Cisco Unified Contact Center Enterprise Solution Reference ...

More documents

Recommendations

Info

Platform Differences 7-4 Cisco Unified Contact Center Enterprise 7.x SRND Chapter 7 Securing Unified CCE For most of these security layers, the Unified CCE solution supports a number of capabilities to enforce the defense-in-depth paradigm illustrated in Figure 7-1. However, what Cisco cannot control or enforce is your enterprise policies and procedures for deploying and maintaining a secure Unified CCE solution. Figure 7-1 Defense-In-Depth Platform Differences Application & Data Data Security Patch Management Intrusion Prevention Virus Protection Host-Based Firewall Server Hardening Host Security Internal Network Perimeter Security Physical security Policies, procedures, and awareness Strong passwords, file ACLs Endpoint security and secure communication paths (SSL, TLS, IPSec) Security update management Day-Zero attack protection Anti-Virus updates Inbound TCP/IP port control OS hardening, authentication, auditing Network segments, Network based IDS Firewalls, ACL configured routers, VPNs Guards, locks, access control Security policies, procedures, education along with a backup and restore strategy Before discussing how to design the various security layers required for a Unified CCE network, this section introduces the differences that are inherent in the applications making up the Unified CCE solution. The Unified CCE solution consists of a number of application servers that are managed differently. The primary servers, those with the most focus in this document, are the Routers, Loggers (also known as Central Controllers), Peripheral Gateways (or Agent/IVR Controllers, as they are called in a System Unified CCE deployment), Administrative Workstations, Historical Data Servers, WebView Servers, and so forth. These application servers can be installed only on a standard (default) operating system installation. For upgrades, these applications can remain (for a limited migration period) on a Windows 2000 Server or Advanced Server, but all new installations must be done on Windows Server 2003 Standard or Enterprise Edition. The maintenance of this operating system in terms of device drivers, security updates, and so forth, is the responsibility of the customer, as is acquiring the necessary software from the appropriate vendors. This category of application servers is the primary focus of this chapter. The secondary group of servers, those running applications that are part of the solution but are deployed differently, are Cisco Unified CallManager, Cisco Unified IP IVR or Cisco IP QM, Cisco Unified Customer Voice Portal (Unified CVP, formerly ISN), and so forth. These servers support and, in some 143954 OL-8669-05
Chapter 7 Securing Unified CCE OL-8669-05 Cisco Unified Contact Center Enterprise 7.x SRND Security Best Practices cases (except for Unified CVP), require installation on the Cisco Unified Communications Operating System (CIPT OS). This operating system is configured especially for those applications. It is hardened by default and is shipped and maintained by Cisco. Customers are required to obtain all relevant patches and updates to this operating system from Cisco. The security hardening specifications for this operating system can be found in the Cisco Unified Communications Solution Reference Network Design (SRND) guide and other Cisco Unified CallManager product documentation, available at http://www.cisco.com/ The approach to securing the Unified CCE solution as it pertains to the various layers listed above differs from one group of servers to another. It is useful to keep this in mind as you design, deploy, and maintain these servers in your environment. Cisco is constantly enhancing its Unified Communications products with the eventual goal of having them all support the same customized operating system, antivirus applications, and security path management techniques. Some examples of these enhancements include the support of Cisco's host-based intrusion prevention software (Cisco Security Agent) and default server hardening provided by the customized operating system or applications. Security Best Practices As part of the Unified CCE 7.0 documentation set, Cisco has released a best-practices guide for the primary group of servers, which covers a number of areas pertaining to the new implementation in the release along with some general guidance for securing a Unified CCE deployment. The best-practices guide includes the following topics: Encryption Support IPSec and NAT Support Windows Firewall Configuration Automated Security Hardening Updating Microsoft Windows SQL Server Hardening SSL Encryption Intrusion Prevention (CSA) Microsoft Baseline Security Analysis Auditing Anti-Virus Guidelines and Recommendations Secure Remote Administration Additional Security Best Practices – WebView and IIS Hardening (Windows 2000) – Sybase EAServer (Jaguar) Hardening – RMS Listener Hardening – WMI Service Hardening – SNMP Hardening – Other 7-5
Page 1 and 2:
Cisco Unified Contact Center Enterp
Page 3 and 4:
OL-8669-05 Preface xv New or Change
Page 5 and 6:
CHAPTER 2 Deployment Models 2-1 OL-
Page 7 and 8:
OL-8669-05 Cisco Unified Contact Ce
Page 9 and 10:
CHAPTER 5 Cisco Unified Outbound Di
Page 11 and 12:
OL-8669-05 Endpoint Security 7-20 A
Page 13 and 14:
G LOSSARY I NDEX OL-8669-05 Cisco U
Page 15 and 16:
OL-8669-05 Preface This document pr
Page 17 and 18:
Preface Product Documentation DVD O
Page 19 and 20:
Preface Cisco Technical Support & D
Page 21 and 22:
Preface OL-8669-05 Obtaining Additi
Page 23 and 24:
OL-8669-05 Architecture Overview CH
Page 25 and 26:
Chapter 1 Architecture Overview OL-
Page 27 and 28:
Page 29 and 30:
Chapter 1 Architecture Overview ICM
Page 31 and 32:
Chapter 1 Architecture Overview Fig
Page 33 and 34:
Chapter 1 Architecture Overview Cis
Page 35 and 36:
Page 37 and 38:
Chapter 1 Architecture Overview Adm
Page 39 and 40:
Chapter 1 Architecture Overview Mul
Page 41 and 42:
Chapter 1 Architecture Overview Cis
Page 43 and 44:
Chapter 1 Architecture Overview Lab
Page 45 and 46:
Chapter 1 Architecture Overview Fig
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Chapter 1 Architecture Overview Con
Page 53 and 54:
Chapter 1 Architecture Overview Non
Page 55 and 56:
OL-8669-05 Deployment Models CHAPTE
Page 57 and 58:
Chapter 2 Deployment Models Unified
Page 59 and 60:
Chapter 2 Deployment Models Parent/
Page 61 and 62:
Chapter 2 Deployment Models OL-8669
Page 63 and 64:
Page 65 and 66:
Chapter 2 Deployment Models IPT: Ce
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Chapter 2 Deployment Models Treatme
Page 75 and 76:
Chapter 2 Deployment Models Alterna
Page 77 and 78:
Page 79 and 80:
Chapter 2 Deployment Models IVR: Tr
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Chapter 2 Deployment Models Connect
Page 91 and 92:
Page 93 and 94:
Chapter 2 Deployment Models Traditi
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Chapter 2 Deployment Models Using I
Page 101 and 102:
Page 103 and 104:
OL-8669-05 CHAPTER Design Considera
Page 105 and 106:
Chapter 3 Design Considerations for
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
OL-8669-05 CHAPTER Unified Contact
Page 155 and 156:
Chapter 4 Unified Contact Center En
Page 157 and 158:
Chapter 4 Unified Contact Center En
Page 159 and 160: Chapter 4 Unified Contact Center En
Page 181 and 182: OL-8669-05 Cisco Unified Outbound D
Page 183 and 184: Chapter 5 Cisco Unified Outbound Di
Page 193 and 194: OL-8669-05 Cisco Unified Mobile Age
Page 195 and 196: Chapter 6 Cisco Unified Mobile Agen
Page 207 and 208: OL-8669-05 Securing Unified CCE CHA
Page 209: Chapter 7 Securing Unified CCE Secu
Page 213 and 214: Chapter 7 Securing Unified CCE Netw
Page 215 and 216: Chapter 7 Securing Unified CCE Netw
Page 217 and 218: Chapter 7 Securing Unified CCE OL-8
Page 219 and 220: Chapter 7 Securing Unified CCE IPSe
Page 223 and 224: Chapter 7 Securing Unified CCE Intr
Page 229 and 230: OL-8669-05 Sizing Call Center Resou
Page 231 and 232: Chapter 8 Sizing Call Center Resour
Page 249 and 250: OL-8669-05 CHAPTER Sizing Unified C
Page 251 and 252: Chapter 9 Sizing Unified CCE Compon
Page 261 and 262:
Chapter 9 Sizing Unified CCE Compon
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
OL-8669-05 CHAPTER Cisco Unified Co
Page 269 and 270:
Chapter 10 Sizing Cisco Unified Cal
Page 271 and 272:
Page 273 and 274:
Page 275 and 276:
Page 277 and 278:
Page 279 and 280:
OL-8669-05 CHAPTER Cisco Unified Co
Page 281 and 282:
Chapter 11 Bandwidth Provisioning a
Page 283 and 284:
Page 285 and 286:
Page 287 and 288:
Page 289 and 290:
Page 291 and 292:
Page 293 and 294:
Page 295 and 296:
Page 297 and 298:
Page 299 and 300:
Page 301 and 302:
Page 303 and 304:
Page 305 and 306:
Page 307 and 308:
Page 309 and 310:
Page 311 and 312:
Page 313 and 314:
Numerics 3DES Triple Data Encryptio
Page 315 and 316:
DiffServ Differentiated Services DM
Page 317 and 318:
MDF Main distribution frame MDS Mes
Page 319 and 320:
SRND Solution Reference Network Des
Page 321 and 322:
Symbols .NET CIL API 4-14 Numerics
Page 323 and 324:
security 7-5 sizing call center res
Page 325 and 326:
CTI Desktop Toolkit 4-4, 4-5, 4-12
Page 327 and 328:
H H.323 3-15 hardening of phones 7-
Page 329 and 330:
modes for outbound dialer 5-3 MoH 6
Page 331 and 332:
public network 11-3, 11-7, 11-10, 1
Page 333 and 334:
Peripheral Gateway (PG) 9-15 Periph
Page 335:
website for technical support and d
show all

Cisco Unified Contact Center Enterprise Solution Reference ...

Create successful ePaper yourself

Delete template?

Save as template?