VoIP Security Not feeling Use this guide to understand Voice safe in the over Internet online world? Protocol (VoIP) Telecommunications and Information Working Group (TEL) AUGUST 2008 VoIP Security Introduction About this Booklet This booklet is intended primarily to assist Small and Medium Enterprises (SMEs) in understanding the issues around VoIP security and to aid in safely using VoIP. This booklet also provides awareness information on the various types of VoIP implementations that are available, differences between traditional telephony and VoIP solutions, the different risks and threats introduced by a VoIP system, and how to protect against these threats. Contents A Background on VoIP Traditional landline telephony has been the mainstay of both household and business communication in the last century. With the introduction of fast broadband Internet What you need to know to read this book connections available at low-cost, a new technology has emerged in the voice communication space. Voice over Internet Protocol (VoIP) can offer significant cost Page 4 savings over traditional landline services for local or long distance calls, and for calls to both international locations and mobile devices. In view of this, market research Find the answers to your questions companies and analysts project that VoIP uptake is rapidly increasing and the future of Page 6 voice communication is closely tied to IP technologies. Why was VoIP developed? Selecting Your Voice over IP Solution VoIP was developed primarily as a technology to compete with traditional telephony, and Page 10 as such, the priorities during its development were focused on quality of voice calls and the reliability of the service. The ability to utilise VoIP telephony with existing telephone Using Your VoIP System switchboard technology and computer systems have also become pivotal considerations in VoIP development and adoption. This focus has allowed VoIP to rapidly become a Page 14 feasible alternative to traditional telephony, however has also introduced a number of security considerations to be addressed prior to achieving the same degree of ‘trust’ that Using VoIP with Other Technologies is now placed in the traditional landline telephone system. Page 28 The out of the box security of certain VoIP and Internet Telephony solutions is considered inadequate for some uses, unless properly considered and accounted for. An insecure VoIP Security Checklist VoIP system may expose organisations and individual users to potential eavesdropping on Page 34 conversations, theft of services, interruption of service and other impacts. Target audience of the booklet This booklet is aimed at all users, regardless of skill level. The content is written for SMEs, but is also applicable to consumer level users. DSL (Digital Digital subscriber line (DSL) is a technology which allows for digital Subscriber Line) data transmission over the wires of a local telephone network – A glossary of terms is usually found at the back of a book and enabling broadband Internet access. A particular form, called ADSL referred to only as required. However, you will find it much (asymmetric digital subscriber line) enables faster data transmission easier to understand this booklet if you take a few minutes now to over copper lines than conventional modem based technology. The familiarise yourself with the vocabulary of VoIP technologies. distinguishing characteristic of ADSL compared with other forms of DSL is that the volume of data flow is greater in one direction than the other – thus it is called asymmetric. Generally download bandwidth is greater than upload bandwidth. What you need to Cable Internet Cable Internet is a form of broadband Internet access which uses cable television infrastructure to transmit data. Cable Internet cabling 4 does not require traditional telephone line connections, but does know to read this book require cable television connections and wiring to be in place. POTS Plain old telephone service (POTS) is a term which describes the Softphone A softphone is a software program that enables IP telephony calls (Plain old telephone service that remains the basic form of residential and on a computer device or workstation. A softphone can be used with telephone service) small business service connection to the telephone network in most a microphone and speakers, or with a softphone capable handset parts of the world. (such as a USB IP telephone). An example softphone is Skype. PSTN The public switched telephone network (PSTN) is the infrastructure Convergence Convergence is the merging of separate networks, technologies, (Public switched for the world’s public circuit-switched telephone networks. This and environments into one collaborative multi-media network. A network is now almost entirely digital and includes fixed (land line) converged network is theoretically capable of handling the different telephone elements and functionalities associated with each separate network, network) telephones. The PSTN is able to deliver quality of service (QoS) guarantees meaning that downtime of the network is limited. and enables a higher level of interactivity between them. This booklet will be dealing with the convergence of voice data and regular data IP (Internet The internet protocol (IP) is a data-oriented protocol for transmitting on the same network. data across computer networks. IP is one of the fundamental Protocol) A denial of service (DoS) attack is an attempt at limiting or stopping technologies on which the Internet is built. IP provides a best effort Denial of Service (DoS) legitimate users from accessing a specific computer system or delivery strategy which means that there are no guarantees about resource. In the context of this booklet, DoS attacks will mainly be packet delivery, however reliability and delivery can be enhanced referring to the disruption of VoIP telephony. with a number of solutions. Protocol A protocol is a standard method for implementing communication IP Packets IP packets are small blocks of data which are used to send between two computer entities. Different protocols can exist to information across an IP network. A packet is a container of both tackle the same basic issue however their success may be highly the configuration and transport information required to deliver the varied. In many cases, the protocols must be the same at each end packet to the correct destination, and the actual information that the of a connection for computers to communicate. system / user / device is trying to communicate, i.e. the payload. Hardened System A hardened system is a computer server / terminal which has been Confidentiality, Confidentiality, integrity and availability (often referred to as CIA) configured in such a way that it is highly resilient to security risks. A Integrity and are three principal properties that information security aims to hardened system would likely have a well configured and up-to-date Availability protect. To maintain confidentiality is to ensure that data remains version of operating system, be well patched and have appropriate private – only the intended and authorised recipients, individuals, security software installed. The way the system communicates with other processes or devices, may read the data. To maintain integrity is systems would be configured with security and protection in mind. to ensure that data has not been altered during transmission from origin to reception. Availability is the assurance of timely and reliable Interoperability Interoperability is the ability of different systems and technologies access to data services. to communicate and share information with one another. SIP and H.323 The Session Initiation Protocol (SIP) and H.323 are the two standard PBX (Private The private automatic branch exchange (PABX) or private branch protocols that enable voice communication connections to occur. exchange (PBX) is a connection between a private business and the Branch eXchange) SIP is the newer of the two and was created specifically for IP PSTN. The PBX handles calls between your organisation’s extensions multimedia technologies. H.323 is an earlier protocol and was as well as connections to the PSTN. conceptualised initially for PBX technologies. WHEN USING VoIP COMPARE TO Page Reference: Page Reference: WHEN USING VoIP COMPARE TO TRADITIONAL TELEPHONY SERVICES, TRADITIONAL TELEPHONY SERVICES, QUESTIONS YOU MIGHT ASK: QUESTIONS YOU MIGHT ASK: WILL VoIP OFFER ANY SIGNIFICANT There are many benefits to VoIP networks, though there are Fraud and theft risks do exist in VoIP, as with any ARE THERE ANY FRAUD OR THEFT RISKS also some tradeoffs. Some potential benefits include higher communication protocol or network. However controls BENEFITS OVER MY LANDLINE PSTN scalability, mobility and being future ready. To learn more can be implemented to minimise this security risk. See the WITH VoIP? about the differences between VoIP systems and PSTN section: VoIP Threats: Integrity, Page 18. NETWORK? networks including both positives and negatives, see the section: Differences between VoIP and traditional telephony VoIP operates via a significantly different transport method services, Page 8. DOES VoIP HAVE ANY RELIABILITY to that of traditional telephony, and is a relatively young technology (circa 20 years) when compared to traditional ISSUES COMPARED TO TRADITIONAL What’S THE DIFFERENCE BETWEEN VoIP solutions are widely varied. For the home user, software-based VoIP or use of a Voice Box solution may telephony