Ads by TechWords

See your link here
Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
 

A VoIP Security Plan of Attack

January 17, 2005 12:00 PM ET

Network World - From a security viewpoint, VoIP is a nightmare, combining the worst vulnerabilities of IP networks and voice networks. But VoIP's security challenges can be solved. All it takes is a plan.
Step 1: Divide and conquer. There are three main threats to VoIP security: authentication failures, integrity failures and privacy failures. Consider all three at each layer of your VoIP implementation.
Step 2: Start with the physical layer. Ensure the integrity of your building LAN. Is it easy for someone to hack in and launch a denial-of-service attack? Do you want to run VoIP over a separately engineered and secured network? Most VoIP devices don't support the 802.1x authentication standard, but you might be able to do media access control-based security -- even if it looks like a pain to manage. If you want to use 802.11 for VoIP access, ask your wireless vendor about quality-of-service and roaming requirements.
Step 3: Move to the IP layer. Services such as the Dynamic Host Configuration Protocol and the Domain Name System can be critical to your VoIP network. Have you planned for their reliability and security? If users will access your VoIP network via the Internet, a virtual private network (VPN) tunnel is required. IPsec and Secure Sockets Layer VPN vendors are adding VoIP support to their products.
Step 4: The session layer is all about authentication. At some point, you have to get those phones registered on the VoIP network. Test deployments often turn off authentication, but don't be tempted.
Somewhere between Steps 2, 3 and 4, you have to deal with eavesdroppers. Most VoIP in the corporate LAN won't be encrypted, which means someone could tap every single phone call, simultaneously, in your network. Determine where taps could be installed and secure those pieces of your infrastructure, or install your own for regulatory reasons. Hint: Look at where you plugged in your intrusion-detection system.
Step 5: The application layer is the hard part. Most of your VoIP network is going to run on phones, which have limited hardening and poor security. Plan for their failure and the need to upgrade many of them very quickly.
The VoIP servers all will run a general-purpose operating system, Windows or Unix. You'll forever have tension between the VoIP application vendor, which doesn't want you to touch its carefully tuned systems, and the operating system vendor, which will release periodic patches. If you have dreams of unprotected VoIP connections over the Internet, you'll not only open yourself to huge risks but also put yourself on an upgrade treadmill with your firewall vendor as it tries to get its VoIP code right. Consider carefully whether the potential for failure is worth the benefits -- and be sure to tighten down whatever firewall you do have to the smallest target you can.
There's a lot to consider in VoIP security. Some VoIP in every corporation is inevitable, so get cracking now and figure out how you're going to secure it.
Snyder, a Network World Test Alliance partner, is a senior partner at Opus One in Tucson, Ariz. He can be reached at Joel.Snyder@opus1.com.


Reprinted with permission from

For more information about enterprise networking, go to NetworkWorld.com
Story copyright 2009 Network World, Inc. All rights reserved.

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Centralized Data Backup and Your WAN
Is your organization prepared to tackle the massive challenge of protecting your data in a cost effective and timely manner? With a growing...  

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

An All-in-One Approach to Web Security
Granting web access to employees poses challenges to IT administrators and introduces unique security risks. Even as companies have perfected their security techniques...  

Best Practices for Managing Business Risks from the Use of IT
(Source: Symantec) Based on exhaustive benchmarks conducted by the IT Policy Compliance, this session highlights the relationship between business risks and use of...

The Hidden Dangers of Spam
Beyond the well-understood productivity drain that spam inflicts on businesses, threats posed by illicit email circulating through a network are causing many security...  

Managing And Protecting Your Ever Increasing Mobile Assets
(Source: Absolute Software) Your users are becoming more mobile each day. This is great for productivity - yet challenging for IT control. Natalie...

Open Source Security Myths Dispelled
(Source: Astaro) Open Source Software is computer software whose source code is available to the general public. This openly viewable nature...  

Sun OpenSSO Enterprise Webinar
(Source: Sun) This webinar replay discusses Sun OpenSSO Enterprise innovation--the single, open-source solution that helps your business solve the challenges around internal access...

Best Practices for Backing Up VMware® with Veritas NetBackup™
VMware® is used by enterprises large and small to increase the efficiency and cost-effectiveness of their IT operations. With this in mind, Symantec...  

Agile Enterprise Content Management (ECM) for Rapid ROI
(Source: IBM) Content rich business processes are a core feature of daily operations at just about any organization today. Very often these essential...