Codenomicon, the main focus of Ari's work is with security testing of various next generation communication technologies such as VoIP, WiMAX and IPTV. His latest book is focused on this topic, and is titled "Fuzzing for Software Security Testing and Quality Assurance". You can win a free copy of The Fuzzing Book from the Codenomicon web site. What is VoIP security all about? After close to ten years of hacking and bashing VoIP, Ari Takanen will finally reveal the secrets and discuss the hype around VoIP security. The discussions in this blog will draw from his book "Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures" co-authored by Peter Thermos, and published by Addison-Wesley. Ari will answer any questions and comments you might have regarding penetration testing and fuzzing of next generation communication networks such as IP telephony. Check out the sample chapter of the VoIP book here!" /> ITworld | IT news, technology analysis and how-to resources

Security: Secrets and Hype

RSS Link

The topics of this blog are in Fuzzing and VoIP security. As the CTO of Codenomicon, the main focus of Ari's work is with security testing of various next generation communication technologies such as VoIP, WiMAX and IPTV. His latest book is focused on this topic, and is titled "Fuzzing for Software Security Testing and Quality Assurance". You can win a free copy of The Fuzzing Book from the Codenomicon web site. What is VoIP security all about? After close to ten years of hacking and bashing VoIP, Ari Takanen will finally reveal the secrets and discuss the hype around VoIP security. The discussions in this blog will draw from his book "Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures" co-authored by Peter Thermos, and published by Addison-Wesley. Ari will answer any questions and comments you might have regarding penetration testing and fuzzing of next generation communication networks such as IP telephony. Check out the sample chapter of the VoIP book here!

by Ari Takanen

  • Vulnerability management: not just for scanning known vulnerabilities

    Posted Apr 08, 2011 - 03:16 pm

    It is springtime!

    [/chunklet] ... and especially here in Finland it is probably the most influencing season of them all with the sun pushing away all the darkness. Perhaps because of that, I also woke up today with new motivation to write something here in ITworld.

  • (Is There) Motivation for VoIP Fuzzing

    Posted Sep 04, 2008 - 03:06 am

    What have we learned during these six or so years of proactive security work with VoIP fuzzing? Here is my top ten discoveries.

  • What to Look in a Test Automation Product: Features or Benefits

    Posted Jul 20, 2009 - 12:10 pm

    The leap from manual tests or simple scripts into fully automated test suites makes all self-respecting test engineers just simply excited. It is difficult to see the limits to the things where test automation could be used. But hold on! Are you thinking straight? Why was it that you were looking for test automation in the first place?

  • Security Testing: It Is About Coverage

    Posted Feb 01, 2010 - 07:19 pm

    It is easy to do pentetration testing. My two year daughter can do it (well at least she broke through a screen-lock). But doing it well is the challenge. That is what coverage is about. Security test coverage, like any test coverage, is measuring how much of all the possible sensible options you cover with your testing. Let's dig into this topic a bit more, and perhaps next time someone comes offering you pentesting services, you will have a few new questions to ask the auditors.

  • IPv6 Day: Time to think about security testing for IPv6

    Posted Jun 08, 2011 - 09:41 am

    Today, on Wednesday June 8th, we celebrate the World IPv6 Day. The IPv6 Day was introduced to motivate organizations across the industry to prepare their services for a successful transition from IPv4 to IPv6, once the IPv4 address space runs out.

  • Good VoIP Deployment Guidelines (Do Not Exist?)

    Posted Oct 23, 2008 - 08:27 am

    I get questions regarding VoIP deployment all the time. Sometimes it is someone looking for simple and cheap Enterprise VoIP, who are unsure if VoIP can be deployed securely with those two parameters in the equation. More often it is the security aware people who are willing to invest almost anything to make it work, but cannot. As always, there is no silver bullet solution for either. If you look at my past opinions, I keep changing my mind between cheap that works, and secure that doesn't. What do you think? Which way should we go in VoIP?

  • VoIP security auditing is becoming more and more complex ... Not!

    Posted Aug 15, 2008 - 07:14 am

    I am curious how people can conduct penetration tests of a complex VoIP system when they barely understand how VoIP infrastructure works. Today, security people are still stuck to auditing practices from 1990s. When asked to do a penetration test, a consultant often is only looking at past issues that can be detected using various vulnerability scanners. Very few of them know that vulnerability scanners have extremely bad coverage of vulnerabilities in VoIP solutions. And even if the tools did know VoIP, who really cares about past issues that might have been relevant several years ago.

  • Greatest Challenge in VoIP Security

    Posted Jul 16, 2008 - 03:08 am

    The greatest challenge in VoIP security is that there are very few good example case studies available. There are some very good VoIP deployments. But try to find a white-paper with someone disclosing all the their success stories in building a perfect VoIP network. No luck! Unfortunately much of that data is hidden in confidential documents. Still, I have really loved to see VoIP security emerge and evolve from being a hindrance in VoIP deployment, into a key marketing value. Finally some of those success stories will get a chance to see daylight.

  • VoIP Still Not Ready For Carrier-Grade Networks

    Posted Oct 02, 2008 - 01:22 pm

    After a quick tour of some Really Talented Groups dedicated to fuzzing research, I noticed three things: 1) Most teams are focused on fuzzing VoIP 2) Most if not all VoIP devices still break with fuzzing 3) Most VoIP vendors still do not get it. The tour continues...

  • Visualizing Security - The Challenge of 2009

    Posted May 20, 2009 - 08:53 am

    Have a look at all leading security companies today, and you see all of them launching or planning to launch solutions targeted at visualizing and collaborating over security issues. What is this about? Let's have a look at different initiatives in this area.
Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Join today!

See more content

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

how to convert nsf to pst?
0 answers
How do you respond to a job interviewer that asks to see your social media activity?
3 answers
What is the best audio format for websites?
2 answers
More questions

Security: Secrets and Hype Archive

See all blogs
2011
June (1)
April (1)
2010
February (1)
2009
July (2)
May (1)
March (1)
January (1)
2008
October (2)
September (2)
August (1)
Ask a Question