IP telephony opens networks to hack attacks

Companies installing IP telephony face a growing threat of hacking, according to Giga Information Group.

Many organisations delay or ignore the requirement for stringent security measures to protect their networks when evaluating IP PBX systems. Applications such as call servers and IP telephones or softphones offer an entry point for back-door attacks to the network.

"Inadequate security measures put companies at risk of illegal long distance calls, conversation eavesdropping and recording, denial of service on phone systems and data network access through IP telephony ports," said Elizabeth Herrell, Giga's director of research.

Hackers who break into a phone system could use it as a link in a chain of compromised systems, making them difficult to track.

Firewall security may be compromised as the huge overhead it causes affects quality of service (QoS), resulting in voice traffic delays.

Herrell said many companies mistakenly believe current firewall security to be adequate for IP telephony. She added that voice traffic had to be filtered across the Wan or Lan to avoid unnecessary security breaches.

But Neil Barrett, technical director of Information Risk Management, an independent security consultancy, said firewalls were not necessarily needed to secure IP telephony between a network switch and the IP tunnelling device.

"You can just have restricted controls on it," he said.

Barrett said the best advice to network managers was to set up a tiered DMZ (demilitarised zone) in networks with VoIP. (See below.)

Traditionally a company would have an internal network and an external network and have a DMZ in-between acting as a buffer.

"The chances are that you have to do that anyway," said Barrett, "Bbcause you have to set up something like a dial-in network point."

Herrell recommends companies take security measures such as call detail recording, telephone number capture and expanded alarm capabilities to combat the threat of hacking.

Barrett added that IP telephony should be separated out from the network and monitored using an intrusion detection system.

"If the only connection point on the internal network is the handset, you aren't going to hack it," said Barrett.

How to protect your IP telephony project

A tiered DMZ uses multiple DMZs that are set up in a network with minimal trust relationships between them and a screen between the lowest DMZ and the internal network.

"That way you have got multiple points at which you can control it," said Barrett.

An IP gateway would connect to the internet, then connect to a telephony IP tunnel device, and that device connects to the switchboard.

The telephony DMZ would have a switchboard that connects to the user's handsets.

The switchboard then connects to an IP tunnelling device, which goes through to the switch.