Fending Off VoIP Attacks

Updated: April 30, 2009

Your business is probably switching or has switched to VoIP to take advantage of the technology's many cost, efficiency and productivity benefits. But you also got something else in the bargain — the need to protect your organization's telephone system from outside attacks.

Security is the part of VoIP that most businesses don't like to think about. Many companies still don't fully understand the need for protecting a phone system. But since VoIP shares many technologies with computer-focused data networks, the need to safeguard Internet telephony deployments is very real.

VoIP vendors and service providers don't like to publicize the fact, but IP telephony is vulnerable to virtually all of the attacks that plague regular data networks, including viruses, worms, Trojan horses, DoS (denial of service) assaults and hijacking. VoIP is also vulnerable to things like toll fraud, phishing , voice spam and eavesdropping . Dealing with VoIP threats requires a three-tiered approach that targets threats on the infrastructure, software and user levels. Here are the details:

Network Considerations
VoIP vendors and service providers tout the cost savings that can be made by placing VoIP onto existing data networks. Yet close proximity to other data services can expose a VoIP system to multiple threats. This is particularly true if the VoIP system is exposed to the public Internet.

To safeguard your VoIP system, make sure that ironclad authentication and encryption tools are in place. A VPN (virtual private network) will enable trusted users to securely connect to your VoIP system from untrusted networks. Internally, a VPN will effectively separate the VoIP network from the underlying data network, sparing your phone system from any attacks that may afflict the rest of the network.

If a hosted IP PBX service is used, you should ask the provider what technologies are utilized on its end to keep VoIP threats from attacking the devices used within your organization. Compare the security policies of several VoIP service providers to find the vendor that offers the best security protection.

Security Considerations
Security technologies designed to safeguard traditional networks often don't incorporate "VoIP awareness." VoIP includes a number of specialized protocols that standard network security gear just isn't equipped to handle. Dedicated VoIP networks and converged networks should be equipped with IPSs (intrusion prevention systems) and firewalls that can look deeply into traffic to detect threats that are aimed specifically at VoIP devices. Also, make sure that intelligent IPS technology is placed between VoIP gateways as well as close to the call manager, a prime attack point that contains all critical user data.

User Considerations
In many ways, users are any VoIP network's weakest spot. Users do all sorts of things that open the door to potential attackers, such as using unauthorized hosted IP telephony technologies like Google Talk and Skype . While these services are relatively safe in a stand-alone consumer environment, they can introduce significant risks into an enterprise VoIP system as they search for ways to reach the public Internet though firewalls and other security barriers.

Installing VoIP-aware IPS technology and firewalls at key access locations will help pave the way for the creation of a uniform user-security policy. Organizations may decide to either block user-installed voice technologies entirely or to confine their use in such a way that they can be accommodated in a safe and authorized manner.

Featured Research
  • Is Your Phone System Stealing Profits?

    Having the wrong phone system can dramatically cut into your profits. Despite this, many businesses just sign up for a plan or platform that seems ‘good enough’. If you haven’t carefully considered your options and the included features, there’s a very good chance that you are leaving money on the table in some way. more

  • Phone System Technology Showdown

    VoIP and IP telephony are often misconstrued as being the same type of phone system, but the truth is they operate on different technology and deployment methods. This guide will explain the differences between VoIP and IP, go into the pros and cons of both VoIP and IP-PBX, and give insight into which type of phone system will benefit your business the most. more

  • Why Enterprises are Making the Switch to VoIP

    Your phone system is your most important business communication system. It allows you to connect with your employees, prospects, and clients. And wouldn't it be great if there was a solution that helped drive down costs while providing a competitive advantage? more

  • Business Phone System Buyer's Guide

    Communication has been a focal point in business since inception, but the industry is changing drastically in how people connect to one another and what tools and systems they use to do so. Less than 15 years ago, 90% of people relied on landline phone systems for communication. Today, less than 60% of Americans even have a landline and 40% rely solely on their mobile phone. more

  • Ditch Your Fax Servers

    An in-house fax server gives an IT department centralized management and monitoring over the entire enterprise's faxing. This can help your company track usage and better maintain records for auditing and record keeping. However, there are serious drawbacks that come with utilizing an in-house fax server solution and these range from security to cost-prohibitive pricing. more