Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

224

|

Chapter 10: Security and Monitoring

Access Control

The biggest headache in building secure networks is often access control. It is by per-

mitting access that rich applications are delivered in the network; it is by restricting

access that those applications are made more secure. Unfortunately, just as in the

outside, analog world, limiting access in the name of security can result in a poor

experience or a lasting resentment by users.

Consider the security checkpoints at airports: very thorough, very time-consuming,

and, possibly, a very big inconvenience. But the point of an airport security check-

point is the same as an access control policy on your VoIP network: allow only the

right people in—that is, people with a boarding pass and a clean X-ray scan. Like-

wise, if an access attempt that isn’t authorized or is possibly damaging is made into

the IP network, stop it immediately.

Don’t confuse access control with intrusion detection. Access control

is a policy-based, preventive idea; intrusion detection is an intelli-

gence-oriented, reactive idea.

There are many layers to the access control paradigm—credentials, origin and desti-

nation, timing, and physical presence controls. One or all of these may be taken into

account when your network decides whether to let somebody have ...