This document discusses common misconceptions about securing VoIP systems and SIP trunking. It outlines known security threats to SIP such as theft of services, eavesdropping, and denial of service attacks. The document then addresses three specific misconceptions: 1) that eavesdropping on VoIP is easy, but securing media with SRTP and signaling with SIP/TLS protects phones, 2) that SIP trunking can be secured with only a SIP firewall when an SBC is actually needed to prevent DoS attacks, and 3) that good security is very expensive when AudioCodes offers affordable solutions that support encryption and other best practices. Overall it provides an overview of SIP security risks and strategies for properly securing VoIP networks

2. Common Misconceptions
Alan D. Percy
Director of Market Development
Alan.percy@audiocodes.com
The Truth of
Enterprise SIP
Security

3. 3
Threat is widely recognized
“Security Is IP Networking's Downside”
Gartner Report, 2006
“SIP is not an easy protocol to secure.”
RFC 3261
“T.J. Max theft is believed largest hack ever”
AP Newswire, March 30, 2007
“…SIP is vulnerable to certain attacks.”
RFC 3329

4. 4
Known Threats
• Known SIP Security Threats:
– Theft of services (unauthorized use of your network)
– Recording and eavesdropping
– Call Detail Capturing (tracking who you call and for
how long)
– Spoofing and Man-in-the-middle (Phone Phishing)
– Denial of Service Attacks
– Registration Flooding
– Malformed Messages
– Unsolicited incoming calling (SPIT)
– Trojan horse devices
– Viruses and Worms
– and more.

5. 5
Three Misconceptions about
Security

6. 6
Misconception #1
Eavesdropping VoIP
is easy

7. 7
IP-PBX SIP Architecture
Media Gateway
LAN Switch
PST
N
PST
N SIP
SIP Phones
SIP
T1/E1
Secure Facility
Secured
with
SIP/TLS
SRTP
IP-PBX

8. 8
Points of Risk
Signaling
Media
IP
Management
SIP/
TLS
SRTP
HTTPS

9. 9
Misconception #2
SIP Trunking is easy
to secure with a
SIP Firewall

10. 10
SIP Trunking is at Risk
• SIP Trunking
without correct
protection is open
to DoS attack, theft
of service and
other threats too!

11. 11
Protecting Against DoS
Attacks
One of two approaches:
1. Use PSTN Trunking
• Cannot execute a DoS attack over a PSTN circuit
• Media gateway insulates enterprise from outside world
• Enterprise uses PSTN as a “moat” around SIP Island
1. Secure SIP Trunks with SBC
• Firewalls do not fully protect against DoS
• Many SIP Security devices don’t support SIP/TLS or
SRTP
• Protect with an Enterprise-class Session Border
Controller

12. 12
SBC – Includes DoS Filtering and
Rate Limiting
ICMP
ARP Request
ARP Response
DTMF
SIP - Invite
SIP - Register
SIP- Response
SIP - Unknown
SIP - Other
SIP - Register
SIP - Other
DoS Filters
Un-Solicited SIP
Traffic
Established SIP
Signaling “Pinholes”
nRT - HI
nRT - LO
Best Effort
Port
SIP App Server
Traffic
Management/Shaping
maintain per queue
rate, size and discard
policy
RADIUS
VRRP
Dispatcher
Rate Limiting &
Prioritization
Application
Intelligence

13. 13
Misconception #3
Security is very expensive

14. 14
AudioCodes Solutions with
Security
Mediant 2000
Scalable Digital Media GatewayMediant 1000
Modular Media Gateway
MediaPack MP-11x
Analog Media Gateway
All support HTTPS, SIP/TLS, and SRTP
Mediant 1000 MSBG
with Integrated SBC

15. 15
Good Security Practices for
Enterprises
 Deploy encryption security (SIP/TLS and SRTP)
 Secure the front door (trunk lines)
 PSTN Trunking or Enterprise SBC
 Secure the back door (set and manage the passwords)
 Control access
 Manage software on
all the devices in the
system
 Eliminate WiFi access
 Keep an audit trail

16. 16
Q/A and More Information
www.audiocodes.com
or
Alan.percy@audiocodes.com