VoIP and Security: What’s the Bottom Line?

By Gene Teglovic
Updated: January 31, 2011

If you are considering a Voice over Internet Protocol (VoIP) solution for your company, you may have some questions regarding VoIP security. VoIP technology faces many of the same vulnerabilities as other Internet traffic, and a few unique ones.

Many consumer VoIP products and solutions do not address security concerns as a high priority. VoIP service providers, however, realize how critical security is to their customers. While their products have vulnerabilities, as do all technology products, business class service providers deal with the security issue much better than freeware or low cost VoIP consumer product vendors do.

Go with a reputable VoIP service provider. Implementing a do-it-yourself, low-cost VoIP solution is asking for security headaches.

Common Security Threats and Mitigation Technologies

Most threats to VoIP solutions are a result of hackers gaining access to a business’s VoIP administration system, usually by finding holes in management software or gateways, to commit crimes such as:

  1. Toll fraud (a.k.a. “Phreaking”): Making or reselling calls on a large scale, sometimes resulting in millions of dollars of erroneous charges to businesses.
  2. Eavesdropping on calls to steal information such as passwords, phone numbers, voicemail messages, and other company data.
  3. Vishing (a.k.a. VoIP phishing): Impersonators leaving voicemails pretending to be a trusted source in attempts to get confidential information.
  4. SPIT (Spamming over Internet Telephony): Similar to email spamming, expect the hacker spams voicemails. This clogs up the system, leaving it more vulnerable to a hacker attack, and can contain malware.
  5. Call tampering: Intercepting phone calls in progress to insert noise packets, stop packets to inject silence, or masquerade as one of the parties.
  6. Viruses and other malware, in smart phones and system administrative software.
  7. Denial of Service (DoS) attacks.

While the list of threats may sound ominous, the cat is usually ahead of the mouse, and many technologies exist to combat these threats.

Firewalls, authentication, and encryption technologies are continually being enhanced to bring VoIP into their folds. VoIP service providers integrate this technology into their hardware and software products, and work quickly to plug holes in their security software.

What Can You Do?

First, understand how your prospective service provider protects VoIP calls. When you discuss and negotiate terms of service, ask questions such as:

  1. What firewalls do you have implemented in your gateways and other equipment that will be connected to my company’s network, phones, and computers?
  2. What assistance will you provide in configuring the firewalls so they remain secure?
  3. What authentication methods do you use for packets traveling from and into my premise?
  4. What encryption methods are in place for transmission of my voice packets?
  5. What security issues have been identified in your VoIP administration software? When and how are they being addressed? How will you help us ensure that we always get the latest security upgrades and patches.

Next, understand that while much of the responsibility for VoIP security lies on the service provider’s shoulders, your business needs to do its part.

Create a security policy as part of your VoIP implementation plan, and engage your service provider as a partner. Ensure the policy addresses items such as access to your VoIP system’s administrative software, installing the latest security upgrades, mobile access, and vulnerability of weak links such as smart phones and gateway connections.

In summary, your VoIP service provider must do its part, and you must do yours. Understand the threats and the technologies to mitigate them. Keep your service provider responsible, do your homework, and implement your security policies with vigor.
 

Featured Research
  • Your Phone System and Your Bottom Line

    Businesses have been using phones to drive increases to their bottom lines for almost a century now. Telephony, much like the rest of the business world, has seen drastic changes with the increase in technological advancement. Voice Over Internet Protocol (VoIP), has enabled companies to connect with consumers at levels that have been seen as unheard of before. And trust us when we say this, it is doing wonders for the bottom line. more

  • 2017 Phone Systems Checklist

    As you are well aware, we are living in an age of extreme technological growth. With this, an understatement might be that phone systems have changed a bit over the last decade. If you are in the market for a new phone system, it is absolutely essential for you to have knowledge of this vast sector and just what exactly you need in order to have your business succeed. more

  • VoIP vs. VoPI

    Are you searching around for an upgrade to your current phone system? If so, you've mostly likely heard of VoIP, but do you know about VoPI? Lately, there has been a lot of conversation around what the difference is between the two systems. Most of this conversation centers around security, as both of these systems, operate over the internet versus the traditional phone lines. more

  • Why You Need Mobile VoIP

    Mobile VoIP is growing at an exponential rate and can help your company reduce costs, improve communications, and drive increased employee satisfaction and loyalty. If what was just mentioned above sounds like it would be good for your business (it is), download our latest guide Why You Need Mobile VoIP to learn even more reasons why you need to make the switch today! more

  • How You Can Stop VoIP Eavesdropping

    In today’s modern technological world we face cyber threats on an almost daily basis. This rings true when switching phone systems to VoIP. While there are many benefits to making the switch, there MUST be precautions taken to ensure that your new phone system is safe and secure. more