VOIP

I. What is VoIP?
II. Business & Security Concerns
III.Security Threats
IV.Security Measures
V. Cost/Risk Analysis
VI.Legal Consequences

1
 What is VOIP?

• Protocol optimized for the transmission of voice

through the Internet or other packet switched
networks

• Also referred to as IP telephony, Internet

telephony, voice over broadband, broadband
telephony, and broadband phone.

2
 How fast is VoIP growing?

Per a study conducted by IBISWorld:

• Industry’s forecast is to experience the largest

revenue growth in the telecommunications sector
over the next five years, at an annual growth rater
of 25%.

• Business subscriptions will grow by 44%,

compared with consumer subscription growth of
21%.
3
 How fast is VoIP growing?

Per a study conducted by IBISWorld:

• U.S. will have 25 million paying VoIP customers

by 2012.

• Total industry revenues in 2008 are forecast

at $3.2 billion, reaching $5 billion by 2012.

4
 Business Concerns

 Integrity – Voice quality should be excellent

 Availability – User needs dial-tone 365/24/7
 Confidentiality – All communication should
remain confidential
 Authenticity – Valid service subscribers
should be able to access the service
provider’s network
 Federal and State regulatory compliance

5
 Security Threats

Configuration weaknesses in VoIP devices and

underlying operating systems can enable
denial of service attacks, eavesdropping,
voice alteration (hijacking) and toll fraud
(theft of service), all of which can result in
the loss of privacy and integrity.

Unscrupulous telemarketers could use VoIP (via

soft PC based phones) to access customer
credit and privacy details.

6
 Security Threats

Today, the biggest VoIP-related security threats

are inside a company's firewall, such as
changing a configuration setting to make
the CEO's phone ring at a disgruntled
employee's desk. Eavesdropping is
another potential problem.

7
 Security Threats

Launch a Denial of Service attack by placing a

large number of calls, either as an
authorized or unauthorized user, to flood
the network.

SPIT (spam over Internet telephony or VOIP) –

advertising that appears in a VoIP voice
mailbox.

8
 Security Threats

Vishing, the process of persuading users to

divulge personal information such as Social
Security and credit card numbers. Attackers
can "spoof" the caller ID that users see to
make the call appear to come from a
legitimate organization.

9
 Security Measures

Bolster encryption by encoding and decoding

information securely, both the conversation
and the call numbers.

Encrypt VoIP communications at the router or

other gateway, not at the individual
endpoints. Since some VoIP telephones are
not powerful enough to perform encryption,
placing this burden at a central point
ensures all VoIP traffic emanating from the
enterprise network will be encrypted.
10
 Security Measures

IP Phone must register to make phone calls.

1. When a phone tries to register, the registrar

sends a challenge.
2. Phone correctly encrypts the challenge,
digital certificate from phone manufacturer,
and Media Access Control (MAC) address.
3. Manufacturer certificate cannot be forged
because it is burnt into the phone’s non-
volatile RAM and cannot be retrieved.

11
 Security Measures

Separate VoIP network from data network by

logically segregating the voice and data
networks using vLAN-capable switches.

Don't allow interaction between Internet-

connected PCs and VoIP components.

12
 Security Measures

Install an Intrusion Prevention System (IPS) at

the network's perimeter to scan for known
signatures while blocking or allowing traffic
based on application content rather than IP
addresses or ports.

An IPS can dynamically modify firewall rules

or terminate a network session when
necessary.

13
 Security Measures

Session Border Controllers (SBC) prevent

someone (most likely a computer program)
from generating abnormal number of calls
from a legitimate VoIP account within a
threshold period.

A violation of the threshold policy rule

suspends additional call placement from an
account for specified period of time.
A session key is maintained for the whole of
the conversation for security and encryption
purposes. 14
 Security Measures

Implement a voice-aware (VoIP-ready) firewall,

which is optimized by voice, allowing the
opening of ports only when a connection
must be established.

Stateful packet inspection can be used to

drop attack packets because they are not
part of an authenticated connection.

15
 Security Measures

In order to mitigate the latency issues caused by

security measures, add QoS to all devices
processing the calls, i.e. turn on this feature
on the service provider’s data switch and
the data router, as opposed to a phone
switch located within the subscriber’s LAN
where the call terminates.

16
 A look at the VoIP infrastructure
Session Border Customer A
EWSD Switch
Controller T1(s)
Edge Router
`

GenBand G6
Public Switched T1(s) Customer B
Telephone Network
PRI Virtual VPN
Trunk Router `
Per rate Center

Firewall
Next VOIP
Service

1. Customer A’s SIP phone initiates call by contacting

SBC
Central Office 2. SBC contacts Applications Server to determine
Site Headend Router
(Telephone Switch Exchange) where to send RTP (Real Time Protocol) traffic
3. Application Server consults with Network Server to
determine where SBC is to connect to send establish
session for traffic
TECH CENTER Core Routing
4. Application Server Contacts Genband G6 and SBC
Virtual VPN Router
VOIP Servers VPN Tunnel and give them each others contact info (IP and port).
5. Genband and SBC establish Signaling session for
call
6. Customer A’s SIP phone sends traffic to SBC, then
to G6 over to the EWSD

Data Center
Broadworks Application
Server

Email Servers that store

Core Routing Vmail wave files

Broadworks Network
Server Broadworks Media Server

Firewall

Firewall
17
Broadworks Web Server
 Security Threat to Come

A lot of the security measures taken today are

based on experience with restricting access
to data networks.

To date, not a single virus is reported that is

specific to infecting the VoIP packets.
However, it is to come without a doubt.

18
 Cost/Risk Analysis

Cost/Risk analysis vary from industry to industry

and business to business. The best
judgment of risk exposure is collective
assessment of both immediate and future
monetary losses to an organization.

Organizations today can utilize research based

calculators for estimating the potential cost
of a data security breach for any number of
'at risk' records. The same concept can be
applied to VoIP.
19
 100,000 Cost/Risk Analysis

A sample identity theft or data breach Cost

calculator can be found at
www.IdentityTheftAmerica.com/databreachcalculator.asp

Enter Total Number Of Affected Records   100,000

Customer Notification (Mail)   $664,000.00
Phone Call Center Support   $2,895,000.00
Legal Defense Services   $663,000.00
Criminal Investigations (Forensics)   $248,000.00
Public / Investor Relations   $205,000.00
Free / Discounted Services (Credit
reports)   $2,380,000.00
Cost Of Brand Impact - Lost & Fewer Customers   $9,832,000.00
Cost Of Security Data Breach   $16,887,000.00
20
 Legal Consequences

Businesses need to be aware that the laws and

rulings governing interception or monitoring
of VoIP lines, and retention of call records,
may differ from those of conventional
telephone systems. These issues
should be reviewed with legal advisers.

Virus attacks delivered through use of VoIP

services, such as Skype, may not be held
accountable.
21
VoIP Security

Questions?

22