Cisco MCS-7825-H3-IPC1 Service Guide - Page 132

Software Configuration Management Chapter 3 Managing and Monitoring the Health of Cisco Unified Communications Manager Systems Locked-down System For security, Cisco Security Agent is included along with a built-in firewall controlling connectivity among all cluster nodes, via IP tables and sensitive ports defined by the application. No AntiVirus application is installed on the appliance. The native OS used by the appliance is also hardened to minimize attack surface and vulnerabilities; fewer than 200 of the thousands of available packages are used to eliminate unused software and the corresponding vulnerabilities. No "on-box" e-mail clients or Web browsers are supported, all unnecessary logins have been removed or disabled, and all software is provided by Cisco and digitally signed to ensure it is authorized by Cisco. The GUI, CLI, and API interfaces that Cisco provides are the only methods to administer the system, and authentication is required for users to interact with them. It also useful to note that appliances of this sort are less frequently targets of malware than Microsoft Windows or other systems with open-system access to the native OS, so significantly fewer patches need to be applied to the base OS. Cisco Unified CM regulates its TCP/UDP port usage. See the "Cisco Unified Communications Manager TCP and UDP Port Usage" document for each Cisco Unified CM release for the specific list. Cisco Security Agent Support The Appliance supports the "headless" or unmanaged Cisco Security Agent. A future release will add support for the event monitoring features of Cisco Security Agent Management Center, but not for policy edits and distribution. Security Patching and Updating The Appliance's software image contains all security updates and patches made to firmware, drivers, native OS, database and Cisco Unified CM application components. Customers who keep current with Cisco maintenance releases are automatically covered for security updates. For more details, refer to the Application Note "Appliance Security Update Process for Cisco Unified Communications Manager" (C27-412838-00), available on request from your Cisco account team. Role-Based Access Control Cisco Unified CM uses Multi-Layer Admin (MLA) for RBAC control over authorization to Cisco Unified CM configuration. Software Configuration Management The Cisco Unified CM server uses a bundled image including all components needed for the system in a single set of DVDs or software downloads. Unlike Cisco Unified CM Release 4.x in which there were up to 6 different components to manage for a total of 18 updates per year on average to stay current, the server has 2 components with an average of 5 updates per year to stay current. It is recommended that you keep your system current with the latest maintenance release for a major/minor feature release. Major and minor release install files are available on DVD media kits or on Product Upgrade Tool at http://www.cisco.com/go/upgrade. Rebuilds, upgrade files for minor and maintenance releases, and Cisco option files and tools are available as software downloads from Software Center at http://www.cisco.com/kobayashi/sw-center/sw-voice.shtml. 3-32 Cisco Unified Communications Manager Managed Services Guide OL-22523-01