Voice Security

As with most emerging technologies, in its infancy, IP telephony deployments were more concerned with features and quality than with security. Because IP telephony is offered through convergence with data on one network, it can be thought of as simply another application running over the data network. As such, IP telephony can be made secure if its transmissions are treated like any other application that requires security, including authenticity, integrity, and confidentiality. With this perspective, it is easy to integrate IP telephony security into the design and security framework of a corporate network.

The security issues associated with IP telephony can be categorized as follows:

• Network security concerns

• Platform security issues

IP Telephony Network Security Concerns

Network attack risks associated with IP telephony typically belong to two of the four categories of attacks seen in Chapter 4, "Network Security Design":

• Access attacks

• Denial-of-service attacks

Access Attacks

Nonauthorized and even fraudulent use of the IP telephony network could be the outcome of an access attack. During an access attack, communications could be intercepted and even replayed. Another concern would be a replay attack or even an impersonation attack.

Denial of Service Attacks

In the case of a denial of service (DoS) attack, the quality of the communication could be severely impaired by a large quantity of bandwidth wasted to parasite traffic.

Platform Security Issues

Many IP telephony control applications run on servers. Those servers can themselves be running a commonly available operating system (OS) such as UNIX or Microsoft Windows XP. Those platforms are themselves vulnerable to attacks. It is therefore fundamental that best practices associated with servers be strictly implemented. Some of those practices, as described in Chapter 4, are as follows:

• Closing all unused TCP and UDP ports

• Timely patching of OS software

• Using antivirus software and ensuring that it is up to date

• Installing the servers in a secure location

Mitigating to Protect IP Telephony

A properly protected data network is by the same token a safe network for IP telephony. Best-practices-level protection can be accomplished by implementing the mitigation technologies that we explain in Chapter 4. This is a multipronged approach, where the perimeter and inside traffic, as well as the outbound traffic, are protected.

The following recommendations, beneficial to a converged network, can protect both data and voice traffic:

• Threat defense:

  - Virus protection Protect the CCM server against viruses.
  
  

  - Hardened servers and workstations Close all unused ports and perform timely patch management.
  
  

  - Traffic filtering This is done by a stateful firewall that has the capability to ensure that only legitimate interactive traffic is crossing into and out of the corporate network.
  
  

  - Intrusion detection and prevention Detect and possibly remediate an incoming attack.
  
  

• Secure communication:

  - Encrypted Virtual Private Networks (VPNs) Used between VoIP-enabled networks to communicate over nonsecure links to ensure the authenticity, confidentiality, and integrity of the communication.
  
  

  - Switched networks Prevent incidences of eavesdropping.
  
  

• Trust and identity:

  - Authentication Forcing IP phones to authenticate prior to being provided with transmission capabilities.
  
  

Security must be natively incorporated in your network design for the benefit of data and consequently VoIP traffic. But as with any good thing, too much can prove to be detrimental. For example, incorporating too much security could lead to noticeable transmission delays, or worse, effectively creating your own DoS attack. Furthermore, at some point in your quest for pervasive security, you will reach a point of diminishing returns, where additional security equipment only provides your network with a marginal rate of security return.^[11] So stay vigilant and keep up with the technology and the hackers, but don't try to be overzealous.