Security

Good VoIP Deployment Guidelines (Do Not Exist?)

October 23, 2008, 07:27 AM — 

Knowledge on security issues is a two-edged sword. Knowing enough of security will empower you to make right choices. But knowing too much can make you paranoid. So what, if all VoIP systems can be broken into? Or can they? Or do you really want to know?

Some people argue that you should not care about VoIP issues unless they impact your own VoIP deployment. With this thinking, why would I care about Microsoft problems as a Mac user? The answer is simple: I am in the security business, so I should know about security issues in any platform. If you are in VoIP security business, your job is much easier as you only need to know about VoIP security issues in any architecture and platform. Knowledge about vulnerabilities in one specific domain will help you analyze similar flaws in another domain. No tool can do that for you. It is not only about knowledge of issues, but how you use that knowledge to find new issues.

Building a VoIP architecture does not start from security mechanisms, but user requirements and budget. Although people keep saying that security is not an add-on, it really often is. But it needs to be added at the right time. Not all VoIP architectures need any security (mechanisms). The right choice of products, protocols and network architectures can take you a long way before any VoIP security solutions need to be added (if ever).

So back to the original question(s): How do I build a cheap (free) but still secure (enough) VoIP deployment?

The most common method of deploying VoIP in an Enterprise environment is using softclients, VoIP terminals running on a PC. The VoIP server can be running any open source VoIP gateway such as Asterisk or SER. The cost? Zero. Sounds attractive?

The security threats in such a simple VoIP deployment are really quite easy to enumerate:

  • VoIP client has a vulnerability(Probability 100%)
  • VoIP server has a vulnerability(Probability 100%)
  • The PC has a vulnerability(Probability 100%)

What? That is not a threat enumeration! You are right... Let's try it the other way around:

  • VoIP client has a vulnerability, with an exploit in the wild(Probability 100%)
  • VoIP server has a vulnerability, with an exploit in the wild(Probability 100%)
  • The PC has a vulnerability, with an exploit in the wild(Probability 100%)

We are not getting anywhere with this, are we... ;) One final time:

  • VoIP client has a vulnerability, which will be exploited by someone(Probability ?%)
  • VoIP server has a vulnerability, which will be exploited by someone(Probability ??%)
  • The PC has a vulnerability, which will be exploited by someone(Probability ???%)

There are quite many influencing aspects in this...

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

I like it!
Comments

I agree that good "Secure

I agree that good "Secure VoIP" deployment guidelines don't exist. Regarding your question, what I think would be good is more "Secure Out of the Box" configurations. The major vendors are getting better and better, but there will still be quite a few security issues present if security isn't a focus during deployment. However, I don't see this changing, until we see more real-world attacks.
| reply
peer-to-peer

Brian Proffitt
Microsoft/Novell: Breaking Down the Coupon Numbers

Esther Schindler
Drupal's Dries Buytaert on Building the Next Drupal

Tom Henderson
Top Ten General Operating Systems Rants

pasmith
PS3 motion controller delayed; goes up against Project Natal

sjvn
Neolithic Windows security hole alive and well in Windows 7

claird
Perl source code comparison makes for good reading

mikelgan
Cell phones don't create stress or interrupt much

Sandra Henry-Stocker
How to: The Unix Interview

 

Where Google Chrome security fails: the password
I heard mention that the Chrome OS will have some sort of encryption available a la bitlocker. If it's possible to encrypt personal data using another password or key, then it may have potential for very secure data.... And Ubuntu has an 'encrypt home directory' option, perhaps google should follow suit.
- Dann

Join the conversation here

The Daily Tip

The Daily TipQuick, practical advice for IT pros. Made fresh daily.

Hot tips:

Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.

Newsletters

Subscribe to ITWORLD TODAY and receive the latest IT news and analysis.

I would like to receive offers via email from ITworld partners.
By clicking submit you agree to the terms and conditions outlined in ITworld's privacy policy.
Marketplace