Mark, Intel96 -
There are a lot of conflicting opinions floating around as to the
security of VoIP systems. One of the things that you need to do is
establish whether you are dealing with a bounded system, (i.e. an
enterprise PBX replacement) or an unbounded one (i.e. SKYPE) as they
have considerable differences in both their vulnerability and the
resources available to deal with issues. Secondly, security of VoIP is
not a single dimensional problem. Many of the issues of protecting VoIP
occur a layers far below the application layer which is where VoIP
lives. So, you need to examine the issue from a systems approach not
simply a point solution for VoIP. Finally, there is a great deal more to
providing SYSTEMIC protection beyond simply protecting the protocol.
This includes things like the provisioning of the endpoints, the control
of and validation of the images contained in the endpoints, the
authentication and authorization schemes for the endpoints and users,
etc. If I can be of help, please feel free to contact me.
Bob
IPCBU Security Architect
Cisco Systems, Inc.
576 S. Brentwood Ln.
Bountiful, UT 84010
801-294-3034 (v)
801-294-3023 (f)
801-971-4200 (c)
rtbell@cisco.com
-----Original Message-----
From: Mark Teicher [mailto:mht3@earthlink.net]
Sent: Tuesday, July 19, 2005 16:40
To: intel96
Cc: pen-test@securityfocus.com
Subject: Re: VoIP Assessment
What specific items have you been tasked to validate?
Could be as simple as :
Are the components VoIP capable?
If so, then what protocols have been
implemented (Y/N)
If x protocol, if implemented correctly
(i.e when enabled, does it process the traffic correctly (Y/N)
If x protocol, if implemented
correctly (i.e. when x protocol is disabled, does it block
VoIP traffic inbound/outbound? (Y/N)
and so and so on
Lots of those "security" type experts will overstate the
obvious and start rattling off big words like MITM attacks,
Resource exhaustion,
H.323 attacks, SIP Overflow attacks, etc, etc, but IMHO,
simplify what the tasks are, and break those tasks into
simple steps that any former senior security consultant can
do by utilizing a checklist approach, otherwise one gets into
the battle with the "puffed out chest security wannabes "
/m
At 01:40 PM 7/19/2005, intel96 wrote:
I have been asked to look at the security of a VoIP
architecture. Has
anyone conducted a security assessment against VoIP or the
components
that make up the architecture?
Thanks,
Intel96
