Security Guide for Cisco Unified ICM/Contact Center Enterprise, Release 12.6(2) - Strengthening Windows Security [Cisco Unified Contact Center Enterprise 12.6(2)] (2023)

As a best practice, we recommend using the Microsoft Security Baseline and CIS Benchmarks to configure ICM servers securely. Use the latest Microsoft security baseline and CIS Level 1 reference profile to reduce the attack surface without impacting functionality and performance.

Apply the security policy in the form of a Group Policy Object (GPO) on a separate organizational unit (OU) that contains ICM servers. Name the OU Cisco_ICM_Servers (or a similar, clearly identifiable name) and be sure to name these servers in accordance with your corporate policy.

Create this OU at the same level as the Computers container or the Cisco Unified ICM Root OU. If you are not familiar with Active Directory, ask your domain administrator for help with Group Policy deployments.

After you apply the security policy at the OU level, prevent different policies from being inherited in the Unified ICM/Unified Contact Center Enterprise Servers OU. You can override block inheritance, an OU object level configuration option, by selecting the Force/Don't Override option at a higher hierarchical level. Group policy enforcement should follow a thoughtful design that starts with the lowest common denominator. These group policies must be restrictive at the appropriate level of the hierarchy.

This section describes the security baseline needed to harden Windows servers running ICM servers. This security baseline is essentially a collection of Microsoft Group Policy settings based on the Microsoft Security Baseline and the CIS Level 1 Reference Profile.

To apply the security baseline on the domain controller, complete the following steps:

1. Download the security guard templates applicable to the respective version of Windows from the Microsoft and CIS Benchmark URL. You can download these security protection templates fromhttps://www.microsoft.com/en-us/download/details.aspx?id=55319mihttps://workbench.cisecurity.org/files?q=&tags=3.

2. Install the latest Administrative Templates (ADMX) for Windows Server. These templates can be downloaded from the Microsoft website athttps://www.microsoft.com/en-us/download/details.aspx?id=103667. You can install the.msi installeron any Windows node as per your IT policy. Windows server can be ICM or non-ICM or domain controller.

3. Navigate to the installed location of Administrative Templates. Copy the template files listed below to the SYSVOL folder on the domain controller.

   • Copy the *.admx files from the PolicyDefinitions folder to\\SYSVOL\Policies\Policy Definitions

   • Copy the *.adml files from the PolicyDefinitions folderfor\\SYSVOL\Policies\PolicyDefinitions\en-US

     Observation

     The domain controller automatically copies the admx and adml files to all domain-joined machines. Select the applicable language code(In us)based on your deployment configuration. Create the PolicyDefinitions folder if it does not exist.

4. Create a group policy object on the domain controller using theGroup Policy Managementconsole and import the respective policy using the import configuration wizard in the console as detailed below. This can be done directly on the ICM nodes as per IT policy.

   • The downloaded Microsoft Baseline (see step 1) has a Group Policy Object (GPO) for Windows Client, Windows Server, Common GPO for Client and Server, Domain Controller, and Internet Explorer. We recommend that you import specific GPOs for Windows Server, Internet Explorer, and common GPOs for client and server.

   • The downloaded CIS baseline (see Step 1) has GPOs for Domain Controller, Microsoft, and User. We recommend importing only the GPO MS-L1 and User-L1.

5. Create the custom GPO on the domain controller to override the policies described inSecurity baseline policy exception for ICMand import the custom exception GPO using the import configuration wizard in the console. You can manually override policies directly on the ICM nodes based on IT policy.

6. Make sure that the imported exception policy (see Step 5) has the highest priority, so that the exception policy is applied after the Microsoft and CIS policies are applied.

   Observation

   Step 6 only applies to domain controllers.

7. Create the organizational unitCisco_ICM_Servers(or a similar identifiable name) under the domain. Assign all ICM machines to this OU. You can perform this step at any time, even before you perform step 1.

8. Link the created GPO (see Step 4 and Step 5) to the created OU (see Step 7).

9. Restart the ICM servers in the OU or run thegpupdateCommand on the respective target ICM nodes to apply the security baseline.

The following CIS reference policies affect the functionality of ICM.

The recommended values ​​(described in the table below) should be used for exception policies to override the CIS recommended values.

The following policies are optional. You can enable these policies based on IT policy after carefully considering the comments column.

Enable the following policies after installing the ICM server. See the Notes column for observed deviations.

Observation

CIS reference versions1.2.1 for Windows Server 2019, version 1.3.0 for Windows Server 2016, Microsoft Windows Server 2019 Baseline version 1809, and Microsoft Windows Server 2016 Baseline version 1607they are validated. Before applying the higher version of CIS and the Microsoft benchmark, review the additional policies introduced in the new version for the impact on ICM functionality and performance. We recommend that GPOs be tailored to the needs of your organization. We recommend deploying the GPOs to a small group of systems, preferably in a lab environment before deploying them to production. In addition to the GPO settings, disable the following settings on Windows Server: NetBIOS SMBv1