Cybersecurity (Zenitel Connect)

Secure communication model in Zenitel Connect. All connections
to and from Zenitel Connect are authenticated, authorized, and encrypted.

Introduction

Zenitel Connect is designed according to secure-by-design principles with security controls enabled by default. The platform implements a zero-trust security model, ensuring that access to systems, devices, and services is granted only after proper authentication and authorization.

Zenitel Connect provides multiple layers of protection, including secure boot, hardware root of trust, software signature verification, encryption, role-based access control, device hardening, audit logging, and secure software management.

This article focuses on cybersecurity features implemented within Zenitel Connect. For network architecture recommendations, trusted and untrusted network design, risk assessment, and deployment hardening best practices, refer to the Zenitel Connect Hardening Guide.

Security Management

Platform Security

Zenitel Connect servers implement Secure Boot and Hardware Root of Trust technologies.

These mechanisms ensure that only trusted and verified software can run on the platform. During software installation and upgrades, software packages are validated using trusted cryptographic signatures. Software that fails signature verification is rejected, helping prevent unauthorized or tampered software from being installed.

Certificate management

Unencrypted HTTP access (port 80) to Zenitel Connect is disabled.

When users attempt to access the web interface using HTTP, they are redirected to an onboarding page where the Zenitel Connect CA certificate can be downloaded.

The ICX510 server includes a certificate store for X.509 certificates and secrets used by secure protocols such as TLS. Zenitel recommends using dedicated certificates and secrets for each installation.

For more details, see

Media Encryption

Audio and video communication between Zenitel Connect and connected devices is encrypted by default. This protects media streams against unauthorized interception and helps ensure the confidentiality and integrity of voice and video communications throughout the system.

Encryption is also supported for external communications such as SIP trunking and IP telephony integrations through industry-standard protocols including TLS and SRTP, where supported by the connected systems.

Internal Firewall

Zenitel Connect includes an internal firewall that supports inbound access rules on a per-interface basis.

After deployment is completed, Zenitel recommends disabling all unused ports and protocols on both Zenitel Connect and connected devices.

For more details, see Firewall.

Out-of-Band Management

Zenitel Connect supports separation of operational and management traffic. Management access can be enabled or disabled independently on each network interface.

This allows devices to operate on untrusted or exposed networks while restricting system administration to dedicated management networks. Even when HTTPS access is allowed by firewall rules, management access can be disabled on specific interfaces.

To prevent accidental lockout, Zenitel Connect always maintains at least one reachable interface with management access enabled.

For more details, see Network Interface Configuration.

Time Synchronization

Accurate and consistent time settings across all network devices are essential for:

Incident investigation
Event correlation
Audit logging
Security monitoring

Zenitel Connect supports both internal and external NTP servers.

The Zenitel Connect server acts as an NTP server for enrolled devices, ensuring consistent timestamps throughout the system.

To protect time synchronization from tampering and spoofing attacks, Zenitel recommends using Network Time Security (NTS) whenever available.

For more details, see Time Settings.

User Management

Users and roles

Zenitel Connect provides the following user roles:

Administrator
Zenitel Link User
Read-only User

The Administrator role is used for configuring the system and devices. The administrator account cannot be deleted, renamed, or disabled. It is recommended to use dedicated user accounts for system administration.

Integrations requiring read and write access must use a dedicated Zenitel Link User account.

For more details, see User management.

Password Policy

All user passwords must:

Be at least 12 characters long
Contain at least one uppercase letter
Contain at least one lowercase letter
Contain at least one number
Contain at least one special character

When devices are enrolled in Zenitel Connect, several security measures are automatically applied:

Default device passwords are replaced with strong passwords.
Individual SIP passwords are assigned to each device.
Unused device firewall rules are disabled.

Session Management

To reduce the risk of unauthorized access:

Users are prompted to change their password during first login.
Users are automatically logged out after 30 minutes of inactivity.
After five consecutive failed login attempts, the account is temporarily locked.
The initial lockout period is 5 minutes. Continued failed login attempts result in progressively longer lockout periods.

Device Password Protection

Access to device passwords is restricted to users with Administrator rights.

To reveal a device password, the administrator must click on the Eye icon in the device configuration screen, and re-enter their own password to confirm the action.

Following successful verification, additional device passwords may be revealed for the next 10 minutes without re-authentication.

External Communication and Services

Zenitel Link

Zenitel Link is composed of two different interfaces:

REST API for requesting information and initiating call or device operations.
WAMP API for the same operations, including event subscriptions and real-time notifications.

Zenitel Link uses encrypted communication channels by default and requires authentication using a dedicated Zenitel Link user account.

Zenitel recommends creating separate Zenitel Link accounts for each integration to support the principle of least privilege and improve traceability.

For more details, see Zenitel Link

SIP Trunking

Zenitel Connect can interconnect with external SIP servers, such as IP-PBX systems and call managers, using SIP trunk connections.

To help protect signaling and media traffic, Zenitel Connect supports:

SIP authentication using usernames and passwords.
Separate inbound and outbound SIP authentication credentials.
Secure SIP signaling using TLS.
Secure media transport using SRTP (Secure RTP).

When supported by the connected SIP platform, Zenitel recommends enabling both TLS and SRTP to protect communications against unauthorized access, interception, and tampering.

Depending on the deployment, SIP trunks can be configured with or without SIP registration. Authentication should always be enabled when supported by the peer system.

For more details, see SIP Trunk.

IP Telephony service

The IP Telephony Service enables Zenitel Connect to communicate with SIP service providers and the public telephone network without the need for external gateway hardware.

Zenitel Connect supports standard SIP security mechanisms, including:

SIP authentication using provider-supplied credentials.
Encrypted SIP signaling using TLS, where supported by the SIP service provider.
Encrypted media streams to protect voice communications from unauthorized interception.
Configurable restrictions on incoming and outgoing calls using Call Services.
Whitelisting of approved incoming telephone numbers.
Control of operator functions such as door opening through permission-based access control.

Zenitel recommends:

Using TLS for SIP signaling whenever supported by the SIP provider.
Enabling media encryption whenever supported by the SIP provider.
Restricting incoming calls to known and trusted telephone numbers where possible.
Applying least-privilege principles through Call Services and user permissions.
Reviewing call permissions regularly to limit unauthorized access to external telephony services.

See IP Telephony service for details.

System Monitoring

Logging and Auditing

Zenitel Connect provides logging capabilities that support operational monitoring, troubleshooting, auditing, and incident investigation.

Logs may be stored locally or forwarded to a remote Syslog server using RFC 5424-compliant formatting.

Zenitel recommends regularly monitoring logs for signs of suspicious activity and security-related events.

Recommended Log Levels:

System log: Information
Audit log: Information
Call log: Information
Debug log: Off

For more details, see Logging.

Security Monitoring

Security monitoring helps identify unauthorized access attempts, configuration changes, service interruptions, and other abnormal system behavior.

Zenitel recommends forwarding logs to a centralized logging or monitoring solution when available and reviewing audit logs regularly as part of ongoing cybersecurity management.

Software Management and Disaster Recovery

Software management

It is strongly recommended to use the latest firmware versions for Zenitel Connect servers, devices, and other network components.

Keeping systems up to date helps ensure that the latest security fixes, stability improvements, and feature enhancements are applied.

Software updates for Zenitel Connect servers and native Zenitel devices can be performed directly from the Zenitel Connect web interface.

To preserve system integrity, all software packages are verified using trusted cryptographic signatures before installation. Software that fails verification is rejected.

For more details, see:

Backup and Recovery

Regular backups are essential for recovering from hardware failures, configuration errors, and cybersecurity incidents. Zenitel Connect provides built-in functionality for creating backups of the system configuration and restoring them to the original server or to a replacement server.

Backup files contain system configuration, users, device configuration, certificates, and encrypted passwords and PINs. A backup file alone is not sufficient to restore encrypted data. Full recovery requires the administrator credentials from the original system in addition to the backup file.