Ground Rules for VoIP Security Testing

Edwin Mier, Randall Birdsall and Rodney Thayer   Today’s Top Stories   or  Other Networking and Internet Stories  

Aligning IT to Business: The Rising Importance of Application Delivery Networks Mitigate Risk, Lower Costs and Improve Network Efficiency Preparing Your Business Services for the Future Southern Company Defending Against the Storm Share our Strength 8 Questions To Ask About Your Intrusion-Security Solution 8 Questions To Ask About Your Intrusion-Security Solution Computerworld Technology Briefings IT Service Management Sign up to receive Networking and Internet Resource Alerts

January 17, 2005 (Network World) -- These ground rules were adopted as a means of setting a level playing field for consistent testing practices for all vendors whose products were tested.

1. The vendor has complete control over the IP telephony environment and underlying network infrastructure -- which products to include and how everything would be configured.

2. A midsize, local-only VoIP environment (campus or building) would be simulated. No VoIP traffic would be carried via WAN between remote, distributed locations.

3. After setup, IP telephony and Layer 2/Layer 3 data networking could not be functionally limited because of security settings, including normal IP phone calling out to or from the PSTN.

4. After setup, vendors could not actively manipulate or reconfigure their network. They could, however, continue to passively monitor security alert/alarm logs.

5. Assaults would all be attempted via these specific attack points:

• a. Via an "office-cube" data-LAN port, which the assailant can legitimately access (for example a valid MAC address).


• b. Via an "office-cube" IP phone, which the assailant is authorized to use, including the "data switch port" on the back of the phone, for a desktop or laptop. These scenarios represent typical insider-attack scenarios.

6. All assaults would employ or be based on tools and attacks that are publicly available via the Internet. No new programming or other unique or custom attacks could be applied.

7. Assailants could not procure or disassemble and dissect a vendor IP hard phone.

Reprinted with permission from

For more information about enterprise networking, go to NetworkWorld.com
Story copyright 2009 Network World, Inc. All rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

Microsoft confirms IE6, IE7 zero-day bug Hacks of Chinese temple were online kung fu, abbot says HP sees PC sales jump in China More top stories...

iPhone worm steals online bank codes, builds botnet Microsoft issues security advisory on IE vulnerability Update: HP reports solid Q4 on services growth

See your link here

Editors' Picks Computerworld's Salary Survey 2009 See results from our survey of more than 5,000 IT pros, and use our Smart Salary Tool to compare your pay with IT workers in similar jobs across the U.S. How to re-energize your weary workforce After weathering layoffs or pay cuts, your IT staffers may need some help getting motivated. Try these strategies for employee renewal. Top 10 free Windows tools for IT pros No Windows geek or PC support pro should be without these must-have utilities -- and they're all free. See more hot topics Get the latest news, features, opinions and more on key technology issues. hot topics Windows 7 Get the latest news, reviews and more about Microsoft's newest desktop operating system. Apple Microsoft Google iPhone Mac A to Z » See more hot topics special report topics View the top-rated IT workplaces. General Mills, Genentech, San Diego Gas & Electric, University of Pennsylvania and Monsanto top the list. More Special Reports 2008 Best Places to Work in IT 2007 Best Places to Work in IT 2008 Salary Survey 2007 Salary Survey 2006 Salary Survey 2009 Premier 100 IT Leaders 2008 Premier 100 IT Leaders 2007 Premier 100 IT Leaders 2008 IT Forecast 2007 IT Forecast 40 Years of Computerworld Top Green-IT 2009 Top Green-IT 2008 The FAQs About Going Green IT Schools to Watch iPhone: One Year Later Global Mobile Your Next Data Center Management: Reinventing IT Stop Data Leaks Web 2.0 Security Surviving Disasters Managing Storage Virtualization The Lean Storage Machine Storage on Trial Can Web 2.0 Save BI? Bypass These BI Potholes All Zones The SAS Zone Software Resource Center Mobile Security Disaster Recovery & Cost Savings Strategic Content Management Business Analytics Zone

• Microsoft confirms IE6, IE7 zero-day bug
• iPhone worm steals online bank codes, builds botnet
• Hacks of Chinese temple were online kung fu, abbot says
• More top stories 

Disaster Recovery & Cost Savings Zone
Thousands of customers world-wide have turned to virtualization solutions from Riverbed as a way to reduce costs.

Linux, Apple, Microsoft, SaaS, Web 2.0, Security, Mobile. If it's tech, it's in our blogs.