SpeechTEK 2009
Securing Cloud Telephony
Dan York, CISSP
Director of Conversations, Voxeo
Best Practices Chair, VoIP Security Alliance (VOIPSA)
dyork@voxeo.com

Security concerns in telephony are not new…
Image courtesy of the Computer History Museum

Nor are our attempts to protect against threats…
Image courtesy of Mike Sandman – http://www.sandman.com/

Privacy Availability
Compliance Confidence
Mobility Cost Avoidance
Business Continuity

TDM security is relatively simple...
PSTN
Gateways
TDM IVR
Switch
Physical
Voicemail Wiring

VoIP security is more complex
Operating Desktop PSTN
E-mail
Systems PCs Gateways
Systems
Network Web
Firewalls
Switches Servers
Standards
Voice over IVR
Wireless
Instant IP Devices
Messaging
Directories
Internet
Databases
Physical
Voicemail
Wiring

Confidentiality
Integrity
Availability

Voice Application Diagram
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Voice Transport
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Voice Transport
Voice
Phone Browser
PSTN
(on svr)
Voice
Phone PBX Browser
PSTN TDM
(on svr)
Voice
Phone IP-PBX Browser
PSTN SIP
(on svr)
SIP Voice
Phone Service Browser
PSTN Internet/WAN
Provider (on svr)
SIP
Voice
Phone Browser
Internet/WAN
(on svr)
SIP

Voice Transport - SIP
Voice
Phone Browser
PSTN
(on svr)
Voice
Phone PBX Browser
PSTN TDM
(on svr)
Voice
Phone IP-PBX Browser
PSTN SIP
(on svr)
SIP Voice
Phone Service Browser
PSTN Internet/WAN
Provider (on svr)
SIP
Voice
Phone Browser
Internet/WAN
(on svr)
SIP

Voice Authentication
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???
Who are you talking to?

Voice Biometrics
Voice Auth
Biometrics Svr
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Web Transport
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

App/DB Server Transport
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Server Security
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Management Interfaces
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

APIs
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Local Storage / Logging
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Call Recording
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Web Interaction - Authentication
Web
Svr
HTTP
Voice App/DB
Web
Phone Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Web Interaction - XSS/Injection
Web Input validation?
Svr
HTTP
Voice App/DB
Web
Phone Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

External Interaction
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
? Java
XML ???
App/DB
Svr

Moving Into The Cloud

Location - Single network/server
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Location - Distributed
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML

Location - Distributed
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML

Location - Into the cloud
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or PHP
perl python
CCXML ruby
servlets
Java
XML ???

Location - Distributed/Cloud
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML

Location - Distributed/Cloud
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML

Location - Hybrid
HTTP
Voice App/DB
Web
Phone Audio Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML
HTTP
Voice App/DB
Web
Browser ?
(on svr) Svr Svr
VoiceXML
or
CCXML

Can You Trust The Cloud
To Be There?

Location/network questions
• What level of network connectivity do you have available?
• What kind of availability guarantees / Service Level Agreements (SLAs) do
you have in place?
• What kind of geographic redundancy is built into your underlying network?
• What kind of network redundancy is built into your underlying network?
• What kind of physical redundancy is built into your data centers?
• What kind of monitoring do you perform?
• What kind of scalability is in the cloud computing platform?
• What kind of security, both network and physical, is part of the platform?
• What kind of security policies and procedures are in place?
• What kind of patch management plans?
• Will firewall traversal be necessary (for instance, for a SIP trunk) and if so,
how?
• How scalable is the solution?
• Do you have appropriately-trained and available staff?

Distributed Architectures
Web App/DB
Svr Svr
Web App/DB
Voice Svr Svr
Browser
(on svr)
Phone Audio
App/DB
Voice Svr
Browser
(on svr)
MR
CP
ASR

Geography

Confidentiality
Integrity
Availability

Thank you!
Dan York, CISSP
Director of Conversations, Voxeo
Best Practices Chair, VoIP Security Alliance (VOIPSA)
dyork@voxeo.com