smb communications - is voip secure?

SMB Communications

Is VoIP Secure?

1 - 20

Introduction | Is VoIP Secure?

Jonathan Greenwood

Managing Director snom UK Ltd

&

Product Manager – snom ONE

Jonathan Greenwood | Is VoIP Secure?

Re-name this

presentation to…


Is your house secure?


Leave the door unlocked


Leave the window open


Leave the key under the mat

Introduction | Is VoIP Secure?


What happens?


What happens?

You will be attacked


There is no difference!


We all have email


User Name

and

Password


OR


Door, Key

and

Alarm


User Name

and

Password

[email protected]

mailto:[email protected]


Is VoIP different?


NO!


Is VoIP Secure?


Yes and No


No if you

• Leave your front door open• Leave your windows open• Tell the world your alarm code• Allow the world to guess your alarm code


There is no difference!


Deploy secure VoIP Systems!


Deploy secure VoIP Systems!

Basic IT Security


SMB – Can I do it?


Yes


SMB – Is it easy?


Very Easy


SMB – What do you need?


• Use the right equipment • Secure Telephone System• Secure IP Phones• Secure PSTN/SIP Connectivity• Security between System and Phones

• Create a basic security guide• Employ a trained reseller


What are we trying to protect

with VoIP?

Traditional telecoms are closed



IP Telephone Systems


IP Telephone Systems

Run on networks


Eavesdropping• Internal

• High risk• Listen to Management calls?


Eavesdropping• External

• Harder to do• Still possible• Man in Middle


Denial of Service (DOS)• System Attack• Flooded by hackers• Chaos OR Fraud• Can your system handle it?


Toll Fraud• Breached system• High phone bills• Who pays• Who is responsible?


Lost Voicemail + CDRs• Stolen voicemail• Company exposure• Should CDRs be available?• Who called who?


Keep everyone happy• Internal users• Home users• Road warriors• Remote offices• Accountant• Business Owner


Who cares?• IT Managers secure networks• Can IT administrators listen• VoIP – Lack of security makes great

news• Don’t allow an employee tap calls• You should care!


Back to


• Use the right equipment • Secure Telephone System• Secure IP Phones• Secure PSTN/SIP Connectivty• Security between System and Phones



IP Phone system must be able do• TLS• SRTP• HTTPS• DOS Prevention• Intrusion Prevention

• Access Lists


TLS• Transport Layer Security• Encrypts SIP packets• Similar to HTTPS• Hides IP addresses, ports• Protects the signalling


SRTP• Secure Voice (RTP)• Encrypts media• If captured you hear white noise


HTTPS• Secures the web traffic• Prevents Password loss• Man in the middle grabbing data• Would you do online banking without


DOS


DOS• Can take your entire system down• Can your IP Telephone system continue

when under attack?


Intrusion Prevention• Blocks IP Addresses (Blacklist)• Allows IP Addresses (Whitelists)• No use of CPU• No processing• Bins rogue SIP packets


Yes we do IPv6


Intruder Alert! Automatic Email Notification

From: [email protected]: Sunday, January 09, 2011 8:57 PMTo: [email protected]: SIP BlacklistBody: Address 69.61.210.157 has been blacklisted. The IP address 69.96.218.157 has been blacklisted for 1440 minutes because there were 10 unsuccessful authentication attempts (sip).


Intruder Alert! Automatic Email Notification

From: [email protected]: Sunday, January 09, 2011 8:57 PMTo: [email protected]: HTTP BlacklistBody: Address 69.61.210.157 has been blacklisted. The IP address 69.96.218.157 has been blacklisted for 1440 minutes because there were 10 unsuccessful authentication attempts (http).

Secure Phone System| snom ONE plus

snom ONE plus

• This one has all those features – and more


IP Phones must be able to do

• TLS• SRTP• HTTPS• Secure or lock down the web interface• Secure provisioning


snom 300 snom 320

snom 370

YES!

Jonathan Greenwood | Is VoIP Secure?snom 821 snom 870

snom M9(DECT)

Meeting Point

YES!


SIP trunks must

• Connect via TLS• Media capable of SRTP• HTTPS for provisioning• Or VPN (more overhead)• Or Private network


snom ONE plus

• Offers Secure SIP Trunk connectivity


SIP trunks to PSTN

• Connect via TLS• Media capable of SRTP• Internal Network only• Private network to PSTN


Internally Secure – Private communication

snom ONE plus

• Offers Secure SIP Trunk connectivity


Carrier Grade SIP Exchange Platform


• Use the right equipment • Secure Telephone System• Secure IP Phones• Secure PSTN/SIP Connectivity• Security between System and

Phones • Create a basic security guide• Employ a trained reseller


IP Phones must communicate with a Secure Telephone System

• TLS• SRTP• HTTPS• Certificates


IP Phones must communicate with a Secure Telephone System

• Install Certificates• IP Phone• IP Telephone System


Security - Not an after thought!


Auto Provision IP Phones

• Install Certificates• Telephone System Provisions the

phone• Strong passwords• HTTPS



• Lock Registration to • Phones MAC address• HTTPS Username and Password• Trusted IP Address



• Lock Registration to


This is easy - Passwords• Secure, strong passwords• Change them every month• Force secure passwords


This is easy - Passwords• Monitor passwords• Weak password


This is easy – Template Deployments• Change template deployments• Hackers target template deployments• Known passwords• Easy target


This is easy – Simple Policy• Different passwords for

• Web Interface• SIP Passwords• PIN Numbers


This is easy – Limit Dial Plans• Block numbers• Add a Pin Number


This is easy – Back up


Which Reseller?• Look for Certified Reseller Partners• Look for Manufacturer Partner Programs• Look on a Manufacturer’s website• Contact the Manufacturer – ask who?


snom Channel Partner Program• Designed for resellers• Aimed at resellers of VoIP


snom Channel Website• Aimed to support resellers• Sales and Product advice• Make resellers feel wanted• Makes for a good working relationship• Give the customer some comfort• http://www.snomchannel.co.uk

http://www.snomchannel.co.uk/


snom Certified Engineers (SCE)• Certified Resellers• Not just Technical• Sales and Support Trained• Marketing Support


What happens when it goes wrong?


Disaster can strike• A customer on an insecure PBX• Not ours • 8000 calls from midnight until 7am• Credit limit stopped at £400.00• SIP trunking provider is the good guy

here


Disaster can strike• If that was the PSTN –

• Next months bill• 1+ months to find out• Big bills• Who is responsible?


Disaster can strike• Who is responsible?

• Carriers• Poor installation• Poor password policy• Poor management


Don’t do this


Instead - Do do this


Employ • snom Certified Reseller• Trained on Sales and Support• Security aware• Backed by the Manufacturer

Deploy



Are you a Reseller?• snom Certified Engineer (SCE)?

• Join today • Receive training• Sales, Marketing and support• Priority support

• Sales• Deployment


Are you a Customer?• Look at our products

• Security is always first• 16 years in VoIP - SIP• Worldwide supply• Local UK office• We are here to help


Visit our stand – find out more

Stand 717


Thank you

Any Questions?

smb communications - is voip secure?

Technology