VoIP Security

Any technology that involves transfer of data or information is prone to compromised security. It happens with telephones, cell phones, email and Internet transactions. Because VoIP (Voice Over Internet Protocol) has the Internet as its mode of transference it’s possible to have your Internet-based called intercepted. To make matters worse, there are techno-troublemakers who are armed with the hacking skills needed to eavesdrop on virtually any call over the Internet they want to. It is impossible to ensure total security on information flow over the web including Internet based phone calls. As new technologies emerge with more highly developed security protocols, there will be those who consider it a unique challenge to crack these online defenses rendering security advances antiquated. The Internet has been notorious for alternating security breaches and accompanying fixes.

As VoIP becomes more popular, VoIP security continues to be stressed as a key to advancement of this technology, especially since it will thrive in the realm of the World Wide Web. There are, however, advances in VoIP security that have been utilized by VoIP providers in order to ensure protection of customer’s personal information.

VoIP Security is IP Security

VoIP is vulnerable to all security issues that generally affect the traditional IP data networks. This includes viruses, worms and denial of service (DoS), spoofing, port scanning, unauthorized access from a third party, and toll fraud. In short, the same issues you deal with in compromised Internet function can be linked to the use of VoIP technology.

VoIP’s Defensive Linemen

The two primary methods of security for VoIP users are tunneling and encryption. These security measures assist in providing a mechanism of trust in the safe use of the VoIP user’s personal data. Most VoIP providers use Layer 2 tunneling and an encryption method called Secure Sockets Layer or SSL to keep hackers at bay. Large corporate enterprises are using similar security mechanisms based on encryption for all internal traffic flowing over the VoIP system as well. It is advisable to route all inbound VoIP traffic that flows via a firewall through a proxy server, thus eliminating any direct connection with the internet.

On a larger level, organizations that are using VoIP as a popular mode of communication rely on a multiple level defense that addresses most VoIP security issues. In this scenario, the VoIP network is divided into secure zones protected by layers of firewall, intrusion prevention, and various additional security mechanisms. The advantage with this strategy is that it allows an organization to logically split and secure separate voice and data networks in front of individual voice and data components and between interactive points within the network. A system (like the one just described) should be complete with authentication, controls access (passwords and firewalls), encryption, an audit trail of calls, and facilities. Recording these issues can prevent security issue to a large degree because they are traceable.

Securing Your VoIP Network

While VoIP being internet-based is a key vulnerability, it also has its beneficial side. The years of experience in fending off or foiling Internet attacks is experience that can be used in blocking VoIP assaults; the lessons learned in the data networking field are just as applicable to VoIP networking.

One approach that should be given serious consideration is setting up a separate network for VoIP applications, running in parallel but separate from the data network. This may be considered a serious expense item that is incompatible with the perceived savings from VoIP. On the other hand, one has to consider the potential costs involved if both networks become corrupted or disrupted from an attack on one which also disrupts the other.

Here are some other methods for securing a VoIP network:

• – Enable as many of the manufacturer’s security protocols as possible, adapting or ‘tweaking’ these to your own specifications rather than simply following manufacturer’s defaults. Keep in mind that hackers and other attackers would probably know these defaults as well.
• – Apply a strong authentication and encryption for both data and voice networks. As noted above, use the lessons learned in dealing with data network security problems to establish a preemptive stance in dealing with potential VoIP security concerns.
• – Work out access controls and authentication protocols to ensure that only legitimate users can gain access to the VoIP network.
• – Use gateway and host-based anti-virus as well as anti-spyware programs to protect crucial VoIP servers. At the same time, consider establishing perimeter security protocols to protect both networks.

A key point to remember is that VoIP is built on already established equipment and applications. The experiences and lessons gained from dealing with security threats to the data network can and should be used in developing security for the voice network.

Conclusion

Because VoIP is a newer technology there is a lot of discussion about its security and reliability. But it may be interesting to note that VoIP is actually more secure than normal email or even bill paying online. You may not need to be too worried about the security issues related to VoIP technology. Many newer technologies are emerging and, given the current trend, it won’t take long before VoIP will be as secure as any other communication technology available today. Until then, if you are not sending highly sensitive information over the internet, VoIP is a relatively safe, reliable, and cost effective means of communication.

Videos on VoIP Security

Keeping your VoIP Secure: An Introduction to Cain, ARP, and MITM Attacks.