Previous pages: Can I trust Microsoft with VoIP?
Reliability: Microsoft and the fifth 9
What really happens when I dial 911?
3. Is VoIP safe?
VoIP security is a broad question that touches on many aspects of how IP telephony systems operate, and the various parts of the network that VoIP touches. But according to one survey, one thing is clear: VoIP technology isn't safe enough for many businesses.
Only half of the IT executives polled recently in a CompTIA study said they think security technology built into corporate VoIP products and services is solid. The survey (of 350 companies with 500 employees or fewer) showed that even wireless technology - often maligned for its security weakness - was held in higher regard than VoIP in terms of security.
With VoIP, security concerns among the respondents in the CompTIA survey were not relating to potential attacks on only VoIP gear and software, but the affect a general worm or virus outbreakk could have on the quality of IP voice calls.
Worms and viruses that flood corporate networks with traffic may cause e-mail delivery to be delayed, with other slow application response times. But the latency introduced can simply kill an IP telephony conversation.
As for VoIP products, vulnerabilities are popping up more in IP telephony gear and software. Cisco, for instance, over the last 18 months issued nine major vulnerability advisories on products ranging from IP phones and IP PBXs to routers that perform VoIP processes and functions. These nine warnings - serious enough for the vendor to issue software patches - compare to only two VoIP-related vulnerabilities Cisco had issued in the previous 18 months.
Many vendors' IP call processing and messaging products run on top of Linux, Windows, Sun or other server operating systems. Softphones generally run on Windows desktops, while applications such as VoIP-based call centre platforms can touch a wide array of other applications.
Taking all this into account, Avaya had 25 product security advisories relating either directly to its VoIP products, or affecting underlying software products on which Avaya's technology runs, according to research by Secunia.
The Internet Security Systems X-Force vulnerability database has more than 100 entries over the past five years relating to vulnerability reports in VoIP products, applications and underlying protocols.
Some security researchers say the basic technology of some VoIP protocols is by nature hackable or susceptible to denial-of-service or call-interception attacks.
Sheran Gunasekera, a researcher with Scanit, wrote in a report that VoIP call interception can be simple, if targeted against equipment and traffic using non-encrypted, standards-based protocols. Against SIP-based VoIP conversations, "signalling attacks can be used to eavesdrop on conversations and re-route or hijack calls," says Gunasekera.
Other new VoIP threats on the horizon include the emergence of maliciously designed VoIP audio codecs. Theoretically, these so-called "evil codecs" are a VoIP audio stream designed specifically to crash a VoIP endpoint or server.
Lawrence Orans, a researcher with Gartner, says eavesdropping is one example of an overhyped threat. "Sure, it's technically possible to execute a man-in-the-middle attack and capture packets. The reason that we hear so much about eavesdropping is that it really does illicit this visceral reaction. The main thing is to focus on the greater threats, for example attacking an IP PBX server itself."
But it is possible to have a secure VoIP deployment if you follow best practices, saysB David Endler, chairman and founder of the VoIP Security Alliance. "All of these systems are securable, but they do take some knowledge to get them to that point."
Using encryption on VoIP signaling (SIP and H.323) and payload streams (RTP and UDP, typically) are some approaches. Ensuring IP PBX servers are patched and configured properly, and restricting the types of traffic that can contact IP endpoints are other measures.
Continued: Do I need a $1,000 IP phone?
Skip to: Will SIP ever be ready for the desktop?
How do I run my business on Skype?
Related content:
Abolishing service blues
Modern architectures show designs on citizens
Better service worth the cost, Mississauga says
Industry Canada trials intrusion prevention for VoIP
VoIP performance: more than a bandwidth issue
Putting a PAL to work
icon.
