Typical switched-circuit voice solutions based on private exchanges have become a very mature technology that is normally supplied as a ‘black box’ connected via well-established interface standards and network services. VoIP may be used to replace such installations, but it takes more than traditional telecoms skills to operate them properly.
On the other hand, there are also notable differences for those more familiar with supporting data networks. Factors such as delay are critically important to VoIP services, so those employed to manage and support such networks will need skills above and beyond those normally required for work on data transmission.
As a result, what VoIP needs is a combination of IT expertise, drawn from experience of maintaining secure data networks, along with more traditional PSTN-oriented skills that have traditionally been more focused on delivering high levels of availability.
Nonetheless, the components of a converged voice and data system make extensive use of software and hardware that form traditional computer installations and, therefore, require the same basic forms of protection.
For example, viruses could exploit weaknesses in the underlying operating systems and in application programmes. But when it comes to hardware, attacks are not limited to routers, switches and other standard network equipment: softphones are also vulnerable.
While such problems will be more frequent in some VoIP systems than others, it is essential that any new patches are applied as quickly as possible to limit the impact of any attacks. Anti-virus solutions will also be required, and these must be designed to ensure that excessive delay in telephony packets transiting the network is not introduced.
It is also important to monitor security sources for details of new forms of attack and register to receive security alerts directly from vendors. Customers that hold support contracts, for example, will usually be informed of any action they must take to protect their installations.
To ensure that VoIP is secure it is important to understand the nature of the specific threats that VoIP systems face and the possible results. With this knowledge, measures to protect the system can be far more targeted and thus more effective. The six threats listed below are likely to be the most common.
Denial of service attacks
Denial of service (DoS) attacks aim to reduce the quality of the phone system, even to the extent of preventing users from making and receiving calls. Like DoS attacks on data networks, email systems or corporate web sites, the perpetrators aim to flood voice services with unnecessary traffic.
In cases where calls are routed through the public internet, or across another network that shares capacity on a ‘first come, first served’ basis, interference can result even from legitimate activities, such as downloading large files. The packets of data that carry the call get delayed, causing breaks in the conversation. In severe cases, the line will be cut.
Those wishing to deny users the ability to use VoIP phone services can exploit the weaknesses by flooding the network with spurious data, reducing its ability to carry calls. Alternatively, an attacker can flood a target call manager, phone or IP telephony infrastructure with false service requests or malformed data packets. These will either overload the system and software completely or impeded its ability to handle legitimate calls.
Just as with DoS attacks on web servers and data systems, attackers can enlist so-called botnets to create a distributed DoS assault. Anti-virus solutions that also protect against malware; appropriately configured firewalls; regular security patches; and intrusion detection and prevention are therefore essential to ensure that weaknesses are not exploited to the full.
In addition, where private networks are used, it is possible to divide the available capacity to create two or more logical networks, each with its own capacity limits. This allows phone calls to be kept separate from data transfers and, as a result, from management traffic, minimising the possibility of interference.
Similarly, by assigning different service qualities, voice can be given higher priority to network resources, reducing the impact of delay and bandwidth hungry data transmissions. Quality can be further assured by operating call acceptance controls to monitor capacity and make sure new calls can only be made when bandwidth is available. After that, callers hear the busy tone.
Fortunately, the incidence of attacks on call managers and other VoIP infrastructure has so far been low. However, the problem is likely to grow as usage increases. As it does, it will become increasingly essential for operators to be equipped to take prompt and effective action to mitigate the effects of attacks until they subside or can be brought under control.
Theft of service
Next on the list of possible crimes is theft of service, the aim of which is to make phone calls at someone else’s expense and without their permission. This requires the ability to access or connect to an organisation’s VoIP network, or the theft of log-on details for public services.