<div dir="ltr"><div>Sorry for the late reply.</div><div><br></div>The requirements were stated in writing and an SOW was created out of that but the requirements were missing (and we missed it wasn't in there at signing). The security scan is what reminded us to put on the defect tracker. However, had it been in there they would had shot it down because they are refusing to adhere to modern day security practices. Their words not mine. I'd cut and paste what they stated word for word and include the person's name and e-mail but I think that would be going too far.<div><br></div><div>We were already contracted with their services before this project to move to UCCE so we really didn't have a choice but use them regardless of their stance on security. Once the contract expires we'll be looking at whether speech enablement and and their our services are truly needed going forward.</div><div><br></div><div>I'll start a new thread but I'm wonder what everyone's take is on speech enabling their IVR and if the juice is worth the squeeze.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 10, 2015 at 2:49 PM, Jason Aarons (AM) <span dir="ltr"><<a href="mailto:jason.aarons@dimensiondata.com" target="_blank">jason.aarons@dimensiondata.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Did you put out an Enterprise RFP and require HTTPS in the design phase
</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1f497d">J</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">I would recommend you submit a product enhancement request to the Nuance Account Manager and involve them. I’m sure it’s on a list somewhere to-do you just need
to give them a business reason that is 7 figure. A Enterprise CIE telling them you’re putting it on hold and stopping payments usually gets noticed.<u></u><u></u></span></p>
<p class="MsoNormal"><a name="150f3602fe6e2c8e__MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></a></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Jon Shay<br>
<b>Sent:</b> Tuesday, November 10, 2015 1:16 PM<br>
<b>To:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b> [cisco-voip] Nuance And Their Lack of Enterprise Security<u></u><u></u></span></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Anyone use Nuance in their Contact Center(s)? We have been for a handful of years between two different ACDs. We're in a current project moving from one ACD to a new ACD vendor and an interesting tid-bit came out during a security vulnerability
scan.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Most if not all of the interfaces to their applications are web-based and the scan identified one of their products using HTTP instead of HTTPS. We asked them to secure it and here is what they said - "No. It is designed that way. If you
want security put it behind a firewall to properly secure it." Whaaaat?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">So they are charging enterprise pricing for this application (7 figures) but they tell us to take a hike and use a FW to make up for lack of programming skills.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Has anyone else had issues similar to this with Nuance? Did you have a means to resolve it without legal action? Do you recommend any other speech vendors that understand enterprise security?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div><p class="MsoNormal"><br>
<br>
<span style="color:white">itevomcid</span> <u></u><u></u></p>
</div>
</div>
</blockquote></div><br></div>