Cisco IronPort Security Plug-in 7.3 Administrator Guide

Transcription

1 Cisco IronPort Security Plug-in 7.3 Administrator Guide May 01, 2013 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax:

2 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of DUB s public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental Cisco Systems, Inc. All rights reserved.

3 CONTENTS Getting Started with the Cisco IronPort Security Plug-in 1-1 What s New in this Release 1-1 Supported Configurations 1-2 Related Documents 1-2 How to Use This Guide 1-3 How This Book Is Organized 1-3 Where to Find More Information 1-4 Cisco IronPort Welcomes Your Comments 1-6 Cisco IronPort Security Plug-in Overview 1-7 Overview 2-1 The Cisco IronPort Security Plug-in 2-1 Installing the Plug-in 2-3 Configuration Modes 2-3 Deploying the Cisco IronPort Security Plug-in with the Cisco Registered Envelope Service (CRES) Key Server 2-5 Deploying the Cisco IronPort Security Plug-in with the IronPort Encryption Appliance (IEA) Key Server 2-6 Downloading the IEA Key Server Token 2-6 Customizing and Signing the Configuration File 2-7 Deploying the Configuration File to the End User 2-8 Configuring Settings for the Cisco IronPort Security Plug-in 2-9 i

4 Contents Performing a Mass Installation 3-1 Performing the Installation 3-1 Using Custom Configuration Files 3-15 Overview 3-16 Editing the XML Configuration Files 3-16 Mass Installation Using the BCE_Config.xml File 3-18 Deploying the Custom Configuration Files 3-20 Configuring and Using the Cisco IronPort Security Plug-in for Outlook 4-1 Cisco IronPort Security Plug-in For Outlook General Settings 4-2 Enable or Disable 4-2 Configuring Basic Settings for the Outlook Plug-in 4-3 Reporting Unwanted s-Spam, Virus, and Phishing Attacks 4-4 Using the Reporting Plug-in for Outlook 4-6 Encrypting Flag and Desktop Encryption Configuration 4-12 Launching the Security Plug-in Configuration File 4-12 Flag Encryption 4-14 Flag Encryption Options 4-15 Desktop Encryption 4-20 Desktop Encryption Options 4-21 Sending Encrypted Manage Secure Messages 4-35 Receiving Secure s 4-37 Opening Your First Encrypted Secure Message 4-42 Changing Logging Settings 4-46 Errors and Troubleshooting 4-48 Outlook Startup Errors 4-49 ii

5 Contents Message Reporting Errors 4-50 Decryption and Encryption Errors 4-51 Repairing Cisco Security Plug-in for Outlook Files 4-53 Troubleshooting Using the Diagnostic Tool 4-54 Data Collected by the Cisco IronPort Security Diagnostic Tool 4-54 Running the Cisco IronPort Security Diagnostic Tool 4-55 Uninstalling the Cisco IronPort Security Plug-in 4-57 IronPort End User License Agreement A-1 Cisco IronPort Systems, LLC Software License Agreement A-1 iii

6 Contents iv

7 CHAPTER 1 Getting Started with the Cisco IronPort Security Plug-in This chapter contains the following sections: What s New in this Release, page 1-1 Supported Configurations, page 1-2 Related Documents, page 1-2 How to Use This Guide, page 1-3 Cisco IronPort Security Plug-in Overview, page 1-7 What s New in this Release This release includes the following new features: Ability to configure Cisco Ironport Security Plug-in to use a Cisco Ironport Encryption appliance (IEA) or Cisco Registered Envelope Service (CRES) as the hosted key server. Outlook bit Support. Automatic Configuration. The Cisco Ironport Security Plug-in is automatically configured by an XML file attachment received from the administrator. Configuration Per Account. The Cisco Ironport Security Plug-in is deployed in three modes that determine the configuration per account as Decrypt Only, Flag, or Encrypt. 1-1

8 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in Desktop Encryption Secure Envelope Options. Lock or unlock encrypted . The end user is able to lock or unlock encrypted . They can also set and modify the reason for locking the encrypted . Set the expiration date and time for encrypted . The end user can set or clear an expiration date and time. Supported Configurations The Cisco Encryption Compatibility Matrix lists the supported operating systems and can be accessed from the following URL: patibility_matrix.pdf Related Documents To use the Encryption plug-in, you need to have a Cisco IronPort Encryption appliance running and properly configured to work with the Encryption plug-in or have a Cisco Registered Envelope Service (CRES) account. To understand how to configure the Cisco IronPort Encryption appliance, you may want to review the following guides: IronPort Encryption Appliance Installation Guide. This guide provides instructions for installing and configuring encryption, and it may help you to understand how to configure your encryption appliance settings to work with the plug-in settings you configure. See: To better understand how Cisco IronPort Security works, you may want to review some basic information about how is classified as spam, virus, or as non-spam. For more details on these subjects, you may want to review the following guide: Cisco IronPort AsyncOS for Configuration Guide. This guide contains information on spam and virus protection. Users can improve the efficacy of the SenderBase network by employing the spam and virus plug-in. When 1-2

9 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in users marks an as spam, virus, or not spam, they can train the filters to become more effective and improve the performance of all Cisco IronPort appliances. See: How to Use This Guide Use this guide as a resource to learn about the features in your Cisco IronPort Security Plug-in. The topics are organized in a logical order, but you might not need to read every chapter in the book. Review the Table of Contents and the section called How This Book Is Organized, page 1-3 to determine which chapters are relevant to your particular configuration. This guide is distributed electronically as a PDF. The electronic versions of the guide are available on the Cisco IronPort Customer Support Portal. You can also access an HTML online help tool in the appliance GUI: In Outlook 2010, go to Tools > Options > Cisco Security. Click the Help button in Outlook, then click Actions > Cisco Security. In Outlook 2003/2007, go to Tools > Options > Cisco Security > Help. How This Book Is Organized Chapter 1, Getting Started with the Cisco IronPort Security Plug-in provides an introduction to the Cisco IronPort Security plug-in and defines its key features and role in network security configurations. New features of the current release are described along with information about other resources for information and support contact information. Chapter 2, Overview introduces the Reporting Plug-in and the Encryption plug-in. This section provides an overview of each of these tools. Chapter 3, Performing a Mass Installation describes how to perform a mass installation. The instructions provide steps for running the install. 1-3

10 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in Chapter 4, Configuring and Using the Cisco IronPort Security Plug-in for Outlook provides instructions for configuring the Cisco IronPort Security Plug-in for Outlook. It includes steps for installing the encryption plug-in, sending or receiving encrypted , and managing secure messages. Appendix A, Cisco IronPort Systems, LLC Software License Agreement contains detailed information about the licensing agreements for Cisco IronPort products. Where to Find More Information Cisco offers the following resources to learn more about the Cisco IronPort Security Plug-in. Security Training Services & Certification Knowledge Base Cisco Security Training Services deliver exceptional education and training for Cisco security products and solutions. Through a targeted curriculum of technical training courses, the program provides up-to-date knowledge and skills transfer to different audiences. Use one of the following methods to contact Cisco Security Training Services: Training. For question relating to registration and general training: stbu-trg@cisco.com Certifications. For questions relating to certificates and certification exams: stbu-trg@cisco.com You can access the Cisco IronPort Knowledge Base on the Cisco IronPort Customer Support site at the following URL: The Knowledge Base contains a wealth of information on topics related to Cisco IronPort products. 1-4

11 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in Cisco Support Community Articles generally fall into one of the following categories: How-To. These articles explain how to do something with a Cisco IronPort product. For example, a how-to article might explain the procedures for backing up and restoring a database for an appliance. Problem-and-Solution. A problem-and-solution article addresses a particular error or issue that you might encounter when using a Cisco IronPort product. For example, a problem-and-solution article might explain what to do if a specific error message is displayed when you upgrade to a new version of the product. Reference. Reference articles typically provide lists of information, such as the error codes associated with a particular piece of hardware. Troubleshooting. Troubleshooting articles explain how to analyze and resolve common issues related to Cisco IronPort products. For example, a troubleshooting article might provide steps to follow if you are having problems with DNS. Cisco Support Community is an online forum for Cisco customers, partners, and employees. It provides a place to discuss general and web security issues, as well as technical information about specific Cisco products. You can post topics to the forum to ask questions and share information with other Cisco and Cisco IronPort users. You can access the Cisco Support Community from the following URL: 1-5

12 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in Cisco Customer Support Note The level of support available to you depends upon your service level agreement. Cisco IronPort Customer Support service level agreement details are available on the Support Portal. Check this page for details about your level of support. You can request support by phone, , or online 24 hours a day, 7 days a week. You can contact Cisco Customer Support using one of the following methods: Cisco Support Portal: Phone support: Contact Cisco Technical Assistance Center (TAC) within U.S. /Canada at and at Worldwide Phone Numbers. tac@cisco.com If you purchased support through a reseller or another supplier, please contact that supplier directly with your product support issues. Cisco Content Security Welcomes Your Comments The Cisco Content Security Technical Publications team is interested in improving the product documentation. Your comments and suggestions are always welcome. You can send comments to the following address: contentsecuritydocs@cisco.com 1-6

13 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in Cisco IronPort Security Plug-in Overview The Cisco IronPort Security Plug-in installs reporting and encryption menus onto Outlook . The reporting plug-in enables users to submit feedback about the type of mail they receive (for example, users can report spam, phishing, and virus s), and the encryption plug-in places an encrypt message button on the toolbar which enables users to either send encrypted from their programs or to flag the to be encrypted before it leaves their organizations. When the Cisco IronPort Security Plug-in is installed, it enables components on an Outlook mail client. This single interface allows end-users to seamlessly report s or send encrypted . End users can lock or unlock encrypted s, adding or modifying a lock reason. End users can also set an expiration date and time for the encrypted . Combining these plug-ins simplifies installation and provides a single interface for users and Administrators to install and modify. The reporting and encryption plug-ins provide a convenient interface that enables you to submit feedback and send encrypted messages by using toolbar buttons and right-click context menus. If you are using the reporting plug-in to report a message, a dialog box appears indicating that the message was submitted. The Encryption Plug-in places an Encrypt Message button in the menu bar of an message to provide an easy way for senders to encrypted messages. The Encryption plug-in requires the presence and proper configuration of a Cisco IronPort Encryption appliance or have a Cisco Registered Envelope Service (CRES) account. 1-7

14 Chapter 1 Getting Started with the Cisco IronPort Security Plug-in 1-8

15 CHAPTER 2 Overview The Cisco IronPort Security Plug-in framework supports several Cisco IronPort Security Plug-ins, including the Reporting plug-in and the Encryption plug-in. This chapter contains the following sections: The Cisco IronPort Security Plug-in, page 2-1 Installing the Plug-in, page 2-3 Configuration Modes, page 2-3 Deploying the Cisco IronPort Security Plug-in with the Cisco Registered Envelope Service (CRES) Key Server, page 2-5 Deploying the Cisco IronPort Security Plug-in with the IronPort Encryption Appliance (IEA) Key Server, page 2-6 Configuring Settings for the Cisco IronPort Security Plug-in, page 2-9 TCP/IP Services Required for the Cisco IronPort Security Plug-in, page 2-9 The Cisco IronPort Security Plug-in The Cisco IronPort Security Plug-in consists of two commonly used security plug-ins: the Reporting plug-in and the Encryption plug-in. You may deploy the Cisco IronPort Security Plug-in on your Outlook program. When you deploy the Cisco IronPort Security Plug-in, it installs one or both of the following applications: 2-1

16 Chapter 2 Overview The Reporting Plug-in The Encryption Plug-in The Reporting Plug-in. The Reporting Plug-in enables Outlook users to submit feedback to Cisco IronPort Systems about unsolicited and unwanted messages, such as spam, viruses, and phishing messages. For details, see The Reporting Plug-in, page 2-2. The Encryption Plug-in. The Encryption Plug-in places an Encrypt Message button in the menu bar of an message to provide an easy way for a sender to mark a message to be encrypted. For details, see The Encryption Plug-in, page 2-2. The Reporting Plug-in enables Outlook users to submit feedback to Cisco IronPort Systems about unsolicited and unwanted messages, such as spam, viruses, and phishing messages. Cisco IronPort uses this feedback to update its filters to stop unwanted messages from being delivered to your inbox. You can also report false positives, which are legitimate messages that are marked as spam, to IronPort Systems by using the Not Spam button. Legitimate messages are often referred to as ham. Cisco uses reports about false positives to adjust its spam filters to avoid misclassifying legitimate in the future. Any valid can be reported as Not Spam and will help to increase filter efficacy. This plug-in provides a convenient interface that enables you to submit feedback by using toolbar buttons and right-click context menus. When you report a message, a dialog box appears indicating that the message was submitted. The message data that you submit is used by automated systems to improve the Cisco IronPort filters. By submitting message data, you help to reduce the volume of unsolicited in your inbox. The Encryption Plug-in places an Encrypt Message button in the menu bar of an message to provide an easy way for senders to mark messages to be encrypted and secured before it leaves the organization. There are two types of encryption available: Flag Encryption and Desktop Encryption. The Flag Encryption option allows you to flag the for encryption, and the is encrypted by the Cisco IronPort Encryption appliance or Security appliance before the is sent out of the network. Desktop 2-2

17 Chapter 2 Overview Encryption allows you to encrypt from within your program using the Cisco IronPort encryption technology. Then, it sends the encrypted from your desktop. You may want to use Desktop Encryption if you want to ensure that mail sent within your organization is encrypted. The Encryption plug-in is designed to work with a functioning and configured Cisco IronPort Encryption appliance or a Cisco IronPort Security appliance (if you have one in your network). The configuration you use for the Encryption plug-in should be developed in conjunction with the settings on these appliances. If you do not use the same configurations for these appliances, issues may occur when sending encrypted messages. Installing the Plug-in To install the Cisco IronPort Security Plug-in for groups of users, you will likely want to perform a silent installation. A silent installation allows you to perform an installation without prompting the end user for input. For instructions on performing the silent installation, see Chapter 3, Performing a Mass Installation. Configuration Modes The Cisco IronPort Security Encryption Plug-in is deployed in three separate configuration modes. The default configuration mode is Decrypt Only. In order to enable the other configuration modes, the Outlook account is configured by an updated attachment file received from the administrator. The administrator sends a BCE_Config_signed.xml file attachment to the end user s account. The end user will receive this file as a securedoc.html file. When the end user clicks the securedoc.html attachment, the Outlook application detects the configuration information attached to the message and applies the updated configuration. Note The default envelope name is securedoc.html.the attachment name value can be changed by the administrator and the envelope will reflect the newly specified name. 2-3

18 Chapter 2 Overview The three configuration modes are: Decrypt Only Allows decrypting of secure messages received. Decrypt and Flag Allows decrypting and flagging of secure s messages. The flag option allows the end user to flag the for encryption, and the is encrypted by the Cisco IronPort Encryption appliance or Security appliance before the is sent out of the network. The server must be configured to detect the flagged messages and encrypt them at the server. Decrypt and Encrypt Allows encrypting and decrypting of secure messages. The following table specifies which features are supported in each configuration mode. Feature Decrypt Only Decrypt and Flag Decrypt and Encrypt Send encrypted message X Flag message for encryption X Open encrypted X X X Reply/Reply All/Forward Message X lock and unlock X expiration X diagnostic (Uses for Reporting and Encryption Plug-ins) X X X Read-receipt X Envelope settings X Settings X X X 2-4

19 Chapter 2 Overview Deploying the Cisco IronPort Security Plug-in with the Cisco Registered Envelope Service (CRES) Key Server Use the following instructions to deploy the Cisco IronPort Security Plug-in so that it is used directly with the Cisco Registered Service (CRES) key server. To begin, log into your CRES account: and go to the Accounts tab. Select the account from which you want to enable the Security Plug-in. Then, go to the BCE Config tab. Step 1 Step 2 Step 3 Choose the token to use with the configuration template: CRES Select if your key server is CRES. SecureCompose Do not choose this option as your CRES token. Token <Account number> Choose this option as your CRES token. Click Download Template to download the template file in order to edit it. The filename is BCE_Config.xml. Edit the configuration file. The BCE_Config.xml file contains detailed instructions for the fields you will need to edit based on your particular environment. Open the file in a text editor and follow the instructions included in the comments to make the necessary modifications. Note Step 4 For localization purposes, do not change or reword the existing Message Security labels Low, Medium, or High. Click Browse to navigate to the edited BCE_Config.xml file, and click Upload and Sign after you have located the file. Once the configuration file is signed, the signed version will be downloaded as BCE_Config_signed.xml. Save this file to your local machine. 2-5

20 Chapter 2 Overview Step 5 To deploy the configuration file to many end users at once, use the Distribute Signed Configuration to Bulk List option. To do so: a. Browse to the BCE_Config_signed.xml file created in Step 4. b. Browse to a comma separated file containing the addresses of end users. c. Change the subject as needed. d. Click Distribute Config. Note If the xml configuration file is forwarded to another end user, versus received from the administrator, the auto configuration will not work and an error is received. Note Do not send the BCE_Config_signed.xml file to a mailing list. CRES does not support mailing lists. Deploying the Cisco IronPort Security Plug-in with the IronPort Encryption Appliance (IEA) Key Server Downloading the IEA Key Server Token The IEA token is needed for use during the configuration signing process. Before signing the configuration file, download the token to your local machine. To download the token file from the IEA key server: Step 1 Log into your IEA administration console: The Administration Console displays. 2-6

21 Chapter 2 Overview Step 2 Step 3 Go to the Accounts tab. Go to the account to use with your plug-in installations. This is usually the Users account. Go to the Tokens tab. Click the Save Token icon (looks like a circle with a down arrow) to the right of the token and save it to your local machine. Customizing and Signing the Configuration File Once the IEA token file has been downloaded, the configuration file can be customized and signed. The Cisco Registered Envelope Service (CRES) is a hosted service that provides support for Cisco IronPort Encryption Technology. Because the plug-in configuration file signature verification is performed by the CRES system, customers using an IEA as their key server who want to deploy the Cisco IronPort Security Plug-in will also need an administrator account on CRES. If you need a CRES administrator account created for you, contact Cisco IronPort Customer Support at: To create a signed configuration file for use with the IEA key server: Step 1 Step 2 Step 3 Step 4 Step 5 Log into your CRES account: The Administration Console displays. Go to the Accounts tab and select the account from which you want to enable the Security Plug-in. Then, go to the BCE Config tab. Choose IEA as the token type, then upload the IEA token you previously downloaded from the IEA. Click Download Template to download the template file in order to edit it. The filename is BCE_Config.xml. Edit the configuration file. The BCE_Config.xml file contains detailed instructions for the fields you will need to edit based on your particular environment. Open the file in a text editor and follow the instructions included in the comments to make the necessary modifications. Note For localization purposes, do not change or reword the existing Message Security labels Low, Medium, or High. 2-7

22 Chapter 2 Overview Step 6 Click Browse to navigate to the edited BCE_Config.xml file, and click Upload and Sign after you have located the file. Once the configuration file is signed, the signed version will be downloaded as BCE_Config_signed.xml. Save this file to your local machine. Note Do not use Step 5 on the BCE config tab Distribute Signed Configuration File to Bulk List (optional) when using the IEA as key server. This option only applies to CRES and will be removed in a future release. Deploying the Configuration File to the End User To deploy the configuration file to end users, send the signed configuration file in an encrypted on the IEA to each end user. The message must be sent from an address that is listed as an administrator on the IEA and on the CRES account. Note If the xml configuration file is forwarded to another end user, versus received from the administrator, the auto configuration will not work and an error is received. Note Do not send the BCE_Config_signed.xml file to a mailing list. CRES does not support mailing lists. To perform a mass installation using the BCE_Config_signed.xml file, see Mass Installation Using the BCE_Config.xml File, page

23 Chapter 2 Overview Configuring Settings for the Cisco IronPort Security Plug-in After you install the Cisco IronPort Security Plug-in, you can make configuration changes from the Cisco Security tab in Outlook. In Outlook 2010, go to File > Options > Add-ins > Add-in Options > Cisco Security. In Outlook 2003/2007, go to Tools > Options > Cisco Security. You can make changes to the Reporting plug-in installation or the Encryption plug-in installation. Or, you can make changes to general options that affect both plug-in installations. For example, you can enable or disable logging for the Cisco IronPort Security Encryption Plug-in or you can modify options for a specific encryption mode. To change the method for marking for Encryption, you need to make changes to the BCE_Config.xml file and perform an auto-configuration. Any of the specified settings must be compatible with your Cisco IronPort Encryption appliance. To make configuration changes on an Outlook installation, see Chapter 4,. TCP/IP Services Required for the Cisco IronPort Security Plug-in Cisco IronPort Security Plug-in requires the use of the following TCP/IP services and their associated ports. These ports must be left available for the TCP/IP services to use. DNS (Domain Name System). The DNS service translates Internet domain and host names to IP addresses. DNS automatically converts the names we type in our Web browser address bar to the IP addresses of Web servers hosting those sites. Port number: 53 (TCP/UDP) 2-9

24 Chapter 2 Overview For more information, see: Impact: High Resolution: This service must be accessible to all end users. SMTP (Simple Mail Transfer Protocol) Simple Mail Transfer Protocol (SMTP) is an Internet standard for electronic mail ( ) transmission across Internet Protocol (IP) networks. Port number: 25, 587, 465, 475, 2525 (TCP) For more information, see: Impact: High Resolution: This service must be accessible to all end users. DHCP (Dynamic Host Configuration Protocol) DHCP is a network protocol used to configure devices that are connected to a network (known as hosts) so they can communicate on that network using the Internet Protocol (IP) Port number: 67, 68 (TCP/UDP) For more information, see: Impact: High Resolution: This service must be accessible to all end users which obtain IP addresses automatically from DHCP server. Net BIOS over TCP/IP NetBIOS over TCP/IP (NBT, or sometimes NetBT) is a networking protocol that allows legacy computer applications relying on the NetBIOS API to be used on modern TCP/IP networks. Port number: 137(UDP) (name services), 138(UDP) (datagram services), 139(TCP) (session services) For more information, see: Impact: High Resolution: This service must be accessible to all end users. 2-10