How secure is your VoIP?
VoIP services enable businesses to conduct calls across the same network to access the Internet and get e-mail – and at a fraction of the cost of traditional voice networks. However, VoIP developers have been focused on quality and reliability versus security. Therefore, if you choose to adopt VoIP, it is up to you to take the proper steps to secure it.
It is important to understand that the same types of attacks that affect data networks can affect VoIP networks. As a result, the content of VoIP communications is vulnerable to being attacked, hacked, altered, intercepted or re-routed.
Worse yet, because voice and data communications are running on the same infrastructure, an attack on the VoIP system could compromise the entire availability of the IP network, risking a business’ ability to communicate via either voice or data.
From denial-of-service attacks, eavesdropping, phishing and toll fraud, intruders can gain control of the VoIP network to not only create resource exhaustion, long term busy signals and force dropped calls, but also to gain access to confidential business and personal information.
In fact, there have been recent wave attacks and malware designed to attack VoIP Session Initiation Protocol (SIP) server and steal credentials. Additionally, VoIP DoS attacks are on the increase and are difficult to circumvent in some scenarios.
The fact that VoIP was designed with simplicity and convenience – in view of bandwidth constraints at the time – and not security, creates unique challenges not only from a defence perspective but also from an audit and compliance perspective.
Security is in most cases retrofitted into the solutions but accountability issues often arise – which explains the legislations that govern the use of certain VoIP applications in some countries where matters of National Security take precedence over users’ desire for relatively inexpensive calls.
The fact that VoIP use is expected to skyrocket over the next few years presents many challenges for users – challenges that need to be overcome. In-Stat, a technology research firm, predicts that the number of business VoIP phones sold will grow from 9,9m in 2006 to 45,8m in 2010.
In-Stat also notes that over 40% of the businesses that it surveyed do not have specific plans for securing their VoIP deployments. However, ignoring security is not advisable, because the more widespread VoIP becomes, the more likely it is to be targeted by Internet criminals.
Most VoIP solutions lack built-in security features, but here are some things that businesses can do to protect themselves:
* Separate VoIP and data networks;
* Be vigilant and stay up to date about new and changing threats;
* Block rogue VoIP use;
* Disable and remove any unneeded application and operating services;
* Employ gateway security to limit access to authenticated users;
* Monitor network security.
VoIP is another example of how the Internet is changing the face of communications by lowering costs and simplifying the business infrastructure. With VoIP use projected to grow, it is likely that attackers will increasingly seek out ways to exploit this technology, which is already subject to most of the same threats as data networks.
Commercial implementations of VoIP solutions have come along way in the past year – security wise, but vulnerabilities still plague the systems and the debate over performance versus security is still some way from being won.
Loading ...