VoIP security: The real risks

Hi, I'm Andy Abramson, editor of VoIP Watch, and today we're going to talk all about VoIP security, the real risks you're facing when you have Voice over IP in your network. Let's first dispel something. A lot of times people are talking about the concept of SPIT, S-P-I-T. That stands for Spam over Internet Telephony. So what is that? That's a bunch of unwanted messages, calls and everything else imaginable that can be done over a telephone being automated from your network and into your network and throughout your network. What are we talking about? Unwanted calls leaving your network. Too many email messages filling your mailbox that mean nothing. Or a telephone call going out from your switchboard with an advertisement preceding it that you never placed in it.

All those things are possible with SPIT. Now, so far there hasn't been a SPIT attack, but that doesn't mean it won't happen. And because of that, we have to understand why it can happen. That's real simple. The network is the network. Let's imagine this is our network. Our network is not totally closed. It has ways in and it has ways out. And inside the network we have packets. Well, packets for voice, just like packets for anything else, because they're based on IP, internet protocol, are susceptible. They're susceptible to attack many different ways, and because it's IP packets in a network and your voice network is running right with your data network, that's going to cause a problem. You're going to get attacked just like your data network possibly is.

So what are the primary threats? From where we're sitting, I see three. The very first one, the dreaded denial of service attack. That's where your network is hit by many different computers all feeding packets to one single IP address or to multiple IP addresses of your network, making your network vulnerable and basically useless. When that happens, you're basically sunk and Voice over IP, just like data, runs the same risk.

Number two, fraud-this one hits you right in the wallet-and abuse. Fraud is unwanted people using your network without permission, unauthorized who shouldn't be on it, making telephone calls. Abuse, that's a little different. That's people who are permitted on your network but don't necessarily have permission to make calls to all the places they are.

And lastly, and maybe the one that we should be concerned about the most, the breach of privacy and confidentiality. That one is real serious. What does that mean? That means somebody can actually listen to your archived voicemail messages that are sitting inside your voice mailbox. Or, someone could access your call records and know who you've called and possibly who has called you. Those concerns are real and they exist today.

Now, let's talk about how we can prevent that from occurring. We have five easy tips that will make your life a lot easier once you've installed it. First, you want to have a security policy. By having security policy in place, just like for your data, for your voice, to prevent attack. Secondly, protect the network. Don't treat voice any different than you do data. Third, maintain and update your software. Make sure that you have it all current. Fourth, detect your abuse and fraud and cut it out as soon as it starts. And lastly, segment your voice and data networks into separate networks to prevent the crossover of problems from one impacting the other.

So just like a regular network has potential threats, VoIP security shouldn't be taken lightly. There are real risks. We've identified a few. We've talked about another that's not yet here, but which could emerge at any time. But with common sense and a good understanding of what you need to do to protect your regular data network, applying those same principles to voice will make your network secure.