Guide to VoIP security

New ways to hack VoIP aren't fatal if you're prepared for them

Securing VoIP networks has long taken a back seat to numerous other corporate IT priorities because while threats to these systems are known, there has yet to be a high-profile exploit to demonstrate the need for VoIP security.

But times are changing.

In the summer of 2006, two men were caught illegally routing calls over service provider Net2Phone's VoIP network. Also last year, the first VoIP phishing scam was launched that directed e-mail recipients to call an 800 number connecting them with a VoIP system that spoofed their bank and stole their personal information.

While these examples represent minor pain compared to the wide-spread damage that worms, viruses, and other attacks have caused in the e-mail, Web, and instant-messaging worlds, they illustrate the point that VoIP security needs to be taken seriously.

"Most organizations are too complacent and not placing the proper focus on protecting their VoIP systems," says Lawrence Orans, a research director at Gartner.

The major threats to VoIP are not so different from those that plague the data world; denial-of-service (DoS) attacks, viruses, spam, and spoofing. But there are a few unique threats to the voice world, such as eavesdropping.

Accordingly, securing VoIP traffic is not unlike protecting data traffic, except that there are vastly fewer companies and products focusing on the voice component at this point in time. Firewalls, intrusion-prevention systems, and other security elements that have become standard components of data networks are still emerging for VoIP, despite the rapid adoption of the underlying VoIP technology; IDC says VoIP expenditures hit $2.9 billion last year, and are expected to grow to $6.9 billion by 2011.

"Security products need to understand voice protocols," says Mark Bornstein,manager of security marketing with Cisco. "We have to supply the same security standards to all types of traffic."

While enterprises can't yet rely on most of today's data-centric security products to protect their voice traffic, security offerings specifically designed for VoIP are emerging.

Cisco's Adaptive Security Appliance, for example, offers firewall, intrusion prevention, and content filtering features for traffic that uses a number of voice protocols, including Session Initiation Protocol (SIP) and Skinny Client Control Protocol (SCCP), Cisco's proprietary protocol. Other IP PBX makers, including Nortel, Avaya, 3Com, and others, also sell security devices that sit in front of their voice equipment to protect that traffic.

Additionally, there's a growing market for third-party VoIP products. Companies including Sipera, Ingate, SecureLogix, Borderware, CheckPoint, and others make SIP firewalls, although Gartner's Orans says most enterprises are not yet using SIP,depending instead on the proprietary protocols that their IP PBX equipment vendors offer and their related security equipment.

Another market that's forming around VoIP security is session border controllers, which enable two different VoIP providers to connect their networks, and often add security measures such as authentication and encryption to voice traffic. These products from companies such as Covergence, NexTone, Acme Packet, Ditech Communications, and others, are considered particularly useful for companies looking to deploy VoIP outside of a single domain.

In addition to deploying VoIP-specific security products, enterprises can protect their IP telephony systems by ensuring that these, as well as their existing data networks, operating systems, and applications, follow best practices in security.

"You have to apply the same hardening strategy [to VoIP networks] as you do to a normal data network," says David Endler, chairman of the VoIP Security Alliance and director of security research for TippingPoint. "But you can't have blinders on to just the VoIP system, you have to look at your entire environment."

Basic steps such as changing default passwords on all software ? including products that may not seem related to the VoIP network but can affect it, such as third-party management tools ? as well as applying operating system patches in a timely fashion can help protect enterprises from VoIP threats, says Endler.

Also, architecting networks so that VoIP traffic is segmented from the data network by a firewall can prevent an intruder or malware that penetrates one virtual LAN from getting at the other.

Implementing quality-of service (QOS) policies that prioritize certain types of traffic is essential for VoIP networks, Endler says. In the case of a DoS attack or other such event that impacts network performance, VoIP traffic will be most sensitive to degradation that could render the voice network unusable.

"VoIP applications really take some of the existing security threats inherited from the data network world and expand the severity because VoIP is just like any other data application, except that it's very unforgiving," Endler says.

Since VoIP security is still a relatively new concept and not thoroughly understood by IT departments, many are turning to VoIP security assessments by third parties to help identify weaknesses and reinforce systems. Assessments are available from a number of service providers including Verizon Business, AT&T, and Sprint, as well as a host of testing companies.

While these assessments can run in the tens of thousands of dollars, that cost pales in comparison to the toll of becoming the victim of a high-profile VoIP exploit.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Network World staff

Network World

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?