Common Windows Exploits

A hardened Cisco IP Telephony Operating System can successfully defend against many common Windows exploits. Some active services cannot be disabled because Cisco CallManager uses them. To secure these areas, you must design the IP telephony-ready network properly and choose the proper roles for the Cisco CallManager nodes in the cluster. You need to protect Windows against some of the most common exploits.

One common exploit involves Extensible Markup Language (XML) applications running on HTTP (TCP port 80). Most XML applications go to the Internet to get their data. Because of this, Cisco recommends that you off-load XML services to a dedicated server that is isolated (as much as possible) from the rest of the network.

The most important task for Microsoft IIS issues is to turn off IIS on all subscribers. IIS is the parent process for HTTP, Simple Mail Transfer Protocol (SMTP), and FTP. Eighty percent of the attacks against Windows are against the IIS parent process. Turn off IIS on the subscribers, where all of the active call processing is taking place, and run it only on the publisher for administration purposes. This practice will minimize the threats against Windows by 80 percent and actually bring it closer to parity with what is considered to be the normal security settings of UNIX or Linux operating systems.

In a Cisco CallManager cluster, different servers can have different roles and, hence, do not need the same active services. One server could act as a pure management server by providing access only to Cisco CallManager Administration web pages, while other servers are providing call-routing functions and others are being used for applications such as phone services. Because IIS is a common target, run it only where needed: at the Cisco CallManager Publisher. During upgrades, IIS will also be needed on subscribers but will automatically be started when needed as long as the service is set to manual rather than disabled. Therefore, set IIS to manual on all subscribers and keep the setting automatic only at the publisher.

Caution

IIS needs to be available during upgrades. If you have set the IIS Startup Type option to Disabled, the upgrade will fail.

Table 20-1 shows what will happen during a Cisco CallManager upgrade when the IIS service is set to different options.

Table 20-1. Behavior of Cisco CallManager During an Upgrade

IIS Service Parameter	Resulting Upgrade Behavior
Enabled	The upgrade will work with no interference.
Disabled	The upgrade will fail; no message is displayed.
Manual and Stopped	The upgrade will stop, a message that the IIS is not running will pop up, the IIS service will start, and the upgrade will continue. On the next reboot, the IIS service will be in the Manual and Stopped state again.
Manual and Running	The upgrade will work with no interference.

Finally, to avoid attacks against the Dynamic Host Configuration Protocol (DHCP) server, which, in most installations, is used to provide IP settings, push DHCP services as close to the endpoints as possible. This might include using an intelligent Cisco switch or router for DHCP services.