Bogdan's Blog: VoIP Security

June 03, 2008

VoIP Security - Myth #5

Myth #5 - My VoIP infrastructure is secure because...

"I have deployed VoIP infrastructure using proprietary protocols and applications from vendor X. They assured me that my VoIP is fully secure."

This is good, but how do you know? There are hundreds of known vulnerabilities related to all VoIP vendors. And most of the vendors does not even talk about security until they finalize the sale.

I suggest you start with a good risk analysis process. Identify your corporate assets that are vulnerable because they are stored/transmitted over VoIP infrastructure. Any revenue generating services you provide to your customers using telecommunication network. Internal business processes that relay on Unified Communication. And remember your data networks could be attacked through VoIP exploits and vice versa. Once you established your risk areas you can define the ways to minimize the risks associated with security breaches.

A commonly used approach from the data security world, vulnerability assessment (VA) is particularly effective as a proactive way of finding security problems and fixing them before they become real problems. By performing a VoIP VA in the lab, before any VoIP equipment and applications are deployed organizations are able to verify the vendor claims and identify security flaws early in the deployment cycle. Executing a VoIP VA of all components prior to the commissioning of
the VoIP infrastructure is recommended as interactions and dependencies between VoIP applications and devices could potentially create additional security vulnerabilities not visible during earlier assessments in the lab. Once VoIP is deployed, periodic or, where required, continuous vulnerability assessments should become cornerstone of an overall proactive VoIP security process. Once security vulnerabilities are identified they should be addressed by appropriate actions such as patching, re-configurations and network tuning.

Within the VoIP network, various security architectures and solutions should be deployed to protect VoIP services from security threats during their life cycle. Any security architectures and solutions deployed must be “VoIP aware” so they do not impact VoIP service quality and reliability. It is recommended deploying multi-layer security infrastructure that provides both perimeter as well as internal network protection. In most cases, it will consists of a number of security devices and host based applications. A comprehensive VoIP aware protection security infrastructure should include VoIP aware firewalls, Session Border Controllers (SBC), VoIP Intrusion Prevention Systems (VIPS), VoIP DoS defenses, VoIP Network Intrusion Detection Systems (IDS), Host VoIP IPS, VoIP Network Access Control (VNAC) and VoIP Anti-SPIT. All the devices and applications have to be coordinated via a higher level application providing unified view of the end-to-end VoIP infrastructure.

Review all your security processes, procedures and training materials. The existing security related processes should be reviewed and modified to accommodate specific requirements of VoIP networks. Also, the compliance and auditing processes should include VoIP as a component. For example, only certified VoIP soft-client should be used on the network. Also phone conversations that are confidential should only be allowed on encrypted links to prevent eavesdropping. GLBA compliance could require providing documented vulnerability assessment results and mitigation steps undertaken to address the discovered vulnerabilities.

If you implement these recommendation you'll be able to report to your management that your VoIP infrastructure is pretty secure and you should be able even to prove that.

Posted at 10:40 AM | Permalink

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/services/trackback/6a00e551f607db883300e552a116028834

Listed below are links to weblogs that reference VoIP Security - Myth #5:

Comments

You can follow this conversation by subscribing to the comment feed for this post.

With VOIP, voice traffic is carried over a packet-switched data network via Internet Protocol. VOIP networks treat voice as another form of data but use sophisticated voice-compression algorithms to ensure optimal bandwidth utilization. As a result, VOIP networks are able to carry many more voice calls than traditional switched circuit networks. VOIP also enables enhanced services such as unified communications.This security workship is the third following successful events in Dallas 2004 and Washington 2005. The workshop addresses the challenges, advanced technologies and regulations for providing secure VoIP services over the Internet as well as in third generation networks.The 2006 workshop will extend the scope of VoIP security to IMS services and present the latest advances in denial of service and SPIT detection and protection mechanisms. The format of the workshop is based on two-day single-track sessions, with presentations of invited and regular papers from academia and industry.
------------------------------------
francis
Link Building

Posted by: francis | October 04, 2008 at 04:41 PM

Thank you for this article. I've found something similar by means of rapidshare search engine( http://www.rapidsharemix.com ) , but they didn't help me much. Your article was of more help to me )

Posted by: Rogelio | January 15, 2010 at 05:50 AM

Do you desire a house but you lack enough cash to acquire it?

Posted by: RamonGustav | August 28, 2010 at 01:41 PM

Have you been turned down by other lenders?

Posted by: RamonGustav | September 01, 2010 at 12:35 AM

I think you are not quite right and you should still studying the matter.

Posted by: Buy_Viagra | September 17, 2010 at 09:08 AM

Are you eager to secure funds for that dream project of yours?

Posted by: Buy_Viagra | September 17, 2010 at 07:55 PM

Are you eager to secure funds for that dream project of yours?

Posted by: Buy_Viagra | September 18, 2010 at 06:02 AM

cialis tadalafil cialis tadalafil 100mg cialis tadalafil 20 mg cialis tadalafil american express cialis tadalafil canada cialis tadalafil cialis tadafil tal cialis tadalafil reviews cialis tadalafil viagra cialis tadalafil work cialis the dangers fda cialis the sex pill cialis to buy

Posted by: Hot_cialis | October 30, 2010 at 05:48 PM

buy cialis buy cialis at a discount buy cialis brand buy cialis by the pill buy cialis canada buy cialis cheap buy cialis cheaper online buy cialis mexico buy cialis omline buy cialis online 20mg buy cialis online site buy cialis online viagra buy cialis pharmacy buy cialis pills generic

Posted by: Hot_cialis | October 31, 2010 at 12:18 AM