New features present new vulnerabilities for unified communications security

Unified communications (UC) is aggressively promoted as the next evolutionary step after VOIP. Vendors are offering a dazzling array of new features, but UC technology has no track record yet. Wary organizations are asking: What new vulnerabilities and security risks come with these complex systems? The Internet begat VoIP, and VoIP begets unified communications (UC). Once voice goes digital, zipping across corporate IP backbones into the Internet cloud, the stage is set for merging all IP-based communications on one platform. All manner of media and channels can in theory be combined: voice and video, voice and Web forms, presence-based forwarding of voice calls to any device, problem escalation from one media type to another, and on and on. But UC adoption is still low: In a recent survey by Forrester Research, about 20% of organizations said they were deploying or upgrading to UC infrastructure. And many respondents said they weren't clear about the definition of UC. The concept is hyped but ill-defined, and UC technology has no track record yet. Wary organizations are asking: What new vulnerabilities and security risks come with these complex systems? Vendor alert While some of the more esoteric UC features offered by vendors are unlikely to have broad appeal, there are two major areas that show promise in simplifying enterprise communications, says Bogdan Materna, CTO at Ottawa-based security provider VoIPshield Systems Inc. "Integrated features like the ability to make calls from Microsoft Outlook and conference calls on the fly are particularly attractive," he says. "And presence-based features also have tremendous appeal - having auto attendant direct calls anyplace on any phone depending on criteria like the type of call, time of day and so on." But enterprises are still in the process of migrating from TDM or hybrid TDM/VoIP to pure VoIP environments, and have barely grown comfortable tackling the new security risks associated with that. UC adds yet more complexity - and more new attack vectors. "Now they must deal not just with VoIP but with video on top of it. This in itself could be a source of problems: the more complex the applications become, the more potential security holes." From a staffing perspective, security management for integrated platforms introduces new headaches, he says. "Telecom staff understand voice but not IP networks, with IT people it's the reverse, and security guys know something about IP but voice is foreign to them. These groups have to merge and work together, so just from a process point of view, this can cause security issues." On the vendor front, Materna warns enterprises to be vigilant about security in their dealings with them. He believes vendors are pushing through new UC features without paying sufficient attention to their impact on security. "Many vendors say security is built into new features, but from our practical observations, we know vendors are avoiding that subject. They know the moment they involve security people, the whole sales cycle will be increased and may even stop until they fix some issues. What we really see is avoidance of security discussions." Materna recommends the active involvement of security staff armed with hard questions throughout the selection and deployment process. The UC space is also gaining a dominant player now that Microsoft Corp. is moving into VoIP, he says. "Microsoft uses VoIP as the keyword in its marketing, but it's in fact emerging as a major UC player. Their message is that you don't need PBX or other infrastructure - if you use Microsoft software and infrastructure, you get VoIP as well." From an integration perspective, this may simplify matters for organizations with existing Microsoft infrastructure, but it complicates life for those that don't. "Microsoft says its software can interact with existing systems but in reality some customization is needed." Keeping up with software flaws and fixes will become imperative as telephony shifts from hardware to software-based models, says Jaynath Angl, analyst at London, ON-based Info-Tech Research Group Inc. "All the major vendors are guilty of releasing fixes to their IP platforms, and this is something security managers didn't need to worry about before for voice systems." Insecure integration An IT industry truism is that security is only as strong as the weakest link. VoIP and UC integration increases the risk of exposing systems that were previously separate to each other's vulnerabilities, particularly in an enterprise call centre environment, says Gary Audin, president of Delphi Inc., an Arlington, VA-based telecom consultancy. "Even if you have perfect call centre security, applications that may not be directly connected may nevertheless be called upon by call centre systems. The more hooks you have across applications, the more you have to ask: Are all those applications uniformly secure?" These integration vulnerabilities will reach their zenith if service-oriented architecture (SOA) is used to automate connections between IT and telephony applications, says a Nortel Networks multimedia applications spokesperson. While SOA isn't strictly required to create unified communications, it makes it easier, and lays the foundation for integrated communications services linked with non-communications services, says Audin. A VoIP call, for example, might be initiated by an IT application without human intervention, and then delivered to an agent with a script and screens to direct the discussion. "With SOA, a poorly-secured IT system could actually be induced to utilize the contact centre or speech system to perpetrate a scam," says the Nortel spokesperson. An emerging new form of security is federated identity management, which becomes even more complicated with new UC features. In the federated approach, organizations that have internal identity management systems to authenticate users and customers to their own systems share these credentials with trusted partner organizations to allow seamless access. "There's a big discussion now in the industry about how to deal with presence-based features across organizations," says Tracy Fleming, IP telephony practice leader at Avaya Canada. "If I'm authenticated to one system, should that be good for all downstream systems or just one system? Over the next year, there will be more focus on managing presence features across different networks." In addition, there will be more attention on delineating privacy parameters for presence-based systems, he says. "If you know who I am and where I am, what information can be shared about that? People are already transitioning their calls to different networks based on proximity, and discussions will focus on whether proximity information can be used to track people or to target them for advertising." Privacy advocates are already sounding alarms about the potential to exploit presence-based information. VoIP and UC systems need to be designed so there are ways to block tracking functions and to allow people to opt into advertising, he adds. Giving voice to new features As more and more new voice features and menus are pushed out to cell phones and other devices, there is increasing demand for speaker verification that verifies the caller's true identity before allowing access to sensitive information. Security experts agree PINs and passwords provide weak security. Mobility is becoming a driving force for voice biometrics. While some early adopters such as airlines' frequent-flyer programs have implemented speaker identification technology, it is still relatively immature and prone to failure, says Audin. Ambient noise, head colds and stress may alter speakers' voices, causing security systems to deny legitimate customers access to applications. Even if they're allowed access, voice recognition of commands to simplify navigation through voice menus is still primitive. "These systems will recognize yes and no responses, and can recognize the numbers 0 to 9 even when they're spoken with an accent, but once you go beyond these 12 items, the accuracy goes down," says Audin. He points out that even in a system with a relatively high accuracy ratio of 85%, one out of six calls will nevertheless need to be routed to a call centre agent. As a back-up mechanism, enterprises must set up these systems so they revert to older and less secure environments when voice identification fails. This creates a vulnerability that hackers can exploit, he says. "The hacker will make sure his voice quality isn't good enough so he can get at older security mechanisms that are easier to fool," he says. "As people create more tools for customer identification, those tools will have their own security vulnerabilities. I don't think enough testing has been done on voice biometrics and VoIP to know if this security is better or worse than the analog world." Another voice-related emerging technology is speech analytics. Once customer calls are available en masse in digital formats in call centres, voice-to-text conversion can be used to convert the information into data so analytical tools can be used to discern trends and patterns. "This analytical solution is growing fast in call centres," says Info-Tech's Angl. "It doesn't just pick out keywords but looks at the context of a discussion about a service, product or issue, then generates a report that's fed back to decision-makers." In a large organization with thousands of agents, an automated approach can help organizations find new leads and upsell opportunities that can drive revenue. "But there are major privacy concerns in this - customers won't feel secure if they know all their communications are being stored and analyzed for selling opportunities," he says.

New features present new vulnerabilities for unified communications security

News | 03/05/2008 3:45 pm EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us