Securing VoIP networks has long taken a back seat to numerous other corporate IT priorities because while threats to these systems are known, there has yet to be a high-profile exploit to demonstrate the need for VoIP security. But times are changing. In the summer of 2006, two men were caught illegally routing calls over service provider Net2Phone's VoIP network. Also last year, the first VoIP phishing scam was launched that directed e-mail recipients to call an 800 number connecting them with a VoIP system that spoofed their bank and stole their personal information. While these examples represent minor pain compared to the wide-spread damage that worms, viruses, and other attacks have caused in the e-mail, Web, and instant-messaging worlds, they illustrate the point that VoIP security needs to be taken seriously. "Most organizations are too complacent and not placing the proper focus on protecting their VoIP systems," says Lawrence Orans, a research director at Gartner. The major threats to VoIP are not so different from those that plague the data world; denial-of-service (DoS) attacks, viruses, spam, and spoofing. But there are a few unique threats to the voice world, such as eavesdropping. Accordingly, securing VoIP traffic is not unlike protecting data traffic, except that there are vastly fewer companies and products focusing on the voice component at this point in time. Firewalls, intrusion-prevention systems, and other security elements that have become standard components of data networks are still emerging for VoIP, despite the rapid adoption of the underlying VoIP technology; IDC says VoIP expenditures hit $2.9 billion last year, and are expected to grow to $6.9 billion by 2011. "Security products need to understand voice protocols," says Mark Bornstein,manager of security marketing with Cisco. "We have to supply the same security standards to all types of traffic." While enterprises can't yet rely on most of today's data-centric security products to protect their voice traffic, security offerings specifically designed for VoIP are emerging. Cisco's Adaptive Security Appliance, for example, offers firewall, intrusion prevention, and content filtering features for traffic that uses a number of voice protocols, including Session Initiation Protocol (SIP) and Skinny Client Control Protocol (SCCP), Cisco's proprietary protocol. Other IP PBX makers, including Nortel, Avaya, 3Com, and others, also sell security devices that sit in front of their voice equipment to protect that traffic. Additionally, there's a growing market for third-party VoIP products. Companies including Sipera, Ingate, SecureLogix, Borderware, CheckPoint, and others make SIP firewalls, although Gartner's Orans says most enterprises are not yet using SIP,depending instead on the proprietary protocols that their IP PBX equipment vendors offer and their related security equipment. Another market that's forming around VoIP security is session border controllers, which enable two different VoIP providers to connect their networks, and often add security measures such as authentication and encryption to voice traffic. These products from companies such as Covergence, NexTone, Acme Packet, Ditech Communications, and others, are considered particularly useful for companies looking to deploy VoIP outside of a single domain. In addition to deploying VoIP-specific security products, enterprises can protect their IP telephony systems by ensuring that these, as well as their existing data networks, operating systems, and applications, follow best practices in security. "You have to apply the same hardening strategy [to VoIP networks] as you do to a normal data network," says David Endler, chairman of the VoIP Security Alliance and director of security research for TippingPoint. "But you can't have blinders on to just the VoIP system, you have to look at your entire environment." Basic steps such as changing default passwords on all software ? including products that may not seem related to the VoIP network but can affect it, such as third-party management tools ? as well as applying operating system patches in a timely fashion can help protect enterprises from VoIP threats, says Endler. Also, architecting networks so that VoIP traffic is segmented from the data network by a firewall can prevent an intruder or malware that penetrates one virtual LAN from getting at the other. Implementing quality-of service (QOS) policies that prioritize certain types of traffic is essential for VoIP networks, Endler says. In the case of a DoS attack or other such event that impacts network performance, VoIP traffic will be most sensitive to degradation that could render the voice network unusable. "VoIP applications really take some of the existing security threats inherited from the data network world and expand the severity because VoIP is just like any other data application, except that it's very unforgiving," Endler says. Since VoIP security is still a relatively new concept and not thoroughly understood by IT departments, many are turning to VoIP security assessments by third parties to help identify weaknesses and reinforce systems. Assessments are available from a number of service providers including Verizon Business, AT&T, and Sprint, as well as a host of testing companies. While these assessments can run in the tens of thousands of dollars, that cost pales in comparison to the toll of becoming the victim of a high-profile VoIP exploit.
Most Popular Reviews
- 1 Evapolar USB air conditioner review
- 2 LED Lenser P7R Professional Torch review
- 3 Aftershokz Wireless Trekz Titanium Bone Conduction Bluetooth Headphones review
- 4 Review: Periscope users rejoice with Feiyu’s G4 Plus 3-Axis Gimbal for Smartphone video
- 5 2016 Ford Mustang EcoBoost review
Latest News Articles
- Boat rental with GetMyBoat – the AirBnB of boating
- Review: Asus ROG G752 OC Edition - Faster than many desktop gaming PCs
- Make a Wi-Fi gadget with a $9.99 Orange Pi development board
- Analysts laud and lance new Microsoft browser armor
- Should I drill a hole into my iPhone 7 to give it a headphone jack?
GGG Evaluation Team
First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.
For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.
The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.
The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.
My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.
- CCProgram Manager - Data InsightVIC
- CCICT Security AuditorACT
- CCWAN Architect and ConsultantWA
- FTTest Manager (HP Quality Centre / ARIBA)NSW
- FTAndroid DeveloperNSW
- CCService Desk analystSA
- FTJava DeveloperNSW
- CCLAN ConsultantWA
- FTCustomer Solutions Engineer | Voice | Data | TelcoNSW
- CCContract Junior Programmer (J2EE/SQL) 160927/JP/551Asia
- FTDesktop/Application SupportVIC
- CCiOS DeveloperNSW
- CCNetwork Design Specialist - TelecommunicationsNSW
- FTTest SpecialistSA
- FTNetApp Storage ConsultantWA
- CCBusiness Analyst with change management experienceACT
- FTTechnical Support Engineer | Cloud | Automation techsNSW
- FTSenior Front End DeveloperNSW
- CCData Analyst | Data Management Framework | Experience in RNSW
- CCContract Systems Analyst (IT Security) 160928/JP/653Asia
- CCBusiness AnalystQLD
- CCSolution ArchitectQLD
- CCSecurity Cleared IT Professionals - Expression of InterestSA
- CCIT Security ArchitectACT
- FTInfrastructure Solutions ArchitectACT