Downloaded 60 times
Uploaded byVoxeo Corp
Securing Unified Communications Systems
The document outlines best practices for securing VoIP and IP communications, emphasizing the importance of understanding the ecosystem, endpoints, media, signaling, and identity. It discusses various threats such as toll fraud and identity theft, along with solutions involving encryption and strong authentication. Additionally, it raises concerns about cloud reliability and vendor responsibilities in terms of availability and security.
More Related Content
Similar to Securing Unified Communications Systems
Securing Unified Communications Systems
- 1. Securing Communications! SpeechTEK NewYork 2010! Dan York, CISSP Director of Conversations, Voxeo Best Practices Chair, VoIP Security Alliance Author, Seven Deadliest UC Attacks!
- 2. About Dan York! www.voipsa.org www.voxeo.com www.blueboxpodcast.com www.7ducattacks.com © Voxeo Corporation
- 3. About Voxeo! Founded in 1999 World’s largest hosted VoiceXML and CCXML platform – Over 82,000 hosted ports globally; hundreds of premise deployments Over 150,000 developers using Voxeo platforms The Voxeo difference: Unlocked Communications, Customer Obsession Teams, Communications Passion www.voxeo.com © Voxeo Corporation
- 4. The Change VoIPBrings! SIP SIP Proxy Proxy A SIP B SIP SIP Alice Bob Media (RTP, MSRP, etc.) © Voxeo Corporation
- 5. The Larger Reality! SIP SIP SIP SIP SIP Proxy Proxy Proxy Proxy Proxy A SIP B SIP C SIP D SIP N SIP Internet SIP Media Media Alice Proxy Proxy Bob Media A Media B Media © Voxeo Corporation
- 6. Once Upon ATime! PSTN PBX Gateways Physical Voicemail Wiring © Voxeo Corporation
- 7. 1. Understand YourEcosystem! Mobile Devices IM Application Internet Servers Networks Operating Systems PSTN IP-PBX VoIP Gateways Web IP Social Firewalls Servers Network Networks Physical Directory Voicemail Wiring Servers Desktop Email PCs Database Servers CRM Servers Systems © Voxeo Corporation
- 8. 2. Understand YourEndpoints! IP Phones, Smartphones, Softphones What services are running on them? Default passwords? How do you patch/secure them? © Voxeo Corporation
- 9. 3. Secure YourMedia! SIP SIP SIP Proxy Proxy Proxy A SIP B SIP N SIP SIP Alice Eve Bob Media Media © Voxeo Corporation
- 10. Secure Media –Hop By Hop! Internet Media Media Alice Proxy Proxy Bob Media A Media B Media © Voxeo Corporation
- 11. Secure Media –End to End! Internet Media Media Alice Proxy Proxy Bob Media A Media B Media © Voxeo Corporation
- 12. 4. Secure YourSignalling! SIP SIP SIP Proxy Proxy Eve Proxy A SIP B SIP SIP N SIP SIP Alice Bob Media © Voxeo Corporation
- 13. Signalling Attacks! Toll Fraud Identity Theft © Voxeo Corporation
- 14. Traditional Telephony! Internet Carrier PSTN PBX Corp HQ © Voxeo Corporation
- 15. IP Communications! ITSP Internet PBX PSTN Corp HQ © Voxeo Corporation
- 16. Failover! PBX ITSP Corp HQ Internet PSTN PBX Office A © Voxeo Corporation
- 17. Redundancy / Geography! ITSP (Boston) Internet PBX ITSP (Paris) PSTN Corp HQ ITSP (Tokyo) © Voxeo Corporation
- 18. 5. Secure YourPSTN Connectivity! Attacks • Toll Fraud • Denial of Service • Spam Solutions • Encryption • Strong Authentication • Transport Security © Voxeo Corporation
- 19. 6. Secure YourIdentity! Attacks • Fraud • Identity Theft • Social Engineering Solutions • Education • Lock Down Spoofing • Strong Identity © Voxeo Corporation
- 20. 7. Secure DistributedSystems! Laptop UC client WiFi UC System Firewall Internet Café Router Corp HQ Mobile Data Network Mobile UC client © Voxeo Corporation
- 21. How Do YouSecurely Federate?! Internet Corporate Corporate Network Network UC UC UC UC System System System System Corp HQ Office A Corp HQ Office A Company A Company B © Voxeo Corporation
- 22. What if theCloud Isnʼt There?! Corporate Internet Network IVR Voicemail IM IM IM Presence Presence Presence Call Call Call Control Control Control Corp HQ Office A Office B PSTN © Voxeo Corporation
- 23. Questions About theCloud! What kind of availability guarantees / Service Level Agreements (SLAs) does the platform vendor provide? What kind of geographic redundancy is built into the underlying network? What kind of network redundancy is built into the underlying network? What kind of physical redundancy is built into the data centers? What kind of monitoring does the vendor perform? What kind of scalability is in the cloud computing platform? What kind of security, both network and physical, is part of the computing platform? Finally, what will the vendor do if there is downtime? Will the downtime be reflected in your bill? © Voxeo Corporation
- 24. The Way ItUsed To Be! © Voxeo Corporation
- 25. Today...! ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP PSTN ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP ITSP © Voxeo Corporation
- 26. Resources! VoIP Security Alliance • www.voipsa.org • www.voipsa.org/blog Hacking Exposed: VoIP • www.hackingvoip.com Seven Deadliest Unified Communications Attacks • www.7ducattacks.com © Voxeo Corporation