Security, a concern for business VoIP systems: Above Security

A Canadian VoIP security specialist says that service providers should heed warnings of potential security risks associated with IP telephony implementation. Robert Potvin, VP of strategic consulting with Above Security noted during a recent conference in Montreal that companies aren’t generally concerned about VoIP security even though they’ve never done a risk assessment of VoIP implementation. Speaking at the IP Telecom EXPO on May 31, Potvin highlighted a number of network factors that could open up an organization to VoIP hackers. He cited the types of components found in a typical network configuration ranging from VLANs to DHCP and TFTP servers as potential openings to hackers. One of the problems in addressing security in the new voice services environment, he said during his presentation at the conference, is that with the migration from traditional PBXs to IP-PBXs, data and voice traffic are being reunited on a single network. This was common practice in the 1970s, said Potvin, but changed after voice-system hackers were able to imitate dial tone, thus enabling fraudulent calls to be made. The network modification occurred when phone companies implemented ISDN to segregate signaling from voice. But in the VoIP world, signaling and voice once again find themselves on the same network. "We might be using different data ports, but they’re still sitting on the same network. So if the hacker has access to the data, he’s going to ," he explained. VoIP security threats can come from a number of external sources, but corporate phone systems also play a role in allowing security intrusions. Potvin said one of the largest threats comes from denial-of-service attacks where huge volumes of packets can clog the network at the data level, severely affecting quality-of-service for voice services. In this instance, the IP-PBX doesn’t "understand" what’s going on and will simply shut down and reboot. Virtual local area networks (VLANs) have been considered a good network intrusion prevention mechanism, but Potvin said this isn’t the case. "A VLAN is something very easy to break into, especially in a denial-of-service attack," he noted. "VLAN is good security, but it’s not the ultimate security." Encryption can also serve as a deterrent to VoIP hacking, but there’s a quality of service tradeoff: the more heavily encrypted the data, the greater the decrease in quality of service. In addition, encryption only works when the user communicates with someone within the same network and using the same device, Potvin said. There are a number of things organizations can do to secure VoIP services or to at least minimize the impact of an attack. Potvin said the architecture of the network needs to include a detailed plan of the types of switches and where they go in the network. As well, companies need to ensure VLANs separate voice from data traffic. Firms also must determine the appropriate level of encryption so as to not sacrifice quality-of-service. Potvin cautioned that the consequences of a virus or worm can be devastating if the network isn’t adequately protected. In the past, the data network alone used to get jammed and go down, but an attack in a VoIP system can be more problematic. "I don’t want something as simple as to bring down my voicemail system," he cited as an example. "So you need to think about all these aspects for security."

Security, a concern for business VoIP systems: Above Security

News | July 6, 2006

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us