Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

220

Chapter 10

CHAPTER 10

Security and Monitoring

Like the Web, email, and other Internet communications tools, IP telephony can be

secured. This fact is one of its biggest appeals over old-school telephone equipment.

Security means enforcing system policy, recording instances of abuse for forensic and

litigation purposes, encrypting or otherwise hiding sensitive information in transit,

bolstering call-management systems’ resilience to exploitive attacks and computer

viruses, and securing the access perimeter of the VoIP network.

Security tools and enforcement practices for VoIP applications are the same, essen-

tially, as those for other IP-based apps, because they run on the same network. The

security objective of VoIP systems is largely the same as those of other IP-based sys-

tems: in a nutshell, preserve the operational status of the system.

There are many threats to this objective and many countermeasures to the threats.

Policy enforcements points, like firewalls, protect lower layers of the network, while

authentication systems like RADIUS and application proxies provide higher-layer

security. This chapter describes how to secure and harden a VoIP server, the basics

of DMZs, how to enable logging of VoIP traffic with iptables, how to tweak the log-

ging configuration of Asterisk, ...