January 17, 2005 (Network World) --
From a security viewpoint, VoIP is a nightmare, combining the worst vulnerabilities of IP networks and voice networks. But VoIP's security challenges can be solved. All it takes is a plan.
Step 1: Divide and conquer. There are three main threats to VoIP security: authentication failures, integrity failures and privacy failures. Consider all three at each layer of your VoIP implementation.
Step 2: Start with the physical layer. Ensure the integrity of your building LAN. Is it easy for someone to hack in and launch a denial-of-service attack? Do you want to run VoIP over a separately engineered and secured network? Most VoIP devices don't support the 802.1x authentication standard, but you might be able to do media access control-based security -- even if it looks like a pain to manage. If you want to use 802.11 for VoIP access, ask your wireless vendor about quality-of-service and roaming requirements.
Step 3: Move to the IP layer. Services such as the Dynamic Host Configuration Protocol and the Domain Name System can be critical to your VoIP network. Have you planned for their reliability and security? If users will access your VoIP network via the Internet, a virtual private network (VPN) tunnel is required. IPsec and Secure Sockets Layer VPN vendors are adding VoIP support to their products.
Step 4: The session layer is all about authentication. At some point, you have to get those phones registered on the VoIP network. Test deployments often turn off authentication, but don't be tempted.
Somewhere between Steps 2, 3 and 4, you have to deal with eavesdroppers. Most VoIP in the corporate LAN won't be encrypted, which means someone could tap every single phone call, simultaneously, in your network. Determine where taps could be installed and secure those pieces of your infrastructure, or install your own for regulatory reasons. Hint: Look at where you plugged in your intrusion-detection system.
Step 5: The application layer is the hard part. Most of your VoIP network is going to run on phones, which have limited hardening and poor security. Plan for their failure and the need to upgrade many of them very quickly.
The VoIP servers all will run a general-purpose operating system, Windows or Unix. You'll forever have tension between the VoIP application vendor, which doesn't want you to touch its carefully tuned systems, and the operating system vendor, which will release periodic patches. If you have dreams of unprotected VoIP connections over the Internet, you'll not only open yourself to huge risks but also put yourself on an upgrade treadmill with your firewall vendor as it tries to get its VoIP code right. Consider carefully whether the potential for failure is worth the benefits -- and be sure to tighten down whatever firewall you do have to the smallest target you can.
There's a lot to consider in VoIP security. Some VoIP in every corporation is inevitable, so get cracking now and figure out how you're going to secure it.
Snyder, a Network World Test Alliance partner, is a senior partner at Opus One in Tucson, Ariz. He can be reached atJoel.Snyder@opus1.com.
Reprinted with permission from For more information about enterprise networking, go to NetworkWorld.com Story copyright 2009 Network World, Inc. All rights reserved.
See results from our survey of more than 5,000 IT pros, and use our Smart Salary Tool to compare your pay with IT workers in similar jobs across the U.S.
Disaster Recovery & Cost Savings Zone
Thousands of customers world-wide have turned to virtualization solutions from Riverbed as a way to reduce costs.
Computerworld Reviews
Looking for advice on something to buy, use or download? Check out our searchabe, sortable reviews database for the best tips on everything from laptops, hard drives and mobile devices to operating systems, browsers, add-ons and Web apps.
See your link here
or
Other Networking and Internet Stories
For more information about enterprise networking, go to NetworkWorld.com
See results from our survey of more than 5,000 IT pros, and use our Smart Salary Tool to compare your pay with IT workers in similar jobs across the U.S.
After weathering layoffs or pay cuts, your IT staffers may need some help getting motivated. Try these strategies for employee renewal.
No Windows geek or PC support pro should be without these must-have utilities -- and they're all free.
Get the latest news, features, opinions and more on key technology issues.
Get the latest news, reviews and more about Microsoft's newest desktop operating system.
General Mills, Genentech, San Diego Gas & Electric, University of Pennsylvania and Monsanto top the list.
Disaster Recovery & Cost Savings Zone
Computerworld
