Who's listening in on your corporate network?
Incorrectly configured VoIP systems are exposing companies to a variety of risks, warns leading IT security consultancy, NTA Monitor. Having voice and data traffic sharing one network with only 'virtual' separation has significant efficiency benefits and effective configuration can avoid any crossovers. However, mistakes or shortcuts can expose organisations to risks such as network users eavesdropping on internal telephone calls or phone users being able to access the network.
Sensitive corporate data and conversations between directors could be a target for network users who are able to 'sniff' or collect voice traffic over the network and subsequently piece it together. However, by encrypting the voice traffic, this potential threat can be avoided. Furthermore, a VoIP server may hold a large volume of data centrally, such as all speed dials, and this aggregation of data creates a tempting target and a system with a higher risk profile.
Simply by plugging a laptop into a VoIP system housed in a public area such as an office reception, an unauthorised third party may be able to gain access to the network. This concern may be elevated by the introduction of wireless VoIP devices.
NTA Monitor highlights that VoIP systems can also be at risk from traditional IP attack vectors. Weak security on Internet facing systems such as web applications, third party links and remote access gateways may lead to stepping stone attacks into the network and potentially into the voice layer if this is not correctly separated. Although VoIP-related infrastructure, such as call managers and phones may be specifically targeted, attacks on conventional network components such as switches, could also result in VoIP outages.
"The route to a robust VoIP deployment and the efficiencies that an integrated network can provide is via careful configuration, particularly separation and encryption, and a considered view of the implications, policies and procedures associated with VoIP," says NTA Monitor's Technical Director, Roy Hills.
This article was first released on: 20th October 2008