The confidentiality of Voice Video endpoint configuration files downloaded during endpoint registration must be protected by encryption.

From Voice Video Policy Security Technical Implementation Guide

Part of SRG-POL-300042

Associated with: CCI-002163

VVSP-01-000010_rule The confidentiality of Voice Video endpoint configuration files downloaded during endpoint registration must be protected by encryption.

Vulnerability discussion

During Voice Video endpoint registration with the session controller, a file containing specific configuration settings is downloaded by the endpoint from the session manager. This file contains the phone number assigned to the endpoint, the IP addresses for session management, the software menus specific to the system, the endpoint configuration password, the stored personal preferences and speed dial numbers, and other system operational information. These configuration settings can be updated by resetting and re-registering the endpoint, which causes an updated configuration file to be downloaded.The confidentiality of these files is critical to preventing compromise of the Unified Capabilities (UC) soft clients, the hardware endpoints, and the system itself. Some configuration files may be human readable, such as XML code and most VoIP signaling protocols. When the configuration files are human readable, intelligence can be gathered by capturing the file in transit. The best method for maintaining the confidentiality of configuration files is encryption. This prevents man-in-the-middle attacks. Encryption of this file is also required if the file contains the password used to access the endpoint's configuration information and settings menus.

Check content

Review the Voice Video registration policies enforced by session managers for approved Voice Video endpoints. Confirm the confidentiality of Voice Video endpoint configuration files downloaded during endpoint registration is protected. This is not applicable to hardware endpoints with a preinstalled configuration file that do not download a configuration file through the network. This is not applicable to UC soft clients that do not download a configuration file through the network. If configuration files are in a vendor-specific binary format only interpretable by the vendor's Voice Video endpoints, this is not a finding. If the confidentiality of endpoint configuration files downloaded during Voice Video endpoint registration is not encrypted, this is a finding.

Fix text

Document Voice Video registration policies to enforce for approved Voice Video endpoints. The confidentiality of Voice Video endpoint configuration files downloaded during endpoint registration is protected by encryption. This requirement does not apply to hardware endpoints or UC soft clients that do not download configuration files from the session manager.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer