BT 2012 Issue 2_8
Table of Contents INTRODUCTION... 3 SERVICE OVERVIEW... 4 BENEFITS OF CHOOSING ENTERPRISE BROADBAND... 5 SERVICE DETAILS... 5 THE WORKPLACE... 5 COVERAGE... 5 ENTERPRISE BROADBAND... 5 ENTERPRISE BROADBAND PRO... 6 LAN LINK M BOLT-ON OPTION... 6 EBB FIBRE... 6 EBB FIBRE PRO... 6 NETWORK AND END USER AUTHENTICATION... 7 END USER IP ADDRESS MANAGEMENT... 7 CUSTOMER PREMISES EQUIPMENT (CPE)... 7 AUTOMATIC ROUTER CONFIGURATION... 7 VIP CARE... 8 END TO END PERFORMANCE... 8 ACCEPTABLE USAGE POLICY... 8 PSTN LINES... 9 CUSTOMER SERVICE... 11 SERVICE PROVISION... 11 SUPPORT OPTIONS... 11 END USER SUPPORT... 11 SERVICE TARGETS... 12 SERVICE ESCALATIONS... 12 SECURITY OF END USER DATA... 12 ROUTINE ACCESS TO END USER DATA... 13 PASSWORD MANAGEMENT... 13 AS PERIMETER SECURITY... 13 FIREWALL SECURITY... 13 SERVER SECURITY... 13 CUSTOMER DATA SECURITY... 13 EMPLOYEE EXIT PROCEDURE... 14 CERT ADVISORIES... 14 PASSWORD CHANGES... 14 LOGFILE SCRUTINISING... 14 NETWORK MONITORING... 14 DATA SECURITY... 14 FURTHER INFORMATION... 14 Issue 2_8 Page 2
Introduction is part of the product portfolio, which includes:, giving customers an easy and flexible way to manage large estates of broadband Internet access lines; Enterprise Connect, giving customers the same management experience as Enterprise Broadband but for broadband access to the customer s existing IP Connect WAN service; and Managed Broadband, a range of professional services to support the customer s rollout and management of either or Enterprise Connect is specifically designed for organisations with a strategic approach to broadband remote working and who plan to have a wide estate of such users / sites in the UK. The product is for use by corporate employees, typically at their home location, or in small site corporate premises. includes a web portal called the Workplace that enables customers to order and manage all their broadband access links through a single, centralised interface. The Workplace offers functions such as adding new users and implementing changes with fault and order tracking. It supports the remote user estate from initial registration through to delivery and connection. It also provides performance statistics, fault reporting and full visibility of progress on installations and repairs. In addition a 24X7 telephone helpdesk is included which helps to support customer internal IT departments specifically for broadband issues. Additionally, end user support option for service assurance is available as a chargeable (per user) option. Issue 2_8 Page 3
Service Overview provides UK ADSL and FTTC access to the Internet for home and remote site workers. This service is available in the following specifications: Product Name 2 2 Pro ** LAN Link M EBB Fibre EBB Fibre Pro EBB Fibre Assured PSTN options Broadband Router purchase options Specification (Downstream IP throughput range*) Rate adaptive up to 24Mbit/s Downstream Rate adaptive up to 1Mbit/s Upstream Rate adaptive up to 24Mbit/s Downstream Rate adaptive up to 1Mbit/s Upstream An optional Bolt-On service for both above Enterprise Broadband options Provides an uplift of the Upstream performance by reducing the achieved Downstream Rate adaptive up to 40Mbit/s Downstream Rate adaptive up to 10Mbit/s Upstream 100Gig / month usage (see Service Details below) Rate adaptive up to 40Mbit/s Downstream Rate adaptive up to 10Mbit/s Upstream 200Gig / month usage (see Service Details below) An optional Bolt-on service for both above EBB Fibre options. Provides an uplift of the assured data download speed to 16Mbit/s Can be ordered in conjunction with either of the above broadband products. Can be ordered in conjunction with either of the above broadband products, or additionally at any time during the term of the service. *These are based on efficient fill of the underlying transport layers in the IP packets. ** 2 Pro has been designed to provide Elevated Prioritisation in terms of data throughput over that of the 2 service. Issue 2_8 Page 4
Benefits of choosing is a powerful teleworking platform that supports employers in implementing a broadband infrastructure initiative with relatively low effort. A comprehensive set of on-line management tools and reports, accessed through the Workplace, speeds ordering and service delivery issues for broadband, through features such as bulk ordering. Service Details This section describes in more detail the features of the offering. The Workplace Corporate administrators can manage aspects of the service through a web-based management tool called the Workplace. The Workplace gives corporate administrators control over the provision of broadband only, or broadband with a PSTN line, or fibre broadband to end users, and enables the initiation of the provision process for either a single end user or for a group of end users, using a bulkregistration tool. Other key features of the Workplace include: Service Control Comprehensive account management tool Service reporting Reports on end users with ability to drill down for details Service Support Problem management tool to track open or escalated issues, backed by 24x7 2nd line support Coverage ADSL services are already available at exchanges serving more than 99% of all UK homes and businesses and more than 99.8% of end users connected to an enabled exchange can now receive broadband services. It is easy to check UK ADSL and FTTC availability at specific locations using the BT availability checker. is aimed at supporting end users who regularly need a fast speed Internet access. ADSL2+ broadband with download access speed up to 24Mbit/s, dependant on local telephone line characteristics; upload speed: typically up to 1Mbit/s. Either wires-only or with a BT Wireless Hub or with a BT Wired Hub Aimed at a single user site Note: where ADSL2+ is not available, or where the line will not support an access speed of greater than 4Mbit/s on ADSL2+, the option will be provided using IPStream Connect, with download access speed typically up to 8Mbit/s, dependant on local telephone line characteristics; upload speed: typically up to 448kbit/s. Issue 2_8 Page 5
Pro Pro has been designed to provide better service performance in terms of network prioritisation than that of the service. ADSL2+ broadband with download speed up to 24Mbit/s, dependant on local telephone line characteristics; upload speed: typically up to 1Mbit/s. Either wires-only or with a BT Wireless Hub or with a BT Wired Hub Aimed at single or multi user site ( 2 to 4) Note: where ADSL2+ is not available, or where the line will not support an access speed of greater than 4Mbit/s on ADSL2+, the Pro option will be provided using IPStream Connect, with download access speed typically up to 8Mbit/s, dependant on local telephone line characteristics; upload speed: typically up to 448kbit/s. LAN Link M Bolt-on option Offers an increase in the Upstream performance, typically up to an additional 1Mbit/s, by reducing the Downstream performance, typically by up to 15% LAN Link M option is only available for short lines, typically those achieving the higher download and upload access speeds. LAN Link M option is only available for those lines that have been provided using ADSL 2. EBB Fibre EBB Fibre is aimed at supporting end users who regularly need a high speed Internet access. FTTC fibre broadband with download speed up to 40Mbit/s, dependant on local line characteristics; upload speed: typically up to 10Mbit/s. 100Gigabit usage / month, access speed will be reduced to 5Mbit/s for the remainder of the month for all traffic on exceeding this usage. Either wires-only (after the Network Terminating Unit) or with a BT Wireless Hub or Aimed at single or multi user site ( 2 to 8) Note: Provision for the Network Terminating Unit (NTU) space and power must be made close to the point of termination of the local line plant. EBB Fibre Pro EBB Fibre Pro is aimed at supporting end users who regularly need a high usage, high speed Internet access. FTTC fibre broadband with download speed up to 40Mbit/s, dependant on local line characteristics; upload speed: typically up to 10Mbit/s. 200Gigabit usage / month, access speed will be reduced to 5Mbit/s for the remainder of the month for non-business traffic on exceeding this usage. Issue 2_8 Page 6
Business traffic (including VPN (IPSec), VOIP, email and HTTP) will remain at the achieved line access speed. Either wires-only (after the Network Terminating Unit) or with a BT Wireless Hub or Aimed at single or multi user site ( 2 to 8) Note: Provision for the Network Terminating Unit (NTU) space and power must be made close to the point of termination of the local line plant. Network and end user Authentication Each customer will have a distinct broadband domain. This domain will be used in all of the customer s end user login accounts to give each user a login name of the format: <btebb/user.id^customer.domain> Customers can manage End User authentication accounts through the Enterprise Broadband Workplace portal. End user IP address management IP address management is available either as dynamically assigned by BT, or consistently served (static IP). There are two static IP options available:- Single Static IP Multiple Static IP - block of 2 useable addresses Multiple Static IP blocks are chargeable options. A Customer may have a mix of any of the above options. Customer Premises Equipment (CPE) CPE can be purchased at any time for direct dispatch to the end users home. Delivery of the CPE will be automatically timed to reach the user before their line is activated. CPE options currently include: Wireless Hub Wired Hub CPE purchased through the product becomes the property of the customer and there are no ongoing rental charges. All CPE is guaranteed for one year. Automatic Router Configuration The Wireless, and Wired Hubs conforms to TR069 protocol, which means when delivered to a user, and on powering up and connecting to the enabled line, they will receive its connection authentication details directly from the configuration server. This obviates the need for users to access the routers set up pages to manually add the details. Note: bulk deliveries of the routers to a single location will not run Auto Configuration, but will require manual configuration. Issue 2_8 Page 7
Equally routers that are not procured through the service will not run Auto Configuration, even if they conform to TR069. VIP Care A VIP Care package is a chargeable option available for those end users who perform a critical role and who need the fastest resolution for any faults. VIP Care has three key elements: Clear flagging of VIPs through the Workplace - to customer IT teams as well as to our own helpdesk Priority handling of new tickets through the helpdesk The use of Care Level 3 to deliver improved clear times Care Level 3 Operates 24 hours a day, 7 days a week including UK Bank and Public Holidays. BT will respond to a fault report within 4 hours of receipt, and will clear the fault within 24 hours. (assuming any engineer access that may be required to any user site is made available within that 24 hours) End to End Performance The end-to-end performance experienced by broadband End Users on the Enterprise Broadband product can be affected by contention at a number of points in the network. Most importantly: The local exchange The EBB Broadband core network The customer's own Internet transit connection and Internet transit provider The customer's own LAN infrastructure, including any secure gateway or concentrator that they might use and, for access to the global Internet, the customer's own proxy servers Contention at the local exchange will depend on the level of capacity provided and on the pattern of use across all broadband End Users, and across all ISPs, at that location. Generally, as most UK Internet usage is residential, contention at the local exchange will be most noticeable during the evenings, typically at around 9pm and during weekends. The EBB Broadband core network is designed to provide a high quality of service to business users. It is unlikely that contention in the EBB Broadband core network will impact End User performance at any time with the possible exception of some specifically targeted protocols (including peer to peer and binary USENET) during the very busiest times of the day. Acceptable Usage Policy is a broadband Internet product for the business market. There are no specific usage limits on accounts and we will not bill customers for excessive usage nor will we disconnect End Users who make heavy use of the service. As a business service, receives the highest priority on our network at all times with particular emphasis being given to business protocols and during business hours. However, the product is not designed for very heavy non-business use, and traffic management rules are applied to constrain the bandwidth available to non-business protocols / applications at certain times of the day in order to protect the level of service provided to our customers. Issue 2_8 Page 8
These bandwidth constraints are applied in two stages. Firstly, rate limits are applied to specific traffic types at specific times of the day. For example, access to YouTube is restricted to 450kbit/s during the working day. Business focused protocols, including HTTP, VOIP, Email and VPN (IPSec) are not rate limited at any time. Equally, upstream traffic is not rate limited at any time. Secondly, after rate limiting, traffic types are mapped into four priority levels for transit through the core network. For example, Peer to Peer and Binary Usenet traffic take the lowest priority; the highest priority is given to VOIP and VPN traffic. The extent to which this prioritisation affects service performance then depends on the aggregate level of traffic on the network. Importantly, traffic with the highest priority would never be expected to experience any delay; traffic at the next priority level, including Email and HTTP, would be affected only under exceptional circumstances. (See below - Exceptional Events) Traffic management rules may be subject to change at any time to further improve service performance. Exceptional Events During short periods of high demand, such as when national or global events drive peaks in Internet usage, we may further constrain peer-to-peer and binary Usenet traffic, and this may be done even during the business day. However, this level of traffic management will be applied only for short periods, and will only affect a small number of (pre-defined) web sites that host non-business related content. During more severe or prolonged events, such as national disasters, peer-to-peer and binary Usenet traffic may be blocked entirely and aggressive rate limits applied to other protocols in order to ensure that VPN and email service levels are maintained at close to normal service at all times during business hours. In any event where one of these two traffic management policies is applied, we will keep customers informed of the action through the Service Status pages of the Workplace portal. PSTN Lines Additionally, customers are able to order PSTN lines for use with. PSTN lines supplied by will not form part of a customer s BT Retail telephony contract, nor will they make any contribution to spend, volume or other commitments under any other BT contract that supplies PSTN. The PSTN lines supplied by are not intended to support outbound calling, there are no call minutes associated or included, although certain types of calls will be possible, for e.g. 0800 / emergency calls and to other none chargeable destinations. Inbound calls will be supported. Customers may wish to terminate their Enterprise Broadband line with an appropriate telephony instrument, none are supplied with the service. PSTN from is therefore intended to be supplied as a data-only supporting line. Issue 2_8 Page 9
Customers who order PSTN lines will not be able to retain them within the service if the associated line is either ceased or migrated to another Service Provider. VIP Care can be extendable to a PSTN line at an additional charge, VIP Care must already exist on the line in order to take this option. Additional ad-hoc charges may apply for non-standard delivery of PSTN, eg for non-served locations, or for temporary or remote sites. Customers with PSTN lines supplied by other providers will be able to migrate the line to, however all of the above conditions shall apply. Issue 2_8 Page 10
Customer Service Service Provision BT will contact the customer after order acceptance to arrange a convenient date for the Workplace training. The training typically takes a little over half a day, and is suitable for up to three members of the customers IT team. The training takes via scheduled on-line training events. Once the training has been completed, the customer will be directed to the Enterprise Broadband Workplace portal to start making use of the service. Support Options Unless the customer has requested End User support, end user problems should initially be reported to the customer s own internal IT support team. Preliminary diagnostics should then be carried out by that team, supported by the on-line fault wizard, which is a feature of the Workplace. Where appropriate, network or service faults can then be passed from the customers IT support team into the service team. This should be via the Workplace ticketing system in the first instance, and can be supported via a phone call to the Enterprise Broadband service team where necessary. End User Support Customers who want their End users to be supported directly by BT may choose the End User Support option. This frees the customer s IT support teams from handling routine fault diagnostics, while leaving them in full control of provisioning and reporting all done through the Workplace. Where a customer has chosen to take the End User Support option, the customer s End users can report faults directly to the helpdesk on 0845 002 0813. This number is available 24 x 7, all year round. Helpdesk agents will answer calls from End Users, connect to the Customer s Workplace portal and work through the Workplace diagnostic system in exactly the same way as would the End User s own IT team. operates a first-touch clear policy wherever possible and so faults will often be cleared without any further call. If it is not possible to clear the fault during the call, the helpdesk agent will give the End user a fault reference, schedule a series of diagnostic checks and end the call with the End user. Once the diagnostic checks have been completed a ticket will be raised on the portal, a helpdesk agent will review the results and, if no fault is found, call the End User back to discuss the next steps. If the diagnostic checks indicate that there could be a fault on the line, the helpdesk agent will raise a fault to our suppliers. During the repair process, the helpdesk agent will call the End User to provide updates where available and, when the fault has been resolved, the helpdesk will call the End User to confirm that the service has been restored to the End User s satisfaction. These proactive updates are the primary way in which End Users are kept informed of repair progress; End Users are requested not to contact the helpdesk to request routine service updates and in any case not to contact the helpdesk within four hours of reporting a fault or receiving a service update. Issue 2_8 Page 11
Further, since the helpdesk agents will log faults on the customer s own instance of the Workplace portal, the customer s IT team will always have full access to all fault tickets and can take control of any fault at any time adding further information, supporting interaction with the End User or escalating the ticket. Fault tickets will always be returned to the IT team for visibility, accountability and auditing, however the helpdesk will update the End User directly via telephone. The tickets need to remain open until the fault is resolved. For escalations of faults the End Users should contact their corporate administrator or the Support Helpdesk who will follow the standard escalation path set out in the Customer Service Plan. Please note that tickets and calls raised by customer IT teams will always take priority over End User fault reports. This means that the level of service provided to customers through the End User Support Option may be marginally lower than that provided directly to the customer IT teams. Importantly, please note that the End User Support option provided with Enterprise Broadband is for fault reports only: End User provisioning support is not available with and so it remains the customer s responsibility to place broadband orders on behalf of end users. This includes re-grade and cancellation requests as well as scheduling appointment for engineer installation, provision of MACs (Migration Authorisation Codes) etc.. Service Targets For all Service Targets, please refer to the latest Customer Service Plan. http://globalservices.intra.bt.com/products/enterprise_broadband/library.html Service Escalations All service issues should initially be raised via the Workplace on-line ticketing system. Where a customer has chosen to take the end user support option then their end users can report faults directly to the helpdesk. However, the customer s IT support team can still use the Workplace to monitor the progress of end user fault reports, and can still use this escalation path to raise the priority of those faults as necessary. For the latest service escalations process, please refer to the Customer Service Plan. http://globalservices.intra.bt.com/products/enterprise_broadband/library.html The service escalation path is for use by a customers internal IT support team only, and not for End-Users. Security of End User Data BT takes very seriously the confidentiality of End User s personal data. This section covers the mechanisms that have been put in place to protect that confidentiality. Issue 2_8 Page 12
Routine Access to End User Data End User data is routinely accessed only through the Workplace environment. Every access to End User information is logged and operations staff are only able to view customer details once they have logged into the Workplace. Access to the Workplace is strictly controlled and only designated computers are allowed access to the environment. Password Management All operations staff only have access to information relevant to their role, and then only to the extent it is necessary. AS Perimeter Security A number of mechanisms are used to protect the integrity of the AS used to hold end user data including restriction of access by protocol (for example, SNMP access from outside the AS is not allowed), control of routing policies and control of access by source address. Firewall Security All servers that have access to centrally held customer data are located behind a firewall. The firewall is configured in the following manner: default action is to deny access through the firewalls ICMP traffic is not allowed through the firewalls only port-specific access is allowed to Internet services provided from inside the Firewalls remote access to the firewalls is not allowed End user data is protected from the Internet by two layers of firewalls (defence in depth). There is no access permitted externally to the database servers. Server Security All servers are secured when they are configured using a server lockdown processes before a server can be scheduled for installation. All access to servers is restricted through the use of passwords. Each server can be remotely accessed only through the ssh protocol, via administration servers (bastion hosts) that are restricted access. This ensures that passwords are never transmitted in plain text and that direct access to servers containing end user data is not possible to enhance security. Management of servers is only permitted from the bastion hosts, and traversal between servers is not possible. Customer Data Security All customer data is stored on the central database servers. These database servers are connected to a non Internet routable network. Only servers behind the firewalls are to be connected to this LAN and access from permitted servers is controlled by network ACLs. Issue 2_8 Page 13
All transactions between the customer and BT that involve the transmission of end user details are conducted through SSL (Secure Socket Layer) web page submissions. All backups of customer data are to be encrypted, whether the backup is to be taken offsite or kept locally. Employee Exit Procedure When BT or its subcontractors become aware that a member of either BT s or its subcontractors staff is going to leave employment, an employee exit procedure is invoked to ensure that they do not have continued access to customer data, customer material or any end user data. CERT Advisories All applicable CERT security advisors are addressed. Password Changes All BT operations staff passwords expire after one month. Staff are required to keep their passwords confidential. Logfile Scrutinising On a daily basis, a selection of server log files is inspected to ensure that no unusual activity has taken place. On discovery of a suspected issue, customers are informed through the Workplace environment and, if appropriate, by email. Network Monitoring On a daily basis all network monitoring reports are reviewed. Data Security All customer data which is input or displayed within the Workplace and Portal applications is run under 128bit Encryption using SSL (Secure Socket Layer). Passwords are normally hashed out and not displayed. Further Information Please contact your account manager for further information and pricing. Issue 2_8 Page 14