victoria avon's List: VoIP- Organization Use and Security Issues

• Information security principles, legal and ethical concerns are amalgamated that surround security testing and components of generic security testing methodologies that can be applied to VoIP. A simple model is created of a business infrastructure (core network) for the delivery of enterprise VoIP services and the selected tests are applied through a methodically structured action plan.
• The adoption of VoIP has raised some security concerns, in particular, issues relating to voice-traffic confidentiality and integrity issues, which may form part of contractual or regulatory requirements, VoIP systems availability issues to maximise the return on capital investment and finally, user and end-point authentication issues to avoid VoIP service abuse such as and toll-fraud and the associated financial impact.
• The basic concept of VoIP is the digitization of analogue voice signals using appropriate coders/decoders to time sample an analogue voice signal; to divide the digital information into data packets for transportation across an IP network.

  • This is how it works.
  Add Sticky Note

• arious QoS mechanisms and traffic engineering techniques are applied during the packet switching and/or routing of voice packets in order to prioritize the delay-sensitive voice packets, over plain data packets. Mechanisms are also employed to compensate for IP network inherited latencies packet loss and jitter.
• The call controller, along with the AAA server allow enterprise employees to authenticate and access to the VoIP network and services. The AAA server accounting service interoperates with the voice gateway to maintain accounting and billing records known as call detail records
• VoIP has the potential to become a mission-critical business application but has a number of information security threats; risks; and vulnerabilities, which need to be addressed, before it is a realistic candidate to replace the PSTN in an enterprise environment. In formulating a security policy to protect a VoIP network a risk and threat assessment is essential is determining, appropriate security countermeasures.
• The methodology recognizes beyond the technical activities, the importance of qualified security testers and all the legal and ethical issues that surround security testing.
• The methodology should include the protection of individuals with respect to the processing of personal data and in particular their right to privacy in private telecommunication networks. The incorporation of specific data protection and privacy verification tests in the methodology will ensure minimum organizational compliance with appropriate regulation and/or legislation.
• A vulnerability rating system is a fundamental component of a security testing methodology. In essence, the objective of a vulnerability rating system is to help the decision maker focus in the most critical security vulnerabilities and prioritize his/her corrective actions accordingly. The methodology will employ the open-source Common Vulnerability Scoring System

• - The exploitation of vulnerable services without explicit written permission is not permitted.

  - Any of the security tests which might impact the availability or integrity of information and information systems will be conducted outside of business hours and only with the explicit written permission
• - The violation of any criminal and civil law, is strictly forbidden.

• he security tester should be informed of and respect:

  - Contractual agreements with third party connected networks.

  - Service level agreements with telecommunication and/or Internet service providers.

  - The organization security policies.
• - The scope of the security test should be clearly defined. In terms of an external security test the client should provide the security target IP address and/or IP network. In case of an internal security test the client will additionally provide a detailed network diagram, access to configuration files and a user level access account.
• - The report must include practical solutions for security problems uncovered by the test

• o ensure the validity of the methodology the following information security best practices will be consulted and included in the development of specific security tests.

  [3] US National Security Agency (NSA) Security Configuration Guides

  • Its important to follow laws while protecting security.
  Add Sticky Note
• US National Institute for Standards and Technology (NIST) Special Publication
• [5] The Institute for Security and Open Methodologies (ISECOM)
• Cisco Systems
• VoIP Security, Ransome and Rittinghouse
• The standard security tests will cover the host environment, which supports and "shelters" the VoIP application.
• The VoIP specific security tests will cover the VoIP application. That is, voice gateway services; call controller services; call control and signalling protocols; call routing; call admission control; voice traffic etc.
• he discovery stage objective is to collect important initial information about the security target by public and private available sources.
• - The security posture review objective of this stage is to gain deep knowledge about the security target's operational environment and security objectives.
• The vulnerability assessment stage objective is to identify; map; and rate known vulnerabilities
• - The security posture review objective of this stage is to ascertain that the security controls of the security target are configured properly and functioning within their operational security requirements.
• The verification stage objective is to verify the identified security vulnerabilities by exploitation or other means.
• The reporting stage objective
• Note that the following summarized findings are a combination of both standard and VoIP specific security tests.

• The laboratory ethernet switch:

  - Supports strong password encryption for every user account.

• nsure that the organization releases the minimum necessary information regarding the elements that comprise the VoIP core network in publicly available databases (e.g. public DNS servers).

  - If possible isolate the VoIP core network in its own security perimeter network.

  - If possible separate the voice traffic from the normal data traffic.

  - Introduce both a properly configured VoIP aware firewall and an intrusion detection system to screen and detect any abnormal activity.

  - If possible block the ICMP protocol by entering in the VoIP core network.

  - Always use a properly configured ethernet switch to provide IP connectivity in the VoIP distribution LAN.

  - Always use the least privilege security principle when configuring the elements that comprise the VoIP core network

  - Harden the IP-PBX server by disabling any unnecessary services and by suppressing any available application banners.

• Always use a real-time patch management system to keep the operating system and its supporting software applications up-to-date.

  - Introduce a hardened AAA server that interoperates with the IP-PBX to provide strong user and end-point authentication and authorization services and to secure the processing and storage of the call detail records.

  - If possible use out of band communications to manage the elements that comprise the VoIP core network. Always use strong cryptographic controls to protect the management traffic when out of band communications are not available.

  - If possible use less automation to distribute services from the VoIP core network to the end-points

• - If possible use strong cryptographic controls to encrypt the voice media stream.

  - If possible use strong cryptographic controls to protect the integrity of the call signalling messages.

  - Always use QOS mechanisms to prioritize the VoIP traffic.

  - Always log and always monitor the VoIP core network for abnormal activity.
• methodical security testing since it has been designed to be reliable, repeatable, and reportable. Reliable in the sense that it promotes the employment of professional security testers, it sets strict rules of engagement, and it provides specific security tests, which are not intrusive in nature. Repeatable in the sense that it provides security tests which are as technology and/or vendor neutral as possible, combined with expected results by every applicable security test. And reportable in the sense that it provides specific results and recommendations which can be incorporated in a final report.
• The first operational and economical benefits by the early adopters of VoIP are visible, but numerous problems remain which are delaying the universal acceptance of VoIP in the enterprise environment.

• One of the most significant concerns of VoIP is its security engineering. Determining and assessing security vulnerabilities and/or misconfigurations in a complicated and demanding information technology application such as VoIP, requires an appropriate security assessment methodology. A dedicated VoIP oriented security assessment methodology enables assessors to perform a competent, repeatable, precise and, ethical security test, which covers the key aspects of a VoIP infrastructure.

  VoIP can offer significant business advantages and has the potential of changing the way people communicate. However there are a number of risks associated with embracing this exciting new technology. A VoIP security framework that includes the appropriate technologies, methods, and tools, will contribute towards the mitigation of these risks and enable implementers to secure their VoIP networks effectively.

33 more annotations...

• Larger organizations have been using VoIP (Voice over Internet Protocol) for their phone needs for some time. Individuals and small businesses that mix landlines and cell phones can also benefit from this communications revolution.
• VoIP technology allows voice calls to take place over an Internet connection instead of the traditional wired phone system.
• VoIP services offer attractive rates compared with a traditional landline service. Typically, you get unhmited calling within the U.S. and Canada for a fixed monthly fee, voice mail, call waiting, caller ID, and other features that vary by provider.
• One drawback is that broadband phone service doesn't work during a power outage unless you and your broadband provider have a working battery backup.

  • This could be dangerous for emergencies.
  Add Sticky Note
• Traditional phone lines are rarely unavailable, whereas broadband connections are occasionally unavailable due to failure or maintenance.
• It has all the advanced calling features Vonage offers and is designed (but not guaranteed) to run on public access computers, making this a good choice for foreign travelers and residents who want to make and receive calls to and from the U.S.
• MagicJack requires your computer to be on and have a broadband connection to place and receive calls.
• MagicJack runs on Windows XP, Vista and Macs
• The basic adapter supports one wired phone line, while the HiPort router can support two wired phone lines and can also add Wi-Fi to your network. A computer is not required to use this service, and it does not support fax machines.
• T-Mobile also offers subscribers a HotSpot service for cell phones. This service allows your cell phone to place and receive calls over a Wi-Fi connection. Calls made or received through a Wi-Fi connection are free and are not deducted from your monthly allotment of minutes.
• so international travelers are on their own in finding an accessible Wi-Fi network
• Skype offers software for making and receiving calls using your computer.
• Skype can work with a dial-up Internet connection instead of broadband
• Skype requires a computer for setup and usage, although special handsets allow Skype calling over most Wi-Fi connections without using a com- puter. Install Skype on your com- puter, plug in a headset with microphone, and you can talk with other Skype users anywhere in the world for free while connected lo the Internet. If you have a webcam, you can also have a videochat.
• kypeOut allows you to dial landline and mobile phones for very low prices. One plan available in the U.S. for $2.95 per month allots 10,000 minutes per month to call any phone number in the U.S. or Canada
• For a small fee you can buy some useful and sophisticated additional services
• $30 to $60 per year,
• you receive a local phone number of your choice
• Because Skype was designed to run from a computer, it works the same (and with the same rates) anywhere in the world. If you take your laptop to Spain and have Internet access, you can use it just as you would back hom
• SMS text messaging, conference calling, video conferencing and large file transfers. Faxing is not reliable over Skype connections,
• Skype is also available for several mobile phones, and in March the company announced new applications for the iPhone and some BlackBerry models.
• f a fax machine is not compatible with your VoIP service, you can subscribe to an Internet fax service.
• For basic home or small office use, landline replacement services offered by broadband and third-party providers offer compelling prices and turnkey installation but are less reliable than traditional wired lines. They offer a host of calling features but may not work with fax machines.

  • This highlights the main points.
  Add Sticky Note
• If staying closest to 100% reliability for calls and 91 1 is important, traditional landlines are still best. If you want simplicity with savings, then look at landline replacement services. If you are a frequent traveler or make many international calls, consider Skype, Magicjack and Vonage V-Phone. If you want to never miss a phone call, T-Mobile HolSpot is a great option.

22 more annotations...

• Although adoption of VoIP bybusinesses is widespread across the United States, a study released today byNetwork Instruments found that network engineers often lack the appropriatetools to successfully manage and troubleshoot VoIP performance problems.

• In an analysis of surveys from 273 network engineers across the United States, the study found that:

  * Nearly 50 percent were concerned with their ability to monitor the

  quality of VoIP service

  * 41 percent were unsure of their network's ability to handle the extra

  bandwidth consumption from VoIP calls

  * 36 percent were concerned with the reliability of their VoIP

  application during periods of heavy use

  • This is a large percentage of people.
  Add Sticky Note
• "The switch is often made without fully understanding the complexities of the technology as well as the high expectations users have of voice performance. The same may be said for the IT staffs, who implement VoIP without having the proper equipment to monitor performance and ensure long-term success."
• The main challenge with running VoIP across an enterprise network is its extreme sensitivity to delay, jitter, and packet loss compared with other network applications such as web and e-mail services. As a result, users can experience audio quality problems, ultimately resulting in user complaints and downtime.
• . "Network teams frequently rely on default testing tools included with the VoIP equipment, which provide minimal insight into VoIP communication running over the network and fail to compare its performance with overall network performance. Instead, the IT staff should use analysis tools that provide detailed insight into both VoIP and overall network performance."

3 more annotations...

• avesdropping is just what it sounds like-listening in on VoIP calls, a trick that is exponentially easier in VoIP than with traditional PSTN telephone networks. Eavesdropping can represent a major communications and security breach. Those overheard conversations can be used to gather intelligence from competing businesses, or worse, used as blackmail for financial gain.

  • This could be a potentially serious problem for companies with sensitive or private information.
  Add Sticky Note
• VoIP hopping can enable a PC to mimic an IP phone, giving hackers the inroads to access the VoIP system.
• Similar to e-mail phishing scams, another threat to keep an eye out for is vishing, or VoIP phishing. Much like its e-mail counterpart, vishing lets hackers spoof caller ID and present a fraudulent phone identity. People who receive calls from a visher may be tricked into believing they're talking to their bank or another legitimate institution, causing them to share sensitive information.
• Since VoIP IDs can consist of numbers or characters, they become similar to an e-mail address, meaning someone can reach you by telephone through the Internet. Spam writers can use VoIP to flood voicemail boxes with junk messages or keep the phone ringing, not allowing more important, welcomed calls to come through.

  • This may be more anooying, than dangerous, but could still delay business.
  Add Sticky Note
• Toll fraud was brought to the forefront in 2006 when the FBI charged two men with accessing VoIP networks and "reselling" minutes to unsuspecting customers to the tune of millions of dollars. A successful toll fraud attack lets unauthorized users access VoIP networks to make calls, increasing VoIP costs and traffic.
• he Skype worm, once known as the w32/Ramex.A virus, is a worm that spreads through instant messaging. It automatically stops access to security tools while it downloads to infected PCs and changes the Skype user's online status to "do not disturb" so that other users can't contact the infected user.
• nstead, using a sniffer or similar tool, a potential attacker can get onto the Wi-Fi network from outside or a different location and use that as an entry point to VoIP.
• Lack of robust tools in phones and servers mean users can't monitor their implementation and the protocols used to implement service. A weak implementation opens up the door for a hacker to send a message and make the system crash or execute code to get access to a laptop and pull data from it.

  • This could create a major problem with losing information.
• paying more attention to the feature set than the internal security mechanisms.

7 more annotations...

• Telecommuting employees are highly mobile, working from home offices, remote work sites, or while traveling. With FreedomIQ Follow-Me-Live call forwarding, incoming phone calls can reach the employee no matter where they are or what type of phone they are using. Since a VOIP hosted PBX uses the internet to transmit calls, the reach of FreedomIQ is not limited to in-office call transfer like a hardwired PBX.

  • This helps people to complete work in many places.
  Add Sticky Note
• elecommuting helps recruit and retain valuable workers.
• According to officials at FreedomVOICE Systems, telecommuting can also increase efficiency in the hiring process.
• Telecommuting respondents had a significantly higher level of education on average, yet their desired annual wage was approximately 11% lower than those applying for the regional position.
• a single worker saves his employer as much as $5,000 a year just by telecommuting. Less money is spent on workstations, maintenance, utilities bills, common office space and insurance.

  • This could appeal to many organizations
  Add Sticky Note
• many employers worry about the efficiency of their out-of-sight employees.
• "We determined that the most critical components for our ideal phone service would be a call recording system, a call monitoring system, and most importantly, a system or method to hold all of our agents accountable for their working hours, here or at home."

• FreedomIQ allows employers to manage by results, as well. With the click of a button, an employer can generate reports detailing:

  -- Login times

  -- Answered and missed calls

  -- Average and total time on calls

  -- Number of calls received in a date range

  -- Duration of calls to specific numbers

  • This helps employers to know what employees are doing.
  Add Sticky Note
• Unlike the additional hardware and expensive wiring of scaling up an office-based PBX system, employers can instantly add or subtract new features and phone stations for their FreedomIQ service.

7 more annotations...

• Service providers and enterprises expect voice over Internet Protocol (VoIP) to enable third-party application development, allowing them to mix-and-match best-of-breed applications from multiple vendors. By taking advantage of applicable techniques employed for Web-based services, service broker functionality deployed in the network will provide a framework for specifying VoIP application interaction rules

• nd the secret key can be derived with practically small computational complexity when only one plaintext is known (or chosen). These facts reveal that HDSP is very weak against known/chosen-plaintext attacks. Experiments are given to show the feasibility of the proposed attacks. It is also found that the security of HDSP against the brute-force attack is not practically strong. Some countermeasures are discussed for enhancing the security of HDSP and several basic principles are suggested for the design of a secure encryption scheme

• The article discusses the framework that deals on the promising technologies and applications that would benefit the business enterprises.

• In both traditional and Internet Protocol (IP) telephony, a caller ID number is subject to control and verification, whereas the displayable caller ID name is a convenience feature which operators have no control over. It may be arbitrarily set by the caller. Voice phishing can exploit this weakness

• VoIP offers unparalleled flexibility for users, but with that flexibility also come security concerns. Moving both the control and data channels to IP opens the doors to new types of attack not seen before on phone systems.