Vigilar’s VoIP Security Assessment: Identifying vulnerabilities in your VoIP infrastructure

VoIP networks continue to grow in popularity as the convergence of voice and data into a single network promises to reduce costs, improve quality and simplify management. The addition of voice on the network poses new challenges to the enterprise and new potential security risks arise.

In a converged VoIP deployment, where a single Ethernet cable provides both the phone service and the computer connection, significant risks arise. In particular, concerns arise around the ability to gain privileged access through publicly accessible phones, such as those found in lobbies, hotel rooms, and conference rooms.

Malicious users may be able to access the VoIP network and eavesdrop on unencrypted calls or cause an interruption of service. A more significant threat is malicious users gaining access to corporate networks through the VoIP network and, potentially accessing confidential data such as intellectual property, customer information or financial records.

Securing Voice VLANs
Vigilar can test the security of VoIP communication systems. During the assessment, Vigilar security experts will attempt to access privileged information or systems by exploiting weaknesses in the VoIP network.

Detailed Reporting
Once the VoIP Security Assessment is complete, Vigilar will deliver a complete report containing prioritized, actionable recommendations for improving the security posture of the VoIP infrastructure. This detailed deliverable will also include recommendations from a technical and management perspective for strengthening the security of your systems.

Vigilar VoIP Security Assessment Benefits

1. Address government and industry regulatory compliance requirements
2. Discover VoIP network vulnerabilities and risks to your business systems
3. Validate the effectiveness of current security safeguards
4. Identify remediation steps to help prevent network compromise
5. VoIP Hopping
6. VoIP Hopper

To discover whether a network may be vulnerable to potential VoIP attacks, Vigilar developed an assessment method called VoIP Hopping, and an automated assessment tool called the VoIP Hopper.

Released as open source, the VoIP Hopper tool helps IT administrators test their networks to determine if VoIP Hopping possible on their network. The VoIP Hopper enables administrators to quickly and easily test the protection controls of a Layer 2 network to see if a regular PC can mimic the behavior of an IP phone and thereby gain access to the IP Phone network.

1. Enable Port Security or MAC Address Filtering
2. Enable 802.1x
3. Proper firewall placement or network segmentation