RedMax EXtreme EX-LRT Průvodce řešením problémů stáhnout pdf (Strana 10)

Oracle SBC Security Guide

 Per-device signaling and media overload control, with deep packet inspection and call rate

control to prevent DoS attacks from reaching service infrastructure

6. Fraud prevention

 Session-based authentication, authorization, and contract enforcement for signaling and

media

7. Monitoring and reporting

 Audit trails, event logs, access violation logs and traps, management access command

recording

 Call Detail Records (CDRs) with media performance monitoring

 Raw packet capture ability

 Lawful intercept capability

General Security Principles

The following principles are fundamental to using any application securely.

Keep Software Up To Date

One of the principles of good security practice is to keep all software versions up to date. Oracle

maintains multiple SBC streams or versions that are updated with applicable security patches. Always

review the Critical Patch Updates and Release Notes relevant to the stream installed to determine whether

an update should be applied. Throughout this document, a minimum software release of at least S-C6.2.0

is assumed so the guide can be applicable to multiple releases.

Restrict Network Access to Critical Services

By design, the SBC family defaults to a closed state. No signaling or media can pass through the system

unless it is explicitly configured.

Only services required for initial configuration of the system are available on a dedicated management

Ethernet port (wancom0) which should be connected to a management network. Insecure services such as

telnet and FTP should be disabled. Access to management services should be protected through the use of

system level Access Control Lists (ACL) specifying allowed IP address ranges.

Signaling and media are only available on a separate set of Ethernet ports designated for services. ACLs

should also be used on services ports for SIP peering deployments where possible. Some management

capabilities can be enabled on these services ports by an administrator, so care should be taken to

determine the risk of doing so in individual cases. In general it is not recommended to enable services

other than perhaps ICMP.

Services should also be protected from DoS abuse through configuration of call admission controls,

signaling thresholds, blacklisting, and attack tool detection, elements covered as part of this guide.

Follow the Principle of Least Privilege

The SBC family provides some implicit least privilege because direct user access is usually not provided.

In most cases, the system acts as a proxy device so there is no direct user interaction. In other cases the

system may provide a registrar function. However, providing the registrar function does not give the user

access to any system level commands.

1 2 ... 5 6 7 8 9 10 11 12 13 14 15 ... 141 142

Žádné komentáře

RedMax EXtreme EX-LRT Průvodce řešením problémů Strana 10