NTA Monitor

Latest News

Will IE6 be the next NT4?

1st October 2009 All penetration testers will remember the long tail of Windows NT 4.0, and how this operating system continued to be used long past the point when security updates stopped at the end of 2004. For many years the presence of an unpatchable NT4 server was a common issue in a penetration test report, and it is only now, almost five years after security support ended, that finding an NT4 system on a network is becoming a rare event. Read More

One in four web applications susceptible to high risk security flaws

7th September 2009 NTA Monitor has reported a 10% increase in the total number of web applications found to have at least one high-risk security issue... Read More

Organisations facing a changing threat landscape

20th July 2009 According to NTA Monitor's 2009 Annual Security Report, the average number of Internet security vulnerabilities is on the rise... Read More

The Return of the Insider Threat

1st July 2009 When NTA started security testing twelve years ago, the main focus was on the insider threat. There were many reports with statistics showing that most security breaches were due to insiders. By contrast there was very little focus on the external threat via Internet and third-party network links. Back then many companies did not even have a firewall. Read More

Who's listening in on your corporate network?

Incorrectly configured VoIP systems are exposing companies to a variety of risks, warns leading IT security consultancy, NTA Monitor. Having voice and data traffic sharing one network with only 'virtual' separation has significant efficiency benefits and effective configuration can avoid any crossovers. However, mistakes or shortcuts can expose organisations to risks such as network users eavesdropping on internal telephone calls or phone users being able to access the network.

Sensitive corporate data and conversations between directors could be a target for network users who are able to 'sniff' or collect voice traffic over the network and subsequently piece it together. However, by encrypting the voice traffic, this potential threat can be avoided. Furthermore, a VoIP server may hold a large volume of data centrally, such as all speed dials, and this aggregation of data creates a tempting target and a system with a higher risk profile.

Simply by plugging a laptop into a VoIP system housed in a public area such as an office reception, an unauthorised third party may be able to gain access to the network. This concern may be elevated by the introduction of wireless VoIP devices.

NTA Monitor highlights that VoIP systems can also be at risk from traditional IP attack vectors. Weak security on Internet facing systems such as web applications, third party links and remote access gateways may lead to stepping stone attacks into the network and potentially into the voice layer if this is not correctly separated. Although VoIP-related infrastructure, such as call managers and phones may be specifically targeted, attacks on conventional network components such as switches, could also result in VoIP outages.

"The route to a robust VoIP deployment and the efficiencies that an integrated network can provide is via careful configuration, particularly separation and encryption, and a considered view of the implications, policies and procedures associated with VoIP," says NTA Monitor's Technical Director, Roy Hills.

This article was first released on: 20th October 2008