Thanks for your feedback.

Core Webex Meetings Services and Components

• Webex Meetings is part of the Webex Suite, providing audio/video conferencing with content sharing and web conferencing capabilities.
• The platform includes multiple microservices such as Meetings Service, Webinar Service, Identity Service, Recording Service, AI Assistant service, Analytics Service, Admin Service, and Media Service.
• Webex Meetings supports cloud-registered apps and devices, enabling users to join meetings from various OS platforms and devices. Users can also join meetings via the PSTN and with SIP endpoints.

Architecture and Deployment

• Webex Meetings services are regionalized and replicated across multiple independent data centers to ensure redundancy and high availability.
• Media services are globally distributed with media server clusters in each data center, providing local and geographic redundancy.
• Media servers handle voice, video, and content sharing, with media commonly encrypted using AES-256-GCM.
• The architecture supports encrypted signaling over TLS/HTTPS and encrypted media streams.

Webex supports joining meetings from multiple platforms and devices, including:

• Webex desktop application on Windows, Mac and Linux.
• Webex mobile application on Android and iOS.
• Webex web application using Chrome, Edge, Safari, Firefox and other browsers.
• Cisco Room Devices and Desk Devices.
• Third-party SIP standards-based audio and video endpoints.
• PSTN devices.

Webex Customer Sovereignty

In response to the growing demand for data residency, Webex has introduced enhanced sovereignty capabilities. Starting with recording, and with support for more services to come, organizations can now maintain control over their meeting content with:

• Localized Processing—Processing meeting content, such as recordings, within their own infrastructure.
• On-Premises Storage—Utilizing their own file storage services to house sensitive meeting assets, ensuring data remains within specified geographic or organizational boundaries.

Ultra Secure Webex Meetings

Historically, "Ultra Secure" features, such as Zero Trust End-to-End Encryption (E2EE), often required a compromise in meeting functionality, as cloud-based value-added services required access to encryption keys, and only a limited number of endpoint types could join these meetings. Webex has eliminated this trade-off with:

• Feature-Rich Zero Trust—Webex has transformed Zero Trust End-to-End Encrypted (E2EE) meetings, adding functionality that make Zero Trust meetings feature-rich. Support for a wider number of endpoint types provides a seamless experience without sacrificing the tools necessary for modern collaboration.
• Zero Trust for Standard Meetings—Webex has integrated Zero Trust E2EE capabilities directly into standard meetings. This ensures that even everyday collaboration can benefit from the highest levels of security, providing consistent protection across the entire Webex ecosystem.

A Unified Approach to Collaboration

By integrating Customer Sovereignty with these advanced Zero Trust E2EE capabilities, Webex empowers organizations to achieve a dual objective: hosting highly secure, Zero Trust meetings within the Webex cloud while maintaining full control over the processing and storage of critical meeting content on-premises. This synergy provides the flexibility and security necessary for modern, compliance-driven enterprise environments.

Extending the security boundary with Video Mesh Node

Adding a Video Mesh Node to an organization enables customers to provide on-premises meeting services, and allows their on-premises endpoints to join any Webex meeting. From a security perspective, integrating a Video Mesh Node maintains Zero Trust within the Webex cloud while offering near-feature parity with standard Webex meetings. Customers also benefit from data sovereignty, as services such as Video Mesh Node meeting recordings are processed and stored on-premises.

Using Zero Trust end-to-end encryption may add a few extra seconds to joining a meeting, but it provides clear security assurance — only the meeting participants have access to the meeting encryption keys, so the meeting content cannot be decrypted by the service provider or other intermediaries.

Summary: Webex Meetings and Hybrid Deployment Models

As shown in the comparison above, deploying Video Mesh Node (VMN) allows Zero Trust Webex Meetings to achieve near-feature parity with standard Webex meetings. While Zero Trust meetings do not support PSTN participants, the Webex web-based application serves as a widely available alternative for end-to-end encrypted access. Furthermore, VMN enables office-based workers using desk phones to seamlessly join Zero Trust meetings.

Video Mesh Node also ensures data sovereignty for critical meeting content, including recordings and—in the near future—transcripts, summaries, and action items. By processing and storing this data on-premises, VMN provides customers with complete control over their information while maintaining a Zero Trust architecture within the Webex cloud.

Encrypted Webex Signaling

Webex services support TLS versions 1.2 and 1.3, with TLS 1.3 preferred when supported by the connecting endpoint. If a client supports only TLS 1.2, the Webex server selects the strongest common cipher suite offered by the client. Unlike TLS 1.2, TLS 1.3 does not use server-preference cipher suite selection because it relies on a smaller, curated set of modern ciphers. This design simplifies the selection process, focusing more on performance improvements such as reducing the overall handshake length, while maintaining strong security. The cipher suites for TLS 1.2 and 1.3 used by Webex are well-defined and prioritized to ensure secure communication.

TLS Cipher Suites

TLS 1.3 cipher suites (TLS 1.3 servers do not use a preference order for suite selection)

TLS 1.2 cipher suites (suites in server-preferred order)

AES_256_CBC and AES_128_CBC encryption ciphers are supported to maintain compatibility with legacy systems, older browsers, and embedded devices that do not support modern AEAD (Authenticated Encryption with Associated Data) ciphers like AES-GCM e.g. Internet Explorer 11 on Windows 7 and Windows 8.1, Safari 6/7/8 on early iOS and MacOS releases use CBC based ciphers.

The CHACHA20_POLY1305 is stream cipher that has a low dependency of hardware, making it a superior cipher to use on mobile devices or devices with low-power CPUs.

Media Encryption Standards for Webex

Webex meetings and calls utilize robust AES-based encryption for all media packets. The specific cipher suite depends on the endpoint type, with AES-256-GCM serving as the preferred standard for optimal security.

Key Security Considerations

• Preferred Standard—AES-256-GCM is the recommended cipher for all deployments to ensure the highest level of data integrity and confidentiality.
• Interoperability—While Webex maintains support for legacy ciphers (such as AES-CM-128-HMAC-SHA1) to ensure interoperability with third-party SIP and H.323 systems, organizations prioritizing a zero-trust architecture should enforce AES-256-GCM where device compatibility allows.

Media Transport Protocols

Webex supports media transport via UDP, TCP, or TLS. For optimal voice and video performance, Cisco strongly recommends UDP.

Performance Considerations:

• Real-Time Efficiency—UDP is the preferred transport for real-time media as it minimizes latency and jitter by avoiding the retransmission and buffering mechanisms inherent in connection-oriented protocols.
• Impact of TCP/TLS—While TCP and TLS provide reliable, ordered data delivery, this behavior is counterproductive for real-time media. The resulting packet retransmissions and stream buffering introduce latency and jitter, which can significantly degrade the quality of experience for participants

Webex use of SRTP and SFrame for media

To maintain the high-security standards required for WebexZero Trust environments, it is important to distinguish between transport-level security (SRTP) and application-layer end-to-end encryption (SFrame).

Key Technical Distinctions—SRTP & SFrame

1. SRTP (Secure Real-time Transport Protocol)

   SRTP is the industry standard for securing media streams in transit.

   • Scope—It provides confidentiality, message authentication, and replay protection for the RTP payload.
   • Operational Context—In many architectures, the Media Server/ Media Gateway (Selective Forwarding Unit (SFU)) terminates the SRTP connection to perform media processing (for example, mixing, layout composition, or transcoding). Because the SFU decrypts the media to process it, the media is technically vulnerable at the SFU point.
2. SFrame (Secure Frame)

   SFrame is an IETF standard. RFC 9605 is designed specifically to facilitate true end-to-end encryption in a multi-party conferencing environment.

   • Scope—It encrypts packetized media frames before they are encapsulated into RTP packets. Webex adds an additional layer of encryption using SRTP.
   • Zero Trust Architecture—Because the media is encrypted at the application layer, the SFU acts only as a "blind" relay. It routes the encrypted packets to other participants without ever having access to the decryption keys.
   • Independence—SFrame is transport-agnostic. It remains secure even if the underlying transport (UDP/TCP/TLS) is compromised, as the security context is tied to the participants' endpoints rather than the transport connection.

SFrame is the critical mechanism that enables E2EE. While SRTP ensures that data is encrypted while traversing the network, SFrame ensures that the media remains encrypted throughout the entire lifecycle of the meeting, including while it resides on Cisco’s infrastructure (the SFU), effectively removing the service provider from the trust boundary.

Webex Meetings Content

Meeting content consists of data created by participants or generated by Webex services on behalf of the meeting host. This includes:

• Media-related content—Recordings, transcripts, summaries, and action items.
• Collaboration data—Chat messages, shared/transferred files, whiteboards, and annotations.

Webex Meetings Content Security—Webex End-to-End Encryption

Webex secures meeting content generated by participants using a robust end-to-end encryption (E2EE) framework. Central to this architecture is the Webex Key Management Service (KMS), which is responsible for generating, distributing, and managing the encryption keys for all user-generated content.

Meeting Content Security Layers

• Data in Transit— Webex App and Cisco video devices use Webex end-to-end encryption (E2EE) with AES-256-GCM to encrypt user generated meeting content such as recording files, AI summary files, chat messages, etc. This is further encapsulated within Transport Layer Security (TLS) to provide dual-layer protection during transmission.
• Data at Rest—Once stored in the Webex cloud, encrypted content is additionally protected by AES-256-GCM disk encryption.
• Protection Profile—This approach shields content from TLS interception during transit and ensures that stored data remains inaccessible to unauthorized actors within the cloud environment.

Webex end-to-end encryption with managed content access for Core Services

Unlike Zero Trust end-to-end encryption, where Webex has no access to media or content encryption keys, Webex end-to-end encryption allows the platform to utilize the Webex KMS-generated keys to decrypt data for essential core services. This managed access enables:

• Search and Indexing—Allows users to search through content history.
• Compliance and Governance—Enables Data Loss Prevention (DLP), eDiscovery, and data archival.
• Media Optimization—Supports file transcoding for cross-device compatibility.
• Security—Facilitates malware scanning using the Extended Security Pack.

Webex Meetings Metadata

Meetings metadata consists of the administrative and technical information generated by the system to facilitate, track, and manage a meeting, rather than the actual content (audio, video, or shared files) of the meeting itself. Metadata can be broken down into several categories:

• Session Information—Meeting title, meeting ID, scheduled start and end times, and the actual duration of the meeting.
• Participant Data—A list of invitees and actual attendees, their IP addresses, device types (such as Windows, iPhone, Cisco Room Kit), and their join/leave timestamps.
• Usage and Quality Metrics—Data used for troubleshooting, such as packet loss, jitter, latency, and the resolution of the video stream.

How Metadata is Used

1. Analytics and Reporting—Administrators use metadata in WebexControl Hub to see how many meetings are happening, which departments are most active, and the overall quality of the experience.
2. Troubleshooting—Cisco TAC (Technical Assistance Center) uses metadata to identify and resolve meeting issues.
3. Compliance and eDiscovery—Compliance officers can search metadata to prove a meeting took place, who was there, and whether it was recorded, even if they cannot see the encrypted content of the meeting.
4. Security—Metadata helps identify unauthorized access attempts or unusual patterns that might indicate a security threat.

Security and Privacy of Metadata

• Encryption—While metadata is not "end-to-end encrypted", it is still encrypted in transit (using TLS) and at rest in Cisco’s secure data centers.
• Access Control—Cisco’s privacy policies strictly limit who can access this metadata, and it is used to provide and improve the service.

For more information on Webex meeting content and metadata, see the Webex Meetings Offer Disclosure.

Assigning meeting session types to users

Webex Control Hub administrators can assign one or more meeting types that their users can use for scheduled meetings. By default, all users are assigned the Pro Meeting and Pro-End to End Encryption_VoIPonly meeting types.

Schedule a meeting—Select the meeting type

Users can select the meeting type that they want to use when scheduling a meeting from Webex App, Webex User Page and Webex Email Add-In for Microsoft Outlook.

Schedule a meeting—Select the meeting type in Webex App

Schedule a meeting—Select the meeting type from the Webex user page

Set a default meeting type

Users can set their default meeting type from Meetings > Settings on their Webex user page.

Set the Default Meeting Type from the Webex User page

Zero Trust End-to-End Identity and Deepfake Prevention

Customer-provided end-user identity certificates are a cornerstone of preventing impersonation in Webex end-to-end encrypted (E2EE) meetings. Unlike traditional deepfake-blocking mechanisms that rely on analyzing audio and video streams, this approach provides cryptographic identity validation at the point of admission. This verified status is displayed directly in the meeting roster, providing transparency to all participants.

Webex has extended its support for customer-managed certificates—previously available on RoomOS devices—to Webex App as part of our "Deepfake prevention" feature. Organizations can provision and manage their own digital certificates, issued by trusted external Certificate Authorities (CAs) using industry-standard protocols like ACME. These certificates, based on X.509 standards and ECDSA P-256 key pairs, provide cryptographic proof of participant identity during E2EE meetings.

End-to-End Verified Identity and the MLS Protocol

The Messaging Layer Security (MLS) protocol utilizes standard X.509 certificates to authenticate meeting participants. A certificate is a digitally signed statement from a trusted CA that verifies the identity of the signing key holder. Participants obtain these certificates through two primary methods:

• Managed Devices (Customer-Provided Certificates)—For organization-managed desktop and mobile clients, an identity certificate from a trusted CA can be installed on the device. When a user logs in using Single Sign-On (SSO), Webex App retrieves this certificate from the OS trust store to present the user's verified identity. This process is also supported for Webex cloud-registered Cisco video devices.
• Default (Webex-Provided Certificates)—If no customer-provided certificate is available, the Webex client or device automatically uses a certificate issued by the Webex Certificate Authority, which reflects an identity verified by Cisco.

Identity Sharing and Fallback Mechanism

During a meeting, each participant shares their Webex identity certificate and, if available, their customer-provided identity certificate with all other attendees. To ensure seamless connectivity, the Webex endpoint follows a strict hierarchy: it prioritizes the customer-provided certificate for verification; if that certificate is missing or fails validation, the system automatically falls back to the Webex-provided identity certificate.

Displaying User Identity Verification Status

When participants join a meeting using Webex App or RoomOS devices with customer-provided certificates, their identities are verified by other meeting members against the issuing CA. This ensures that only authorized users are recognized, preventing attackers from impersonating legitimate participants, as these certificates are uniquely tied to verified identities and cannot be forged by Cisco or intermediaries.

The participant list in an E2E-encrypted meeting displays the identity verification status of each user:

• Zero-Trust E2E Verified ( domain.com )—When a customer-provided identity certificate is used, the participant’s domain is displayed in blue text. This indicates true E2E- verified identity that Cisco cannot tamper with. For example, in the meeting roster, you might see that "Kevin" has a verified email address from example.com in blue.
• Webex-Verified ( domain.com)—Certificates issued by a Webex CA provide a more limited level of protection. While superior to having no identity protection, these participants are not marked as "Zero Trust E2E verified." Instead, their identity status is displayed in grey text, indicating that the identity was verified by the Webex CA.
• Unverified Guest User ( Unverified)—Although the identity of guest participants is not authenticated (as there is no sign-in process), they still require a certificate to join the MLS group for a call or meeting. This certificate is issued by a Webex CA and uses "anonymous" as the username.

Additionally, a meeting security code derived from the cryptographic state of all participants helps detect person-in-the-middle attacks by allowing participants to verify that everyone shares the same secure meeting context. By combining cryptographic identity verification with end-to-end encryption, this "Deepfake prevention" feature offers a robust defense against impersonation and synthetic media threats, safeguarding meeting integrity and confidentiality across both Webex App and RoomOS devices.

Managing Certificate Rollout

Organizations can simplify the rollout and management of these customer-provided end user identity certificates by installing them into corporately managed devices using Mobile Device Management (MDM), Mobile Application Management (MAM), or Enterprise Mobility Management (EMM) applications. These management platforms enable IT administrators to centrally provision, configure, and control certificates and related security policies across a wide range of devices, whether corporate-owned or personally owned. For example, Microsoft Intune supports both MDM and MAM capabilities that allow organizations to deploy and manage Webex App and its security configurations, including identity certificates, on managed devices. Similarly, Cisco Meraki Systems Manager provides MDM capabilities to enroll devices, push configuration profiles, and deploy certificates to ensure trusted device status. Leveraging these management solutions reduces administrative overhead, simplifies certificate lifecycle management, and enhances the security posture for Webex E2EE meetings with "Deepfake prevention" features.

The Three Pillars of Identity

Effective Identity and Access Management (IAM) for Webex relies on:

• Provisioning (CRUD)—Managing user lifecycles (Creation, Read, Update, Deletion) to ensure the "Source of Truth" matches the collaboration platform.
• Authentication (AuthN)—Verifying user identity via secure credentials or tokens.
• Authorization (AuthZ)—Defining granular permissions and API access levels post-authentication.

Provisioning & Lifecycle Management

Webex supports several methods to synchronize users and groups:

• SCIM 2.0—The preferred cloud standard. It automates the user lifecycle, ensuring offboarding in the IdP automatically revokes Webex access.
• Directory Connector—A Cisco tool for hybrid environments, bridging on-premises Active Directory (AD) to the Webex Cloud.
• API-Based Provisioning—Uses the Webex "People API" for programmatic user creation and license assignment in complex environments.
• Legacy LDAP—Supported for on-premises directories (e.g., CUCM), though less optimized for modern cloud traffic.

Authentication & Authorization Frameworks

• Authentication (AuthN):

• SAML 2.0—The enterprise standard for Single Sign-On (SSO). Webex acts as the Service Provider (SP), validating XML assertions from the corporate IdP.
• OIDC (OpenID Connect)—A modern, lightweight identity layer built on OAuth 2.0 using JSON Web Tokens (JWTs). It supports "Discovery URLs" for automated configuration.

• Authorization (AuthZ):

• OAuth 2.0—Manages API access via short-lived Access Tokens (defining scopes) and long-lived Refresh Tokens. It enforces security via PKCE (Proof Key for Code Exchange) for public clients.

Integration & Multi-IdP Strategies

Webex provides specialized paths for seamless integration:

• Entra ID Wizard—The recommended path for Microsoft environments. It uses the Microsoft Graph API for advanced attribute syncing (avatars, hierarchies) and automates OIDC/SAML configuration.
• Duo Security—Adds "Continuous Identity Security" by verifying device posture and enabling phishing-resistant MFA.

Multiple IdP Support: Webex allows organizations to federate multiple independent IdPs within a single Control Hub.

• Use Cases—Mergers, acquisitions, or decentralized IT departments.
• Routing—Authentication requests are routed based on domains or user groups.
• Consideration—Requires strict coordination to maintain consistent security policies across all federated sources.

Example of most common IdP Identity Integrations with Webex:

Best Practices and Resilience

• SSO Recovery—Always utilize the built-in "SSO Recovery" link in Control Hub to bypass SSO via a one-time password (OTP) if the IdP configuration fails.
• Certificate Management—Monitor SAML certificate expiration. The SSO Wizard automates metadata exchange, reducing manual errors.
• Troubleshooting—Use the SAML Tracer tool to inspect XML assertions and validate NameID formats if authentication issues arise.
• Security Posture—Regularly deprecate legacy grant types and ensure PKCE is implemented for all public client integrations.

Conclusion—Identity for Webex Meetings

A robust identity strategy is a continuous lifecycle process. By combining SCIM for provisioning, OIDC/SAML for authentication, and OAuth for authorization, organizations can ensure a secure, frictionless experience for users while maintaining strict administrative control.

Cisco Secure Development Lifecycle

At Cisco, security is not an afterthought. It is a disciplined approach to building and delivering world-class products and services from the ground up. All Cisco^® product development teams are required to follow the Cisco Secure Development Lifecycle. It is a repeatable and measurable process designed to increase the resiliency and trustworthiness of Cisco products. The combination of tools, processes, and awareness training introduced in all phases of the development lifecycle helps ensure defense in depth. It also provides a holistic approach to product resiliency. The Webex Product Development team passionately follows this lifecycle in every aspect of product development.

Read more about the Secure Development Lifecycle.

Cisco Foundational Security Tools

The Cisco security and trust organization provides the process and the necessary tools that give every developer the ability to take a consistent position when facing a security decision.

Having dedicated teams to build and provide such tools takes away uncertainty from the process of product development.

Some examples of tools include:

• Product Security Baseline (PSB) requirements that products must comply with
• Threat-builder tools used during threat modeling
• Coding guidelines
• Validated or certified libraries that developers can use instead of writing their own security code
• Security vulnerability testing tools (for static and dynamic analysis) used after development to test against security defects
• Software tracking that monitors Cisco and third-party libraries and notifies the product teams when a vulnerability is identified

Organizational Structure that Instills Security in Cisco Processes

Cisco has dedicated departments in place to instill and manage security processes throughout the entire company. To constantly stay abreast of security threats and challenges, Cisco relies on:

• Cisco Information Security (InfoSec) Cloud team
• Cisco Product Security Incident Response Team (PSIRT)
• Shared security responsibility

Cisco InfoSec Cloud

Led by the Chief Security Officer for Cloud, this team is responsible for delivering a safe Webex environment to our customers. InfoSec achieves this by defining and enforcing security processes and tools for all functions involved in the delivery of Webex into our customers’ hands.

Additionally, Cisco InfoSec Cloud works with other teams across Cisco to respond to any security threats to the Webex service.

Cisco InfoSec is also responsible for continuous improvement in Webex’s security posture.

Cisco Product Security Incident Response Team (PSIRT)

Cisco PSIRT is a dedicated global team that manages the inflow, investigation, and reporting of security issues related to Cisco products and services. PSIRT uses different mediums to publish information, depending on the severity of the security issue. The type of reporting varies according to the following conditions:

• Software patches or workarounds exist to address the vulnerability, or a subsequent public disclosure of code fixes is planned to address high-severity vulnerabilities
• PSIRT has observed active exploitation of a vulnerability that could lead to a greater risk for Cisco customers. PSIRT may accelerate the publication of a security announcement describing the vulnerability in this case without full availability of patches.
• Public awareness of a vulnerability affecting Cisco products may lead to a greater risk for Cisco customers. Again, PSIRT may alert customers, even without full availability of patches.

In all cases, PSIRT discloses the minimum amount of information that end users will need to assess the impact of a vulnerability and to take steps needed to protect their environment. PSIRT uses the Common Vulnerability Scoring System (CVSS) scale to rank the severity of a disclosed issue. PSIRT does not provide vulnerability details that could enable someone to craft an exploit.

For more information about about PSIRT, see Cisco Product Security Incident Response Team.

Security Responsibility

Although every person in the Webex group is responsible for security, the main rules are as follows:

• Chief Security Officer, Cloud
• Vice President and General Manager, Cisco Cloud Collaboration Applications
• Vice President, Engineering, Cisco Cloud Collaboration Applications
• Vice President, Product Management, Cisco Cloud Collaboration Applications

Internal and External Penetration Tests

The Webex group conducts rigorous penetration testing regularly, using internal assessors. Beyond its own stringent internal procedures, Cisco InfoSec also engages multiple independent third parties to conduct rigorous audits against Cisco internal policies, procedures, and applications. These audits are designed to validate mission-critical security requirements for both commercial and government applications. Cisco also uses third-party vendors to perform ongoing, in-depth, code-assisted penetration tests and service assessments. As part of the engagement, a third party performs the following security evaluations:

• Identifying critical application and service vulnerabilities and proposing solutions
• Recommending general areas for architectural improvement
• Identifying coding errors and providing guidance on coding practice improvements

Third-party assessors work directly with the Webex engineering staff to explain findings and validate the remediation. Refer to the Webex Meetings Letters of Attestation Trust Package for penetration test attestation information.

Physical Security

Physical security at the data center includes video surveillance for facilities and buildings and enforced two-factor identification for entry. Within Cisco data centers, access is controlled through a combination of badge readers and biometric controls. In addition, environmental controls (for example, temperature sensors and fire-suppression systems) and service continuity infrastructure (such as power backup) help ensure that systems run without interruption.

Data center servers are segmented into “trust zones”, based on infrastructure sensitivity. For example, databases are “caged”, the network infrastructure has dedicated rooms, and all equipment racks are locked. Only Cisco security personnel and authorized visitors accompanied by Cisco personnel can enter the data centers.

Cisco’s production network is a highly trusted network: only very few people with high trust levels have access to the network.

Infrastructure and Platform Security

Platform security encompasses the security of the network, systems, and the overall Webex data center. All systems undergo a thorough security review and acceptance validation prior to production deployment, as well as regular ongoing hardening, security patching, and vulnerability scanning and assessment.

Servers are hardened using the Security Technical Implementation Guidelines (STIGs) published by the National Institute of Standards and Technology (NIST). Firewalls protect the network perimeter. Access Control Lists (ACLs) segregate the different security zones. Intrusion Detection Systems (IDSs) are in place, and activities are signed and monitored on a continuous basis. Daily internal and external security scans are conducted across Webex. All systems are hardened and patched as part of regular maintenance. Additionally, vulnerability scanning and assessments are performed continuously.

Service continuity and disaster recovery are critical components of security planning. The design of Cisco data centers with global site backups and high-availability help enable the geographic failover of Webex services. There is no single point of failure.

Administrative data

Information about employees or representatives of a customer or other third party that is collected and used by Cisco in order to administer or manage Cisco’s delivery of products or services, or to administer or manage the customer’s or third party’s account for Cisco’s own business purposes.

Administrative data may include the name, address, phone number, email address, and information about the contractual commitments between Cisco and a third party, whether collected at the time of the initial registration or later in connection with the management or administration of Cisco’s products or services.

Administrative data may also include the meeting title, time, and other attributes of the meetings conducted on Webex by employees or representatives of a customer. Other examples of administrative data may include meeting title, meeting time, and other attributes of the meetings hosted on Webex.

Customer data

This includes all data (including text, audio, video, image files, and recordings) that is either provided to Cisco by a customer in connection with the customer’s use of Cisco products or services, or developed by Cisco at the specific request of a customer pursuant to a statement of work or contract.

Customer data also includes log, configuration, or firmware files, and core dumps.

It is data taken from a product or service and provided to Cisco to help us troubleshoot an issue in connection with a support request. Customer data does not include administrative data, support data, or telemetry data.

Support data

Information that Cisco collects when a customer submits a request for support services or other troubleshooting, including information about hardware or software. It includes details related to the support incident, such as authentication information, information about the condition of the product, system, and registry data about software installations and hardware configurations, and error-tracking files. Support data does not include log, configuration, or firmware files, or core dumps taken from a product and provided to us to help us troubleshoot an issue in connection with a support request, all of which are examples of customer data.

Telemetry data

Information generated by instrumentation and logging systems created through the use and operation of the product or service.

All data collected in the Webex cloud is protected by several layers of robust security technologies and processes. Below are examples of controls placed in different layers of Webex operations to protect customer data:

• Physical access control—Physical access is controlled through biometrics, badges, and video surveillance. Access to the data center requires approvals and is managed through an electronic ticketing system.
• Network access control—The Webex network perimeter is protected by firewalls. Any network traffic entering or leaving the Webex data center is continuously monitored using an Intrusion Detection System (IDS). The Webex network is also segmented into separate security zones. Traffic between the zones is controlled by firewalls and Access Control Lists (ACLs).
• Infrastructure monitoring and management controls—Every component of infrastructure, including network devices, application servers, and databases, is hardened to stringent guidelines. They are also subject to regular scans to identify and address any security concerns.
• Cryptographic controls—As noted earlier, all data to and from the Webex data center to cloud registered Webex Apps and Webex Devices is encrypted, except for PSTN traffic and unencrypted SIP/H323 video devices in a cloud–enabled meeting. Additionally, critical data stored in Webex, such as passwords, is encrypted.

Cisco employees do not access customer data unless access is requested by the customer for support reasons. Access to systems in this case is allowed by the manager only in accordance with the “segregation of duties” principle. It is granted only on a need-to-know basis and with only the level of access required to do the job. Employee access to these systems is also regularly reviewed for compliance. Employees with such access are required to take annual International Organization for Standardization (ISO) 27001 Information Security Awareness training.

In addition to these specialized controls, every Cisco employee undergoes a background check, signs a Nondisclosure Agreement (NDA), and completes Code of Business Conduct (COBC) training.

Health Insurance Portability and Accountability Act (HIPAA)

Cisco can provide information regarding the functionality, technology, and security of Webex. A HIPAA-covered entity would need to consult with its own legal counsel to determine whether Webex’s functionality is compliant for its business processes and GDPR-ready.

• GDPR Compliance
• Cisco Webex Meetings Offer Disclosure

Industry standards and certifications

In addition to complying with our stringent internal standards, Webex also continually maintains third-party validations to demonstrate our commitment to information security. Webex is:

• ISO 27001, 27017, 27018 and 27701 certified
• Service Organization Controls (SOC) 2 Type II audited
• SOC 3 certified
• Cloud Code of Conduct
• CSTAR
• Cloud Computing Compliance Controls Catalogue (C5) attestation
• FedRAMP certified (visit cisco.com/go/fedramp for more details, scope, and availability)

Refer to the Cisco Trust Portal for a complete set of security, privacy, and compliance documents including details on the above standards and certifications.