User's Manual

Security
For information about toll fraud, see the respective call server documents on the Avaya support
web site. The Avaya B189 Conference phones cannot guarantee resistance to all Denial of
Service (DoS) attacks. However, checks and protections are in-built to resist such attacks while
maintaining appropriate service to legitimate users.
All Avaya B189 Conference phones support HTTP authentication for backup and restore
operations. The reprogrammable non volatile memory stores the authentication credentials
and the realm. The reprogrammable nonvolatile memory is not overwritten if new phone
software is downloaded. The default value of the credentials and the realm are null, set at
manufacture and at any other time that user-specific data is removed from the phone or by the
local administrative (Administration Menu) CLEAR procedure.
If an HTTP backup or restore operation requires authentication and the realm in the challenge
matches the stored realm, the stored credentials are used to respond to the challenge without
prompting the user. However, if the realms do not match, or if an authentication attempt using
the stored credentials fails, the user is then prompted to input new values for backup/restore
credentials.
If an HTTP authentication for a backup or restore operation is successful and if the user ID,
password, or realm used is different than the values currently stored in the phone, the new
values will replace the currently stored values.
You also have the following options to restrict or remove how the deskphone displays crucial
network information or uses the information. For more information on these options, see
Server
Administration on page 39.
• Support signaling channel encryption.
Note:
Signaling and audio are not encrypted when unnamed registration is effective.
• Restrict the response of the Avaya B189 Conference phones to SNMP queries to only IP
addresses on a list you specify.
• Specify an SNMP community string for all SNMP messages the phone sends.
• Restrict the ability of the user to use a phone Options application to view network data.
• Compliant with IETF RFC 1948 Defending Against Sequence Number Attacks, May 1996,
by S. Bellovin. from Release 1.5 onwards.
• Apply the security-related parameters, SNMP community string (SNMPSTRING), SNMP
Source IP addresses (SNMPADD), and (Administration Menu) Access Code
(PROCPSWD) that is administered on the call server. Download the file with encrypted
signaling in addition to unencrypted HTTP or encrypted HTTPS
Network Requirements
36 Administering Avaya B189 Conference IP Phone December 2013
Comments? [e-mail]