This document provides a checklist to help with hardening SBC Edge against malicious network-based attacks.
Security Hardening Checklist
The following checklist provides a security hardening guide.
- Use latest versions of SBC Edge software. When new security vulnerabilities are reported in operating systems and common third-party software, Sonus produces maintenance releases incorporating the fixes.
- Configure Access Control Lists.
- Configure access lists to prevent excessive amounts of unwanted traffic (Dos attacks) on the SBC Edge.
- Documentation Links:
- Use TLS/SRTP for SIP/Media.
- Use TLS for signaling and SRTP for media. Do not use UDP/RTP for signaling and media because they are not encrypted.
- Some documentation links:
- Only use Certificates from Trusted CA. Do not use self-signed certificates (unless the systems with self-signed certificates are within your trusted network).
- Always use certificates from a trusted certificate authority, do not use self-signed certificates.
- Documentation Links:
- Enable enhanced password security for SBC operator accounts.
- By default, when new SBC operator accounts are created, enhanced security such as complex passwords, limited account duration, limiting the number of login sessions, etc., are not enforced. This must be enabled by the administrator to limit the number of malicious/unauthorized login attacks on the system.
- If Active Directory is used, use TLS with Active Directory.
- Use TLS when configuring Active Directory services on SBC Edge.
- Check if RADIUS is used for user authentication.
- Passwords are encrypted during RADIUS authentication process. However, RADIUS works on UDP and fields other than the user's credentials are not encrypted. RADIUS servers and the SBC Edge are usually within the same trusted domain (inside corporate LAN protected by firewall or over VPN) and so this is not an issue at all. However, if confidentiality is important even inside the trusted domain, RADIUS should not be used.
- Documentation links:
- Check if RADIUS CDR confidentiality is required
- RADIUS CDR transport is based on UDP and this data is not encrypted. In all cases however, RADIUS servers and SBC Edge are usually within the same trusted domain (inside corporate LAN protected by firewall or over VPN), consequently this is not an issue. However, if confidentiality is important inside the trusted domain, RADIUS should not be used.
- Documentation link:
- If the ASM module is present, configure the ASM Firewall.
- If the ASM module is present, configure the ASM security template
Once the system is fully configured,the operator should periodically monitor the system. Many alarms supported by the system are triggered upon security events.
- Review system security logs and user-login activity.
- .Review web-access logs: