Cisco TelePresence Administrator's Manual page 69

Field Description
HTTP Strict Determines whether web
Transport browsers are instructed to
Security only ever use a secure
(HSTS) connection to access this
server. Enabling this feature
gives added protection
against man-in-the-middle
(MITM) attacks.
On: the Strict-Transport-
Security header is sent with
all responses from the web
server, with a 1 year expiry
time.
Off: the Strict-Transport-
Security header is not sent,
and browsers work as
normal.
Default is On.
Note: by default, access via HTTPS and SSH is enabled; access via Telnet is disabled. To securely manage
the VCS you should disable Telnet, using the encrypted HTTPS and SSH protocols instead. For further
security, disable HTTPS and SSH as well and use the serial port to manage the system.
Because access to the serial port allows the password to be reset, it is recommended that you install the
VCS in a physically secure environment.
HTTP Strict Transport Security (HSTS)
HTTP Strict Transport Security (HSTS) provides a mechanism, where a web server forces a web browser to
communicate with it using secure connections only.
As of January 2012, this mechanism is supported by the following browsers:
Chrome, versions 4 and later
n
Firefox, versions 4.0.211.0 and later
n
When HSTS is enabled, a browser that supports HSTS will:
Automatically turn any insecure links to the website into secure links (for example,
n
http://example.com/page/ is modified to https://example.com/page/ before accessing the
server).
Only allows access to the server if the connection is secure (for example, the server's TLS certificate is
n
valid, trusted and not expired).
Browsers that do not support HSTS will ignore the Strict-Transport-Security header and work as before. They
will still be able to access the server.
Note that compliant browsers only respect Strict-Transport-Security headers if they access the server
through its fully qualified name (rather than its IP address).
Cisco VCS Administrator Guide (X7.2)
Usage tips
See below for more information about HSTS.
Network and system settings
Page 69 of 498