1 Building the Lync Security Eco System in the Cloud Fact Sheet. [Type text]
2 The need to secure and deliver a compliant cloud solution to all transactions in and out of the fastest growing Universal Communication applications (UC) and allow for complete interoperability when connected to legacy Universal Communication platforms, such as IPPBX or remote mobile/tablet computing inclusive of BYOD is crucial in the 21 st century. Cloud Computing for Universal Communications Office Box and Microsoft Lync Server provides complete presence, instant messaging, conferencing and enterprise voice capabilities through a single, user-friendly interface. The provision of data center resiliency and survivable branch security (branch flexibility) for high availability is possible. The consistent management infrastructure, new capabilities to increase availability and interoperability with existing systems work for administrators. It must be easy and cost effective to inter-connect all Microsoft Lync environments, encrypt end to end clients that are non Microsoft and manage security with direct access to the Microsoft s Lync architecture at the closest point to their core servers. Microsoft's Lync is based on the Session Initiation Protocol (SIP) which is the preferred standard Universal Communications protocol adopted by most vendors, hosted service providers and which is used to provide SIP trunk connections from Network Service Providers (NSP). SIP trunks are direct IP connections to IP-PBXs. Security and interoperability between Lync and other SIP based products and services can be complex, unless run by Office Box, Lync is a complex product; a typical Lync installation spans multiple servers and is dependent on a number of additional services. Security is a high priority for Office Box. Investment in Universal Communications has been a major part of the IT budget in the last 5 years with many looking to use Voice over the Internet, Video and Instant Messaging as productivity tools, which improves communication, saves significant costs to the business and is the future. The introduction of Bring Your Own Devices (BYOD-Mobile) together with the adoption of Cloud computing, private or public and the variants of technologies that uses SIP, has created a natural void for security, and in this we see many gaps have occurred which add risk to the business and allows various criminal activities such as:- Denial of Service Attacks Eavesdropping Packet Spoofing Replay Attack Message Integrity Information Leakage
3 Office Box services in the Cloud for Universal Communications. UM-Labs platform provides access and security via the Lync Edge server and Front End Server. These connection points enable full UC integration. UM Labs also offer Mediation Server connections; these are used where a lower level of integration is needed, for example for SIP trunks connections. SIP is delivered over IP networks. All data and applications on an IP network use a transport protocol to deliver data from one end-point to another, for example from a remote web site to your browser.
4 Lync Security Eco System in the Cloud Explaining the Solution and the over lay for Universal Communications (UC). All transport protocols run over the Internet Protocol (IP). IP s job is to deliver a series of packets. The transport protocol reassembles those packets and reconstructs the application data stream. SIP offers a choice of three different transport protocols. These are: o UDP, this is a light-weight connectionless protocol that does little more than extract data from IP packets then delivers it to an application. It is the responsibility of the receiving application to re-assemble the data stream. o TCP, this is a connection orientated protocol which delivers complete and ordered data streams to the application. Compared to UDP, there is an additional overhead particularly on servers handling large numbers of connections. o TLS, this is also a connection orientated protocol. TLS encrypts the data stream. TLS is the protocol used by secure web sites.
5 The SIP standard allows all 3 transport protocols. Microsoft Lync supports only TCP and TLS and uses TLS for all connections between Lync clients and servers for signalling. Lync uses a variant of TLS known as mtls (mutual TLS). TLS connections are established using certificates. The use of mtls in Lync means that the Lync server and all connecting Lync clients must each be configured with their own certificate. While Lync and supporting services such as Active Directory include functions to generate and distribute these certificates, these requirements make it difficult to connect users outside of your own organisation, and very difficult to use TLS to connect devices from other vendors. Lync s security model assumes that all users are running Lync clients, that all users are included in Active Directory, that the Active Directory schema has been defined appropriately and that the enterprise is running the latest versions of both Lync and Active Directory.
6 Most enterprises will want the flexibility to be able to operate outside of these constraints. The UM Labs Lync Connector establishes the same grade of connection to a Lync server as a standard Microsoft Lync client. It can connect to either the Lync Front-end Server or Edge Server (depending on network topology). The connection is fully encrypted and authenticated. The Lync Connector also establishes authenticated and encrypted connections to the standard SIP Hosted Service or Enterprise PBX. The Lync Connector then relays all calls, Instant Messaging and presence information between the Lync and standard SIP systems. SIP Trunk Services The majority of SIP trunk services provide only UDP for signalling connectivity; this makes it impossible to directly connect to a Lync server. A small number of trunk providers offer TCP connectivity. While this enables the trunk to connect to a Lync server, there is a loss of the security offered by TLS. An even smaller number of SIP trunk services offer TLS, but their connectivity requirements may be incompatible with Lync. Allowing TCP connections from an external service to a Lync server sacrifices a layer of security. Existing IP-PBX Many organisations are deploying Lync to provide an internal IP-PBX service. The Lync system will need to connect to both hardware IP phones and softphones running on tablets or mobile devices. In most cases these deployments will coexist with an existing IP-PBX or need to interconnect with an IP PBX in another location. Lync s connectivity requirements make this difficult. Mobile VoIP Clients and BYOD Many enterprises have deployed VoIP clients on smartphones to enable enterprise mobility and to adopt a Bring Your Own Device (BYOD) policy. There are a number of VoIP apps for smart-phones and for tablets which enable those clients to connect over WiFi or a cellular data connection to the corporate IP-PBX and operate as extensions on that PBX. Many of these apps offer call encryption and also support IM and presence. Organisations implementing Lync will want to retain their investment in this area, particularly as the earlier Lync client for smart-phones does not support direct VoIP calls. (Lync 2013 client has implemented this in the update.)
7 While most VoIP apps are able to offer a choice of SIP transports and therefore request a connection to a Lync server, there are a number of practical difficulties in connecting a non-lync device to a Lync server. Even if the device supports TLS it may not be possible or practical to meet Lync s strict mtls requirements. Using TCP as a connection option means sacrificing a layer of security and will leave the Lync server open to a range of attacks, including a potentially expensive call fraud attack. It may not be feasible or practical to use Active Directory to authenticate users running non Lync devices. Edge Server Authentication, Encryption Lync Connector Active Directory Mediation Server Front-end Server OTT Service Lync Users Voice/Video Calls Presence Instant Hosted Service Users UM Labs Software Security Platform as a Service (SSPaaS) is responsible for handling security functions which include signalling and media encryption for the back-end systems. Calls made via the service are decrypted and forwarded to a UC acting as an IP-PBX. The IP-PBX is responsible for routing calls between handsets, for providing a voice mail service for handsets that are not currently reachable and for implementing other functions including text messaging and conferencing with secure video if necessary. The UC processes clear-text audio/video streams, and so must be contained within secure perimeter with all connections to external services calls routed via the SPaaS.
8 The UM-Labs SPaaS can also support secure connections to desk phones and connections to external systems including the corporate internal phone system and SIP trunk services to provide PSTN access. Most external connections will be made in clear-text. UM-Labs and Office Box are part of the Innovation in Security Showcase which Includes: European cloud partnerships which must have
9 Innovation in Security showcase is the world s first authentication and Encryption Security Platform as a Service (SPaaS) for UC, which brings together Persona Management and End to End encryption across an enterprise voice network, allowing 21 st century social business to be performed in safety, protected from corruption or eavesdropping. The aims are to deliver a breakthrough environment that decreases risk, reduces costs and improves communication across the business, gaining improved ROI from the use of VOIP/Video/IM/BYOD in an Enterprise UC 21 st century environment.
11 About Office Box The ENZCOM was founded in 1997 and specializes in the provision of IT infrastructure services in the context of IT outsourcing projects and managed IT services. Since 2014, we are operating as GmbH and based in Buchholz, south of Hamburg. Under IT infrastructure management, we understand all the benefits that are associated with the design, implementation, monitoring and reliable operation of infrastructural IT systems. These offers ENZCOM services in the following areas: Monitoring Management Server Management Backup and Disaster Management Security Management Client Management Software Packaging and rollout Inventory Management 24 7 ServiceDesk LAN Management Solutions Consulting Data Center Our employees in IT infrastructure support are highly qualified and experienced system engineers. Condition for the activity in ENZCOM Operation Center (NOC) or in ENZCOM Project Center (EPC) Experience in customer-focused service, manufacturer authorizations (Microsoft MCITP, Microsoft MCP, etc.) and participation in further education in telephone support, remote management and technology.
12 Our system engineers are experienced in the design and implementation of complex CITRIX, Microsoft and security infrastructure systems. The ENZCOM is both technically and organizationally well equipped for the provision of service desk support and remote services. Guaranteed Telephone availability 24 7 Custom Incident assumption Mapping and monitoring of customized SLAs through the use of professional, ITIL compliant service desk tools Proprietary hardware and software for remote monitoring and remote access (RAP) Development and maintenance of customer-specific documentation databases and knowledge bases Reliable and proven escalation structures and quality monitoring ITIL compliant processes In order to meet the legitimate expectations of our customers, particularly in terms of accessibility, responsiveness, system availability, flexibility and quality full, sets the ENZCOM on a proven system: Close cooperation with all major manufacturers such as CITRIX, DELL and Microsoft Continuous accessibility for customers (24 hours / 7 days) Employees with specializations and authorizations in all relevant infrastructure and technical areas Regular developments in the field of technology and customer orientation QM system as an optimization basis for technical and administrative procedures and services (the ENZCOM operates according to the standards of ISO 9001 and ITIL) Benchmarking as the basis of price / performance comparisons
VoIP in the Enterprise Date: March. 2005 Author: Sonia Hanson Version: 1.1 1 1 Background Voice over IP In the late 1990s Voice over IP (VoIP) was seen as a disruptive new technology that had the potential
SIP Trunking Benefits and Best Practices White Paper Janne Magnusson Vice President, Product Management Ingate Systems Abstract 1 1 What is SIP trunking 1 2 The benefits of SIP trunking 1 2.1 Calculating
Small Logo SIP Trunking: Deployment Considerations at the Network Edge at the Network Edge Executive Summary The move to Voice over IP (VoIP) and Fax over IP (FoIP) in the enterprise has, until relatively
With hundreds of Help Desk software packages available, how do you choose the best one for your company? When conducting an Internet search, how do you wade through the overwhelming results? The answer
WHITE PAPER Is Your Network Ready For IP Telephony? Straight facts about IP telephony planning and deployment 1. Introduction Enterprises are rapidly adopting IP telephony for cost savings, productivity
An Oracle White Paper August 2013 What Is an Enterprise Session Border Controller? Introduction... 1 Redefining Enterprise Communications... 2 E-SBCs Protect and Control IP Communications... 3 E-SBCs Do
A Guide for SMEs 1 When switching to Voice over Internet Protocol (VoIP) telephony, the decision of whether to use a hosted or on-site phone system (IP-PBX) must be made. Both have fundamental differences
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
WHITE PaPEr: Easing the Way to the Cloud: 1 WHITE PAPER The Business Benefits of Upgrading Legacy IP Communications Systems 2 WHITE PAPER: The Business Benefits of Upgrading Legacy IP Communications Systems
SIP Trunking Deployment Models: Choose the One That Is Right for Your Company SIP Trunking Deployment Models: Executive Summary Transitioning to Session Initiation Protocol (SIP) trunking is a strategic
Contents 1 Introduction... 2 2 PBX... 3 3 IP PBX... 4 3.1 How It Works... 4 3.2 Functions of IP PBX... 5 3.3 Benefits of IP PBX... 5 4 Evolution of IP PBX... 6 4.1 Fuelling Factors... 6 4.1.1 Demands from
How to Successfully Select and Implement a Hosted VoIP System Written by Igal Rabinovich, CEO IT Help Central How to Successfully Select and Implement a Hosted VoIP System Page 1 TABLE OF CONTENTS EXECUTIVE
white paper: voice over IP VoIP Migration for Global Business Success How Convergence à la Carte Can Realise the Benefits of Enterprise-Wide IP Communications By Jo Matthew Perrin Nickols and Huib Coomans
Seattle Housing Authority VoIP Replacement Request for Information Table of Contents I. Introduction and Purpose of Request r'or Information... 1 II. Background...2 III. Description of Information Required...
Brand icons C O M M U N I C AT I O N S, S O RT E D. Cloud Connectivity Inbound Mobile VoIP Connectivity Inbound Mobile VoIP Inbound Mobile VoIP Brand icons - reversed Cloud Brand icons - green background
The Business Value of Enterprise SIP - A CIO View Table of Contents Background... 1 What is SIP?... 1 Why SIP?... 1 1. Presence... 2 2. User Centricity vs. Device Bound... 3 3. SIP Trunking and Delivering
White Paper: Managed Network Services Trends for Today s Enterprise Organizations Released December 2010 Spacenet Inc 1750 Old Meadow Road McLean, VA 22102 www.spacenet.com 866-480-2263 1 Table of Contents
Report Number: I332-016R-2005 Security Guidance for Deploying IP Telephony Systems Systems and Network Attack Center (SNAC) Released: 14 February 2006 Version 1.01 SNAC.Guides@nsa.gov ii This Page Intentionally
VoIP Security Best Practice (Version: 1.2) NEC Corporation Liability Disclaimer NEC Corporation reserves the right to change the specifications, functions, or features, at any time, without notice. NEC
SMALL BUSINESS PHONE SYSTEMS OFFER BIG BUSINESS ADVANTAGES Investing in a phone system is an important step for any small business. Your decision to sign up for small business phone service service should
BENEFITS OF SIP TRUNKING FOR CONTACT CENTERS MAY 2013 Executive Overview With strong, consistent growth over the past few years, and continued growth forecasted well into the future, it s no secret that
Cloud Computing: Public, Private, and Hybrid You ve heard a lot lately about Cloud Computing even that there are different kinds of Clouds. And you ve got questions:» What are the differences between Public