A VoIP Security Plan of Attack

Joel Snyder, Network World   Today’s Top Stories    or  Other Security Stories  

Long Tail Supplier Collaboration - What's In It For You? E-Mail As a Service: Time for Another Look? Data Protection and Disaster Recovery with iSCSI and VMware Case Study: Simplified DR Planning and Implementation Virtualized iSCSI SANs: Flexible, Scalable, Enterprise Storage for Virtual Infrastructures Case Study: Consolidating Servers While Keeping Them in Sync with DR Sign up to receive Security Resource Alerts

January 17, 2005 (Network World) -- From a security viewpoint, VoIP is a nightmare, combining the worst vulnerabilities of IP networks and voice networks. But VoIP's security challenges can be solved. All it takes is a plan.
Step 1: Divide and conquer. There are three main threats to VoIP security: authentication failures, integrity failures and privacy failures. Consider all three at each layer of your VoIP implementation.
Step 2: Start with the physical layer. Ensure the integrity of your building LAN. Is it easy for someone to hack in and launch a denial-of-service attack? Do you want to run VoIP over a separately engineered and secured network? Most VoIP devices don't support the 802.1x authentication standard, but you might be able to do media access control-based security -- even if it looks like a pain to manage. If you want to use 802.11 for VoIP access, ask your wireless vendor about quality-of-service and roaming requirements.
Step 3: Move to the IP layer. Services such as the Dynamic Host Configuration Protocol and the Domain Name System can be critical to your VoIP network. Have you planned for their reliability and security? If users will access your VoIP network via the Internet, a virtual private network (VPN) tunnel is required. IPsec and Secure Sockets Layer VPN vendors are adding VoIP support to their products.
Step 4: The session layer is all about authentication. At some point, you have to get those phones registered on the VoIP network. Test deployments often turn off authentication, but don't be tempted.
Somewhere between Steps 2, 3 and 4, you have to deal with eavesdroppers. Most VoIP in the corporate LAN won't be encrypted, which means someone could tap every single phone call, simultaneously, in your network. Determine where taps could be installed and secure those pieces of your infrastructure, or install your own for regulatory reasons. Hint: Look at where you plugged in your intrusion-detection system.
Step 5: The application layer is the hard part. Most of your VoIP network is going to run on phones, which have limited hardening and poor security. Plan for their failure and the need to upgrade many of them very quickly.
The VoIP servers all will run a general-purpose operating system, Windows or Unix. You'll forever have tension between the VoIP application vendor, which doesn't want you to touch its carefully tuned systems, and the operating system vendor, which will release periodic patches. If you have dreams of unprotected VoIP connections over the Internet, you'll not only open yourself to huge risks but also put yourself on an upgrade treadmill with your firewall vendor as it tries to get its VoIP code right. Consider carefully whether the potential for failure is worth the benefits -- and be sure to tighten down whatever firewall you do have to the smallest target you can.
There's a lot to consider in VoIP security. Some VoIP in every corporation is inevitable, so get cracking now and figure out how you're going to secure it.
Snyder, a Network World Test Alliance partner, is a senior partner at Opus One in Tucson, Ariz. He can be reached at Joel.Snyder@opus1.com.

Reprinted with permission from

For more information about enterprise networking, go to NetworkWorld.com
Story copyright 2006 Network World, Inc. All rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

Breaking Through IP Telephony VoIP Security a Moving Target Avoiding Potholes on the VoIP Path

A VoIP Security Plan of Attack The VoIP Management Challenge The Hidden Costs, and Savings, of VoIP

"Dear me. Just because I recently talked about Windows XP SP3's virtues and vices, some people seem to think I've..." Read more... "Your Kevin Mitnicks, your Frank Abagnales, your Jerome Kerviels -- what are we supposed to do with our hackers, especially..." Read more... Read more Security posts or See all Blogs

Hackers hijack a half-million sites in latest attack HP in talks to buy EDS for up to $13B Microsoft faults OEMs for some XP SP3 endless reboots More top stories...

Mozilla slates Firefox 3.0 RC1 for late May IPhone out of stock 'companywide,' say Apple sales reps Cisco data center chief steps down

Your help desk career: Dead end or launching pad? A role on an IT help desk is what you make of it, tech pros say — just don't get too comfy. The darker side of Webmail Web-based e-mail may be exposing you to privacy and security dangers you didn't sign up for. Performance showdown: Flash drives versus hard disk drives Ever been tempted to replace the mechanical hard drive in your laptop with a shiny new solid-state disk? Our expert did so, and here's what he found. Xerox touts erasable paper, smart documents PARC showed erasable paper and other technologies that adds intelligence to documents with raw text. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 2 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone See your link here

Long Tail Supplier Collaboration - What's In It For You? Long Tail Supplier Collaboration - What's In It For You? Download this webcast, free, compliments of Sterling Commerce Go to the webcast  Computerworld Executive Bulletin: Building a Robust Antivirus Defense Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing  Eliminate SPAM, Gain Productivity Get this white paper now! (Source: MessageLabs) Learn all about the dangers and the costs of spam in all its forms - from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses - and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. New Fujitsu High-End Itanium Windows- and Linux-Based PRIMEQUEST Servers Offer the Utmost in High Availability New Fujitsu High-End Itanium-Based PRIMEQUEST Servers Offer Industry-Leading System Management for Linux and Windows Symantec State of the Data Center Report 2007 View more whitepapers

• Breaking Through IP Telephony
• VoIP Security a Moving Target
• Avoiding Potholes on the VoIP Path
• A VoIP Security Plan of Attack
• The VoIP Management Challenge
• The Hidden Costs, and Savings, of VoIP

• Hackers hijack a half-million sites in latest attack
• HP in talks to buy EDS for up to $13B
• Microsoft faults OEMs for some XP SP3 endless reboots
• More top stories 

Security Management Zone Security management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones



Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day. New baits



Computerworld Technology Briefing: An open-source path to optimal virtualization Looking for a virtualization strategy that offers both the flexibility and reliability to meet the demands of mixed-source environments? Look no further than the fast-emerging open virtualization approach backed by some of the biggest names in enterprise computing. Together they are pointing the way toward higher data center performance without higher costs. Download this briefing



In Security There's plenty of talk about how to behave during a Customs search of your computer and gear, but Jon Espenschied's got tips for securing your data (and privacy) before you reach the border. Click here to read the latest column by Jon Espenschied