RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 62)

Oracle SBC Security Guide

peering does happen over an untrusted network, such as OTT, the ACL entry drops incoming requests

from unknown sources.

It then falls to the operator to determine if their particular architecture might see SIP scans from behind a

trusted IP address. With multiple layers of NAT in IPv4 networks, it is always possible that messages are

transiting through a firewall or gateway rather than just an individual SIP proxy.

Access: Calls are sent directly from a SIP endpoint to the SBC. A SIP registration may be required to

authenticate and authorize the services available to the endpoint.

Access deployments will benefit the most from SIP scanner mitigation. This deployment model relies on

the ability for users to roam, so ACLs based on known IP addresses cannot be used. Access to the

network needs to be controlled via other means, usually through the use of a SIP registration.

Hybrid: Many networks have a mix of peering and access. In these cases, calls from remote subscribers

may be sent to a trusted peer such as a service provider.

Strategies for Mitigating Against SIP Scanners

Mitigation Strategies

Mitigation against SIP scanners can be provided through several complementary strategies.

1. Access Control: Ensure proper configuration to block unauthorized end-points. Proper

configuration of access control settings such as realm trust levels, access control lists (ACL), and

SIP port allow-anonymous settings can limit traffic to known session agents and/or registered

endpoints.

2. Threat Identification: Identify and drop messages from SIP scanners and avoid responding to

the sender whenever possible - fraudulent messages can be dropped based on patterns found in

the SIP messaging.

3. Enforcement: Limit attacks that cannot be identified as a scan from a known tool. Enforcement

of message thresholds (DoS configuration) can demote or blacklist endpoints that do not become

trusted or abuse their existing trust potentially limiting the damage of a scan.

Access Control

There are several types of access control that apply to deployments over untrusted networks.

Denial of Service Prevention: The section regarding DoS in this appendix covesr proper configuration of

access control parameters. Guidelines are provided for configuring trust levels, ACLs, allow-anonymous

settings, and message thresholds.

Signaling Authentication and Encryption: SIP can be encrypted using the Transport Layer Security

(TLS) protocol. If the connection is established using mutual certificate authentication, then a resulting

benefit is effective access control. During the TLS connection establishment, the endpoint verifies the

SBC certificate, and the SBC verifies the endpoint certificate was issued by a trusted Certificate Authority

(CA). That mutual authentication provides assurance that the device is legitimate, and not an attack tool.

When combined with the use of online certificate status protocol (OCSP), it is possible for administrators

to refuse network access to devices that are lost or have left the organization. If TLS with mutual

authentication is used, then the effects of all SIP scanning tools are mitigated.

1 2 ... 57 58 59 60 61 62 63 64 65 66 67 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 62