A VoIP Security Plan of Attack

Network World - From a security viewpoint, VoIP is a nightmare, combining the worst vulnerabilities of IP networks and voice networks. But VoIP's security challenges can be solved. All it takes is a plan.
Step 1: Divide and conquer. There are three main threats to VoIP security: authentication failures, integrity failures and privacy failures. Consider all three at each layer of your VoIP implementation.
Step 2: Start with the physical layer. Ensure the integrity of your building LAN. Is it easy for someone to hack in and launch a denial-of-service attack? Do you want to run VoIP over a separately engineered and secured network? Most VoIP devices don't support the 802.1x authentication standard, but you might be able to do media access control-based security -- even if it looks like a pain to manage. If you want to use 802.11 for VoIP access, ask your wireless vendor about quality-of-service and roaming requirements.
Step 3: Move to the IP layer. Services such as the Dynamic Host Configuration Protocol and the Domain Name System can be critical to your VoIP network. Have you planned for their reliability and security? If users will access your VoIP network via the Internet, a virtual private network (VPN) tunnel is required. IPsec and Secure Sockets Layer VPN vendors are adding VoIP support to their products.
Step 4: The session layer is all about authentication. At some point, you have to get those phones registered on the VoIP network. Test deployments often turn off authentication, but don't be tempted.
Somewhere between Steps 2, 3 and 4, you have to deal with eavesdroppers. Most VoIP in the corporate LAN won't be encrypted, which means someone could tap every single phone call, simultaneously, in your network. Determine where taps could be installed and secure those pieces of your infrastructure, or install your own for regulatory reasons. Hint: Look at where you plugged in your intrusion-detection system.
Step 5: The application layer is the hard part. Most of your VoIP network is going to run on phones, which have limited hardening and poor security. Plan for their failure and the need to upgrade many of them very quickly.
The VoIP servers all will run a general-purpose operating system, Windows or Unix. You'll forever have tension between the VoIP application vendor, which doesn't want you to touch its carefully tuned systems, and the operating system vendor, which will release periodic patches. If you have dreams of unprotected VoIP connections over the Internet, you'll not only open yourself to huge risks but also put yourself on an upgrade treadmill with your firewall vendor as it tries to get its VoIP code right. Consider carefully whether the potential for failure is worth the benefits -- and be sure to tighten down whatever firewall you do have to the smallest target you can.
There's a lot to consider in VoIP security. Some VoIP in every corporation is inevitable, so get cracking now and figure out how you're going to secure it.
Snyder, a Network World Test Alliance partner, is a senior partner at Opus One in Tucson, Ariz. He can be reached at Joel.Snyder@opus1.com.