Enterprises are upgrading from Microsoft OCS to Lync

Upgrading from
Microsoft OCS to Lync
The Ideal Time to Address Your Social Business Needs

Executive Summary

Microsoft Unified Communications (UC) users are migrating from Office a single mouse click. These advances make Lync UC more valuable to
Communications Server (OCS) to Microsoft Lync to take advantage of the corporations, putting sales in real-time contact with potential customers,
many new features incorporated into Lync, especially new voice features enhancing support for existing customers, enabling hiring managers to
such as support for common area phones, enhanced emergency service contact prospects and work with new hires, and allowing marketing to
(E-911), new VoIP support that makes Lync a suitable replacement for engage with prospects in a new way. As UC value and access expands
PBX, and new voice features for select public instant messaging platforms. beyond the enterprise to embrace public networks, so do the concerns over
Where Microsoft OCS delivered federation for different consumer UC managing access for security and compliance.
platforms so users could connect in real-time using instant messaging
and chat, Microsoft Lync adds Public IM Connectivity (PIC), giving users As enterprises deploy Lync to take advantage of richer communications

integrated voice with public instant messaging (IM) platforms such as Live with public IM networks and UC clients, it creates a need for more robust

Messenger which now supports more than 300 million users. Microsoft’s security. Migration from Microsoft OCS to Lync is the ideal time to assess

acquisition of Skype, which now boasts about 700 million users, promises the security of your unified communications, especially as it relates to an

to extend Lync access even further. open federation strategy and access to public networks. This white paper
will discuss potential weaknesses in enterprise security and compliance
At the same time, enterprises are seeing a growth in other social media that can accompany Lync migration and federation and will offer some
applications. LinkedIn now has more than 160 million users, making it strategies to address those weaknesses.
one of the most valuable online destinations for business research and
contacts, and something that IT managers need to be concerned about
as part of their UC strategy. Similarly, Facebook now has more than 900
million users and continues to gain momentum with business users as
well as consumers, and soon you will be able to send messages and even
initiate voice contact and even Skype video chat from within the
Facebook environment.

With enhanced PIC support with Live Messenger and other clients,
the promise of Skype integration and social media access, Lync users now
have the potential to connect to more than one billion consumers with

2 | Upgrading from Microsoft OCS to Lync 3 Upgrading from Microsoft OCS to Lync | 3

The Case for Lync Migration and UC Federation

Organizations looking to hone their competitive edge are relying more on Lync 2010 and recent add-ons such as Microsoft XMPP Gateway and
Unified Communications (UC) to support collaboration both within their third-party federation products such as NextPlane offer more integration
enterprise networks and through UC federation. Migrating to Lync offers and more connectivity options to accommodate federation and integration
an even richer communications experience with greater productivity and with public IM and UC platforms. What makes Lync 2010 attractive to
cost savings thanks to new and enhanced UC features. Deploying UC many users is enhanced support for integrated voice communications.
enables real-time communication using instant messaging/chat, group Microsoft is promoting Lync 2010 as the UC solution that works across
conferencing, file transfer, whiteboard applications, mobile conferencing, platforms and devices, encompassing PC, Macintosh, browsers, mobile
and voice and video. platforms, and even desk phones so users can make the same voice-
over-IP (VoIP) calls from their phone or workstation. Lync also enables
As an organization begins to benefit from UC, the circle of real-time integrated conferencing services so workstation users have full audio,
collaboration typically expands to encompass additional UC platforms, video, and web conferencing.
such as Microsoft OCS or Lync, IBM Sametime, and Cisco Unified
Communications Manager. UC federation extends to both private and Lync also can interoperate with PSN, SIP trunks, and PBXs from vendors
public UC platforms to make it easier to communicate with partners, such as Cisco, Siemens, Avaya, and Mitel so Lync can deliver real savings
suppliers, customers, and third parties. According to the latest sixth to PBX users. Centralizing administration of a few centrally located
annual research report produced by Actiance, “The Collaborative Internet: Lync pools for VoIP versus managing individual PBX systems in each
Usage Trends, End User Attitudes & IT Impact,” organizations that have branch office makes it possible to leverage SIP trunking, which is much
chosen to federate their UC platforms are doing so with business partners less expensive than legacy PSTN T1/E1 links. And Lync has the added
(66%), customers (46%) and IT vendors (45%), as shown in Figure 1. advantages of providing a common platform for email, IM, voice, video,
application sharing, and conferencing.
With whom do you federate?
A recent report in IT Knowledge Exchange indicated that:

“Sprint has saved $2.5 million in avoidance of PBX upgrade costs,
$6.7 million in recurring circuit costs and $4 million in cost avoidance for
conferencing since the installation of Lync. The company has even been
able to earn some green savings – $700,000 annually because it doesn’t
have to power and cool old PBXs anymore.”

Figure 1. Corporate Usage of UC Federation for Realtime Collaboration


Considerations for UC and Federation Security

Lync mobile clients also extend telecommunications support further to Lync was designed to provide a rich, easy-to-use unified communications
handheld devices such as Windows Phone, Apple’s iPhone, the Android, experience, and federating Lync with partner, suppliers, customers,
and Nokia mobile devices. and public networks is where users realize more productivity and achieve
real ROI from their Lync investment. Enterprise infrastructures tend to
And Lync 2010 features much more robust support for public IM standardize on a single UC system and then recoup their investment by
connectivity, providing interoperability with AOL Instant Messenger (AIM), adding other UC platforms for specialty applications (e.g., public IM
.NET Messenger Service, Live Messenger, Yahoo! Messenger, and Google systems, VoIP, and Web 2.0 applications). And with the enhancements
Talk. By design, Lync breaks down the barriers between enterprise and in Lync 2010, that list now includes more public IM and
public communications, making it as easy to connect with external IM communications platforms.
users as it is to chat with contacts within the enterprise. And Lync Server
has an Extensible Messaging and Presence Protocol (XMPP) gateway that According to Actiance’s research report, there has been a significant
can federate with external XMPP servers such as Google Talk and Jabber. spike in corporate UC adoption. According to the 2011 survey, 63% of
respondents have a UC platform deployed in 2011, compared with 34%
And there is the promise of Skype. Microsoft has committed to extend in 2009 and 29% in 2008 (see Figure 2). And many of these UC systems
Lync support for Skype. Microsoft has not disclosed how tightly it will are rapidly extending their reach outside the enterprise through federation
integrate Lync and Skype, but it seems likely integration will be on a par with other private and public UC infrastructures.
with Live Messenger. Full integration with Skype would extend the reach
for Lync users worldwide. Integration with Skype also would clearly give
Lync users ready access to almost anyone they need to connect with
UC deployments (% of respondents)
immediately.

The good news is that all these new Lync 2010 capabilities deliver a
richer UC experience and promote seamless connectivity to platforms and
partners beyond the enterprise. The bad news is that this same seamless
connectivity opens new channels for a potential malware attack or data
leaks. The technology that enables creation of an open UC platform to
promote better real-time communications is the same technology that
creates new vulnerabilities. The challenge facing IT management is finding
the right solutions to manage this new open UC infrastructure, to promote
better security against malware from an unmanaged or public source, and
Figure 2. Increase in UC deployment for Corporations
to filter and archive all the UC data traffic for regulatory compliance.

6 | Upgrading from Microsoft OCS to Lync 7 | Upgrading from Microsoft OCS to Lync Upgrading from Microsoft OCS to Lync | 7

Federating multiple UC platforms to create an open communications and 20 percent log in from their work location. The same survey shows
architecture is good for business and challenging for network that 79 percent of respondents indicated their organization maintains a
administration. Organizations are susceptible to both inbound threats corporate Facebook web page, 61 percent are on LinkedIn, 61 percent
from viruses, malware, and phishing attacks and outbound threats from are on Twitter, and 46 percent are on YouTube.
data breaches and inappropriate use of federated UC links. With greater
connectivity to outside platforms comes greater risk, particularly from However, training users to be safe online is an ongoing challenge.

public and uncontrolled network sources. Employees are bringing their bad home computing habits to the office.
In a culture increasingly dominated by photo and file sharing and open
According to Irwin Lazar, vice president for communications and online conversation, it’s no wonder that employees put corporate data
collaboration research at Nemertes Research, most enterprise users see UC and intellectual property at increasing risk from data leaks and malware.
and VoIP as closed systems and therefore not subject to attacks. However, According to a report by Deloitte-NASCIO, among state workers, 55
new trends in SIP trunking, cloud adoption, and employee BYOD (bring percent of data breaches were accidentally generated from within the
your own device) are increasing the security risks for UC platforms. In a organization, and 40 percent were due to malware (see Figure 3).
recent article published in Search Unified Communications, Lazar writes:

“IT managers can no longer afford to hide behind the PSTN-as-a-fire- Sources of Internal Breaches of State Networks
Accidental acts by employees and malicious software caused the greatest
break approach to UC security. In order to minimize the risk of data loss number of internal breaches with state organizations and more than 20%
or service disruption, it’s important to have a proactive strategy that of state CIOs say they have had no internal breaches.

addresses emerging security threats, integrates UC security with the
broader overall enterprise security architecture, and leverages specific
tools and/or services to mitigate threats from SIP trunking, cloud services
and mobile devices.”

Increased use in social media platforms for business is stretching IP
security even further. There are several reasons for businesses to leverage
social media. For example, new survey from CareerBuilder shows that 37
percent of businesses are using social media to research job candidates.
According to Actiance research, social media use is found in 100 percent
of the organizations surveyed, and more than 90 percent of users reported
maintaining profiles on one or more social networks. What’s more, 66
Source: 2010 Deloitte-NASCIO Cybersecurity Study
percent said they log into their social media site at least once a day,
Figure 3. Sources of security breaches

8 | Upgrading from Microsoft OCS to Lync | Privacy Controls for Facebook 9 Upgrading from Microsoft OCS to Lync | 9

The cost of the damage from data leaks, whether inadvertent or malicious, Social Networking in Regulated Industries
continues to rise. Recent research from PGP Corporation and the Ponemon
Institute released in the annual “U.S. Cost of a Data Breach Study”
reveals that corporations paid an average of $5.5 million per data breach
last year.

And then there are the issues concerning regulatory compliance. According
to Actiance’s latest study, use of public networks and social media in
regulated industries is on the rise (see Figure 4). Those surveyed indicated
that there is a steady increase in the use of social networking in regulated
industries such as banking, healthcare, energy and government. The
result is a higher risk for regulated organizations that are not taking steps
to secure their federated UC channels for compliance. Guidelines issued
Figure 4. Use of Social Networks in Regulated Industries
by Sarbanes-Oxley (SOX), the Financial Industry Regulatory Authority
(FINRA), and the Financial Services Authority (FSA) indicate that all
electronic communications, including those over enterprise UC, federated Securing UC as Part of Lync Migration
UC channels, and public UC channels, need to be preserved and archived.

What’s interesting is that the same Actiance survey also found that in
New features in Microsoft Lync provide compelling reasons to expand the
regulated industries, social media, collaboration tools, and UC channels
enterprise infrastructure and UC deployments, including federation with
are not applying the same level of compliance procedures as traditional
strategic partners and expansion to include public UC networks. The new
forms of electronic communications, such as email. All electronic
capabilities added for voice and video over Live Messenger (and soon for
communications, including chat, instant messages, web conferences,
Skype) as well as support for public networks means that data traffic will
social media posts, and Tweets, all fall under compliance mandates set
transit your enterprise network from any number of unmonitored sources.
by industry regulators. However, the research indicates that these are not
Now is the time to review your UC security strategy.
being monitored or archived for regulatory compliance.

Security needs to be established at the enterprise perimeter to filter
both inbound and outbound data traffic. We recommend a centralized
approach to monitor all UC collaboration and social media/Web 2.0
content to provide granular security and policy controls over all real-time

10 | Upgrading from Microsoft OCS to Lync 11 | Upgrading from Microsoft OCS to Lync Upgrading from Microsoft OCS to Lync | 11

communications traffic. This allows you to monitor conversations within More malware is making its way into real-time communications channels,
the enterprise for data leaks and regulatory compliance. bypassing conventional antivirus and anti-malware security measures.
With more access to IM public networks such as Yahoo!, AIM, Google
Microsoft has its administrative management console, including basic Talk, Windows Live, and Skype, there are more potential risks from
support for managing Lync federation. Lync 2010 provides controls inbound threats such as malware. SpIM (spam over IM) is also becoming
for Microsoft Lync Online users to communicate with other Lync users, more prevalent in the data stream, creating new risks for federated
including control over which domains to federate with, which domains enterprise users. Lync migration is a perfect time to fortify your UC
to block, and enabling or disabling domain federation. However, you still malware protection against real-time threats. The same proliferation in
need to monitor and archive the data traversing those federated and the use of communications through public IM channels, either through
PIC connections. the Lync client with PIC or directly through public IM clients, increases
the risk of outbound data leaks. Unmonitored IM and UC channels can
With federation, there are more possibilities built into the infrastructure
open up new channels to leak sensitive proprietary corporate information
for a richer real-time communications experience. For example, now
and competitive data, so data monitoring to prevent outbound leaks and
you can make audio and video calls to a Windows Live contact. You can
threats also needs to be part of your Lync migration strategy.
call from a SIP-enabled handset or your desktop system, share screens,
exchange files, or add other parties via VoIP or chat. Regulatory compliance also has become part of federated UC
environments. There are more than 10,000 laws relating to electronic and
While Microsoft’s management utilities make it easier to manage
real-time communications overseen by agencies such as the Securities
connections, e.g., blocking certain lines from making long-distance calls,
and Exchange Commission (SEC), FINRA, Sarbanes-Oxley, the Federal
controlling call routing and VoIP access, blocking calls from specific
Rules of Civil Procedure (FRCP), and the Federal Energy Regulatory
domains, or managing bandwidth and quality of service (QoS), you still
Commission (FERC). The penalties for non-compliance can be costly, up to
need to manage content and access at global, group, and user levels.
millions of dollars in fines, not to mention the loss of intellectual property
As part of your security strategy, you need to be able to manage Active
and corporate reputation. To protect your organization in the event of a
Directory, IP, and domain-based policies as well as control VoIP, voice,
regulatory audit, you need the means to archive and search IM chat and
IM, group chat, and data conferencing. You also need to add a solution
UC conversations. Depending on your industry and UC environment, you
that supports policy setting, limits file uploads, and supports data loss
may also need the means to establish ethical walls between departments
prevention (DLP), content filtering, and malware protection. A strong
and configure “poison room” policies for federated Lync chat and web
security and compliance system will enable you to apply role-based
conferencing to prevent ethical breaches. And you want to be able to add
access controls and policy management across multiple UC platforms
disclaimers and other legal protections to outbound IM communications.
beyond Lync.


And you will need tools to monitor UC traffic as well as manage it. and community networks. Vantage provides granular content filtering
Where are the potential threats originating from? Are there employees and archiving of all conversations, ensuring an audit trail for data leak
who habitually try to violate security and compliance policies? You need prevention, compliance and e-Discovery. Actiance Vantage is used by the
tools that provide visibility into your overall UC infrastructure, including world’s largest firms to secure, manage, and ensure that the use of instant
the ability to generate regular reports to identify potential weaknesses and messaging and other real-time communications applications comply with
choke points and to bolster your case in the event of a regulatory audit. corporate security policies and government regulations. Organizations
Without adequate visibility, you cannot effectively manage your federated choose Actiance Vantage because it provides a number of benefits:
UC infrastructure, nor can you demonstrate to regulatory auditors that
•• Built-in support for both Microsoft Lync Server and OCS allows for
you are both secure and compliant.
flexible migration paths

•• Identity management with policy control at global, group, and
Adopting Actiance to Manage individual employee levels
Lync Traffic as Part of Migration •• Guaranteed TrueCompliance™ to meet corporate policies and
government regulations

•• Archival of file transfers over Lync Server into WORM storage
As part of Lync migration, you want to filter for all of your federated
•• Advanced content filtering and keyword blocking to prevent loss of
UC traffic for both security and compliance. You need a central point in
confidential information
your federation architecture that gives you visibility over all collaborative
applications and conversations; allows you to filter traffic for malware •• High availability and load-balancing deployment increases security and
and data leaks; and that allows you to enforce acceptable usage policies reliability of existing real-time communications infrastructure
both within your enterprise network and with external, public UC systems. •• Export to third-party email archiving systems

•• Centralized reporting and customizable reports
Actiance Vantage and Unified Security Gateway (USG) have been
designed to integrate into a typical Microsoft Lync-enabled network to •• Enforcement of ethical walls
control, monitor, and maintain all IM conversations, collaboration, •• Comprehensive solution for preventing user circumvention of Lync
and Web 2.0 traffic.

Actiance’s Vantage provides granular security and compliance features
and policy controls for Microsoft Lync Server 2010, OCS, and other unified
communications platforms, such as alongside public instant messaging


When combined with USG, users can gain total control over enterprise (You can configure your UC traffic manager at the Lync Edge Server, but
IP traffic. USG is the only Secure Web Gateway to combine feature and such an architecture only allows you to monitor external conversations,
content controls of social networks with the monitoring, management, which leaves the organization vulnerable to internal abuse.) Vantage
and security of Web 2.0 applications. USG provides granular control of manages all policies, storing backend data in a Microsoft SQL database
not only websites and applications but also the content posted to and using queries to Active Directory to apply policies to users and groups.
blogs, wikis, webmail, and social networking sites such as Facebook, Actiance Lync Connector is installed on the Lync Front End Servers as a
LinkedIn, and Twitter. small Connector Agent service. Content filtering and archiving is provided
by pushing messages for archiving using Microsoft Message Queuing.
In a typical Lync management configuration, Vantage runs on Microsoft
Windows Server and connects directly to the Lync Front End Servers Policies are defined within Vantage and regularly pulled from the Lync
to monitor all data traffic, both inbound and outbound, including Front End Servers. Once the baseline policy and global defaults are
conversations originating inside and outside the enterprise (see Figure 5). configured, exceptions can then be defined for different individuals and
groups of users, including which groups can intercommunicate. Vantage
integrates with Active Directory; thus, policies leverage user information
mapped from Active Directory such as user names, SIP uniform resource
identifiers (URIs), and phone numbers. Once conversation transcripts
are received by Vantage, they are parsed and written into the backend
SQL database.

Actiance USG can be integrated into the infrastructure with a
Web/FTP proxy server, such as Blue Coat or a Squid proxy, through
an ICAP-based connector. It also can be installed in simple passby
mode – a plug-and-play deployment that requires no change to network
configurations. Any applicable Vantage polices are applied to the user,
and any unauthorized applications will be blocked by USG.

Figure 5. A typical UC architecture secured by Vantage and USG


Using Vantage with USG, you can manage and monitor all data traffic Since the Actiance Agent is deployed on the Lync Front End server,
flowing through internet connections, including federated and PIC UC Vantage has visibility into all user activity and communications and can
systems. When internal Lync users communicate with users inside or monitor and report on overall Lync usage. Some of the reports include the
outside the enterprise through a Lync Edge Server, all the traffic is routed number of users currently online, number of sessions by modality, and
through the Front End Server running the Actiance Connector Agent. usage trend reports – information that can help you measure Lync adoption
That means all traffic is scanned: and identify points of weakness. Vantage also lets you filter on usage by
employee groups, time period, and modalities used for more granular
•• Viruses, malware and other file types are filtered or blocked results and to provide ROI metrics.

•• Policies are applied using settings for individual users or using Active
With respect to social media, Actiance offers the Socialite platform to
Directory, such as:
enable the use of networks like Facebook, LinkedIn, and Twitter safely
–– Allow or block Lync functions such as Live Meeting, Voice, or Video
within the organization. Socialite helps organizations protect their brand
–– Allow or block text or regular expressions in an IM conversation,
and ensure compliance while allowing employees to share relevant
such as a credit card pattern or a phrase
content, measure impact, and increase engagement to grow their business.
•• Disclaimer messages can be added to IM messages Socialite controls access to more than 200 features across the above three
•• Conversation and UC event transcripts can be sent to Vantage for networks but can also moderate, manage, and archive any of their traffic
handling, such as: routed through the solution.
–– IM content, including disclaimers
–– File transfers
–– Call detail records for voice calls and Lync conference sessions
and other communications


Best Practice in Securing Lync

By filtering all your Lync traffic from both sides of the firewall, you not only Adding new services and extending reach through federation bring
secure your federated UC systems today, but you are also ensuring that additional security challenges to any enterprise. With the right filtering
your infrastructure remains relevant in the future. technology in the right location within your network architecture, you can
filter content, inject disclaimers where needed, effectively manage data
Choose a platform that allows you to monitor Lync traffic and that can access and traffic, and archive conversations that may be essential in case
monitor additional UC traffic in case users access Live Messenger and of an audit. So as you migrate to Lync 2010 and are considering ways to
Skype directly. It also is important to choose a security and compliance manage and secure your infrastructure, consider this three-step process:
platform that supports collaboration from applications like SharePoint
and Jive, as well as communications and collaborations from social 1.0 ain visibility over the entire infrastructure, including all conversations
G
applications such as Facebook, LinkedIn, and Twitter. across the entire UC spectrum – those supported by Lync and within
the enterprise, those between Lync and public networks, and even
As Lync continues to evolve with deeper integration into enterprise and public IM to public IM.
public messaging platforms, embracing more UC features and even
adding support for potential integrations (e.g., Skype conversations over 2. reate acceptable usage policies that control the flow of conversation,
C
Facebook), you will have an infrastructure in place that is ready to both inside and outside the organization, and have the technology in
secure new Lync capabilities. place to monitor and enforce those policies.

Remember that while most businesses are seeking a single platform on 3. eploy the means to block unauthorized access, prohibited
D
which to standardize their UC, some of the real value of UC is federating applications, and inappropriate conversations, while enabling those
with partners and third-parties or accommodating other UC platforms collaborative connections that are in line with your organization’s
such as IBM Sametime or Cisco Unified Communications Manager (i.e., communications objectives.
accommodating multiple UC platforms). And it is becoming increasingly
difficult to head off BYO UC, where employees adopt their own IM,
Skype, or Facebook. In fact, the number of Web 2.0 applications being
used by business has been rising steadily every year since Actiance
started tracking corporate usage of Web 2.0 applications in 2005.


About Actiance

Enterprises are looking to adopt platforms like Microsoft Lync to enable Actiance enables the safe and productive use of Unified Communications
users to improve productivity and the company to realize cost savings. and Web 2.0, including blogs and social networking sites. Actiance’s
As Microsoft Lync showcases its value for collaboration, enterprise award-winning platforms are used by more than 1,600 customers for
managers are seeking to expand that value by federating with other private the security, management, and compliance of unified communications,
and public UC platforms. Real-time communications and collaboration, Web 2.0, and social media channels. Actiance supports or has strategic
including rich presence, IM, Voice, Video, application sharing and partnerships with all leading social networks, unified communications
conferencing across the enterprise, partners, suppliers, customers and providers, and IM platforms, including Facebook, LinkedIn, Twitter,
consumers, is the most dramatic change to enterprise communications AOL, Google, Yahoo!, Skype, Microsoft, IBM, and Cisco.
since email. However, with the added complexity of supporting multiple
modalities and applications comes more concern over enterprise security. Actiance is headquartered in Belmont, California. For more information,

Just as with the expansion of email, enterprises need to maintain visit www.actiance.com or call 1-888-349-3223.

vigilance to protect their UC infrastructures. Actiance Vantage and USG
enable enterprise users to realize the benefits of UC communications
and online collaboration without compromising security.

22 | Upgrading from Microsoft OCS to Lync | Privacy Controls for Facebook 23 | Upgrading from Microsoft OCS to Lync Upgrading from Microsoft OCS to Lync | 23

Worldwide Headquarters EMEA Headquarters
1301 Shoreway, Suite 275 400 Thames Valley Park
Belmont, CA 94002 USA Reading, Berkshire, RG6 1PT UK
(650) 631-6300 phone +44 (0) 118 963 7469 phone
info@actiance.com emea@actiance.com

This document is for informational purposes only. Actiance makes no warranties, express or implied,
in this document.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights
under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system,
or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise),
or for any purpose, without the express written permission of Actiance, Inc.

© 2001 - 2012 Actiance, Inc. All rights reserved. Actiance and the Actiance logo are registered trademarks
of Actiance, Inc. Actiance Vantage, Unified Security Gateway, Socialite, and Insight are trademarks of
Actiance, Inc. All other trademarks are the property of their respective owners.

Enterprises are upgrading from Microsoft OCS to Lync

More Related Content

What's hot (20)

Similar to Enterprises are upgrading from Microsoft OCS to Lync (20)

More from Actiance, Inc. (16)

Recently uploaded (20)

Enterprises are upgrading from Microsoft OCS to Lync