our security protocols, standards & encryption practices, and maintains ISO 27001, 27017, and 27018 certifications as well as PCI compliancy. Key Vault Technology is used to maintain Trust and ensure the security and integrity of: 

Secrets Management - tokens, passwords, certificates, & API keys 
Key Management – controlling the encryption keys used to encrypt your data 
Certificate Management - deploy the platform that supports public and private TLS/SSL certificates 
 

Additionally, strong encryption is achieved by using 2048-bit public/private key pairs to create unreadable records that may be safely stored.

We proactively identify and monitor threats utilizing User and Entity Behavior Analytics (UEBA) to detect:  

• Zero-day,
• Targeted attacks, and
• Advanced persistent threats.

Our Partners, Security Teams and Tools continuously monitor and isolate threats in real-time via through 24x7x365 proactive monitoring, response, and incident handling processes.  

To maintain security and to ensure trust and integrity, Avaya maintains a variety of audit logging within the AXP solution, including:

Retention period for Monitor Logs is 365 days, and we can configure with a maximum of two years

• Active Audit Trail
• Activity logs
• Audit reports
• Diagnostic services, logs, & metrics (such as Key Vault audit)
• Network Security Group (NSG) flow logs & event logs
• Cloud Monitoring, Cloud Network Watching & Cloud Real-time scanning
• Audit data retention & archiving to meet Sovereignty & Regulatory Processes
• Retention period for Monitor Logs is 365 days, and we can configure with a maximum of two years

Support for AXP is based on ITIL®️ processes, including Service Desk, Service Management, Incident Management, Problem Management, and Change Management.  

In case of a incident, customers of AXP will receive an email with details of the updates being applied to the environment through the standard notification processes for all Planned Maintenance and Emergency Changes. Customers will be notified of any security incident in accordance with contracted obligations.

Avaya enables the export of audit trace logs to integrate customer SIEM. RWS admin can download application configuration change logs, although product activity and resource logs aren't exportable. By default, the retention period within the platform is 90 days but can be expanded up to one year.

AXP is scanned regularly with a third-party, industry standard solution, and pen tests are conducted as least annually. Vulnerabilities identified as a part of Avaya’s Vulnerability and Penetration Testing (VAPT) processes will be addressed in accordance with Avaya’s vulnerability patching guidelines and processes.