Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Security for IP Telephony

|

223

Security for IP Telephony

IP telephony security boils down to three risk factors—the application, the network

operating systems, and the infrastructure. Secure these, and you secure the VoIP net-

work. Here are the most common types of security risks to data networks today:

DoS (denial of service)

Attacks that reduce or compromise the functionality of a software system via a

buffer or bandwidth overrun or by exploiting a security bug. Generally, DoS

attacks are accomplished using specific code to create certain conditions within a

target host or network that trigger a denial of service. As a rule, DoS attempts are

defeated with access control.

Man-in-the-middle

Attacks that allow a third party to monitor, record, block, or even alter, a data

transmission. Packet sniffing, or the capture of packets on a data link, usually

accompanies this kind of attack. Man-in-the-middle attacks are defeated with

encryption and authentication.

Trojan horses and malware

Autonomous software processes designed to travel across the Internet and IP

networks, infecting exploitable hosts in order to replicate themselves and, some-

times, to leave a footprint behind.

In the world of convergence, access control, call-accounting, and telephony features

are aspects of the same extensible ...