Securing VoIP networks has long taken a back seat to numerous other corporate IT priorities because while threats to these systems are known, there has yet to be a high-profile exploit to demonstrate the need for VoIP security. But times are changing. In the summer of 2006, two men were caught illegally routing calls over service provider Net2Phone's VoIP network. Also last year, the first VoIP phishing scam was launched that directed e-mail recipients to call an 800 number connecting them with a VoIP system that spoofed their bank and stole their personal information. While these examples represent minor pain compared to the wide-spread damage that worms, viruses, and other attacks have caused in the e-mail, Web, and instant-messaging worlds, they illustrate the point that VoIP security needs to be taken seriously. "Most organizations are too complacent and not placing the proper focus on protecting their VoIP systems," says Lawrence Orans, a research director at Gartner. The major threats to VoIP are not so different from those that plague the data world; denial-of-service (DoS) attacks, viruses, spam, and spoofing. But there are a few unique threats to the voice world, such as eavesdropping. Accordingly, securing VoIP traffic is not unlike protecting data traffic, except that there are vastly fewer companies and products focusing on the voice component at this point in time. Firewalls, intrusion-prevention systems, and other security elements that have become standard components of data networks are still emerging for VoIP, despite the rapid adoption of the underlying VoIP technology; IDC says VoIP expenditures hit $2.9 billion last year, and are expected to grow to $6.9 billion by 2011. "Security products need to understand voice protocols," says Mark Bornstein,manager of security marketing with Cisco. "We have to supply the same security standards to all types of traffic." While enterprises can't yet rely on most of today's data-centric security products to protect their voice traffic, security offerings specifically designed for VoIP are emerging. Cisco's Adaptive Security Appliance, for example, offers firewall, intrusion prevention, and content filtering features for traffic that uses a number of voice protocols, including Session Initiation Protocol (SIP) and Skinny Client Control Protocol (SCCP), Cisco's proprietary protocol. Other IP PBX makers, including Nortel, Avaya, 3Com, and others, also sell security devices that sit in front of their voice equipment to protect that traffic. Additionally, there's a growing market for third-party VoIP products. Companies including Sipera, Ingate, SecureLogix, Borderware, CheckPoint, and others make SIP firewalls, although Gartner's Orans says most enterprises are not yet using SIP,depending instead on the proprietary protocols that their IP PBX equipment vendors offer and their related security equipment. Another market that's forming around VoIP security is session border controllers, which enable two different VoIP providers to connect their networks, and often add security measures such as authentication and encryption to voice traffic. These products from companies such as Covergence, NexTone, Acme Packet, Ditech Communications, and others, are considered particularly useful for companies looking to deploy VoIP outside of a single domain. In addition to deploying VoIP-specific security products, enterprises can protect their IP telephony systems by ensuring that these, as well as their existing data networks, operating systems, and applications, follow best practices in security. "You have to apply the same hardening strategy [to VoIP networks] as you do to a normal data network," says David Endler, chairman of the VoIP Security Alliance and director of security research for TippingPoint. "But you can't have blinders on to just the VoIP system, you have to look at your entire environment." Basic steps such as changing default passwords on all software ? including products that may not seem related to the VoIP network but can affect it, such as third-party management tools ? as well as applying operating system patches in a timely fashion can help protect enterprises from VoIP threats, says Endler. Also, architecting networks so that VoIP traffic is segmented from the data network by a firewall can prevent an intruder or malware that penetrates one virtual LAN from getting at the other. Implementing quality-of service (QOS) policies that prioritize certain types of traffic is essential for VoIP networks, Endler says. In the case of a DoS attack or other such event that impacts network performance, VoIP traffic will be most sensitive to degradation that could render the voice network unusable. "VoIP applications really take some of the existing security threats inherited from the data network world and expand the severity because VoIP is just like any other data application, except that it's very unforgiving," Endler says. Since VoIP security is still a relatively new concept and not thoroughly understood by IT departments, many are turning to VoIP security assessments by third parties to help identify weaknesses and reinforce systems. Assessments are available from a number of service providers including Verizon Business, AT&T, and Sprint, as well as a host of testing companies. While these assessments can run in the tens of thousands of dollars, that cost pales in comparison to the toll of becoming the victim of a high-profile VoIP exploit.
Most Popular Reviews
- 1 2016 Ford Mustang EcoBoost review
- 2 Review: TCL C1 series 4K TV
- 3 Sony 75-inch UHD TV (X9400C) review: Sony and Android are a winning duo
- 4 LG 55EG960T OLED UHD TV
- 5 Panasonic Viera UHD TV review: good hardware, fragmented software
Best Deals on Good Gear Guide
Latest News Articles
- Microsoft's pricey Surface Book is getting stomped by the ancient Surface Pro 3
- Android TV's universal search feature finally works with Netflix
- Facebook takes on critics with political bias class
- Kodi dives into hardware with a Raspberry Pi 3 case perfect for low-cost HTPCs
- What iOS 10 can tell us about the new iPhone
GGG Evaluation Team
First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.
For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.
The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.
The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.
My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.
- CCTechnical Content ProducerVIC
- CCImplementation ManagerNSW
- CCData Warehouse Specialist- Power BI, SSAS DBA, Azure, SQLNSW
- CCProgrammer (IT Security/Website Administration) 160711/P/565Asia
- FTNV2 Defence Project Manager | Canberra | Major exciting White Paper projectsACT
- CCSystem AnalystACT
- CCContract System Analyst (Renewable Contract)Asia
- CCProject ManagerNSW
- FTVoice ArchitectNSW
- CCLead Communications ConsultantWA
- FTProject Coordinator / AdministratorNSW
- CCCobol ProgrammerACT
- CCSAP PI/PO ConsultantVIC
- FTNetwork EngineerNSW
- CCSenior Business Analyst- BPMN, Testing backgroundNSW
- CCInfrastructure ArchitectACT
- CCContract Analyst Programmer (J2EE/JAVA/SQL) 160621/AP/082Asia
- CCSystems Administrator with developer skills | Defence intelligence | NV2 clearedACT
- FTSenior Architect, TechnologyNSW
- FTBusiness Analyst/Data Analyst Capability ManagerVIC
- CCSenior Project Delivery ManagerACT
- CCSenior Change Manager, Financial ServicesNSW
- CCICT PreSales SpecialistVIC
- CCContract Programmer (IT Security/Website Admin) 160617/P/564Asia
- CCBusiness AnalystACT