Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Key Issues: Security and Monitoring

|

245

Key Issues: Security and Monitoring

• Security in traditional telephony is quite limited and much less effective than

that of modern data systems. Security in IP telephony applications is infinitely

controllable and expandable due to its basis in software.

• Snooping and phreaking are fairly easy in traditional telephony environments.

• Call detail records and call accounting can provide forensic data when investi-

gating an instance of system abuse.

• A properly configured and well-tested dial-plan is a good way to prevent anony-

mous abuse.

• Credentials and authentication are often required in order to use IP telephony

applications, just as they are required to use other kinds of applications.

• MD5 hashing is a good way to hide passwords from casual observation, and

most SIP implementations support authenticating endpoints using MD5-

encrypted credentials.

• Media encryption can stop would-be eavesdroppers from listening in on your

VoIP conversations.

• Software maintenance is crucial with VoIP servers in order to avoid virus and

worm attacks that exploit known vulnerabilities.

• Hardening VoIP servers is important, just as it is in any other mission-critical

application.

• Removing unnecessary software and optimizing local firewall policy are