Wholesale VoIP Featured Article
Stop Eavesdropping the VoIP Way
Eavesdropping has been a problem for most every communications method ever since Og tried to tell Thag about how he starts his fire so readily. The advance to voice over Internet protocol (VoIP) hasn't changed the idea much; it only made the tools required for eavesdropping as advanced as the communications upon which snooping is done. Thankfully, there are several good ways to protect a VoIP system from eavesdropping, some of which we'll check out now.
First, never deploy a VoIP phone system with its default settings. Default settings are comparatively easy to look up online, and if default settings are left in play, the keys to the kingdom could be handed over in one easy swoop. So be sure to run changes, either manually or via some kind of policy change.
Second, check with handset vendors. Advisories from vendors are meant to clue in users about potential security issues. Indeed, a 2015 warning about Cisco (News - Alert) IP phones and eavesdropping came from the vendor, so being ready on that front could prevent problems before becoming serious.
Third, update any applicable session border controllers (SBCs) in the system. Since these systems have an impact on traffic flow, these may be a weak point for outside intruders to attack. However, keeping up with updates here should have a positive effect, so when updating antivirus systems and the like, update the SBCs as well to help keep on a more regular schedule.
Fourth, look into encrypting VoIP calls. VoIP calls, in a sense, really aren't that different from any other online traffic. Several VoIP providers actually offer encryption as an inducement to buy, and some industries require encryption to comply with federal regulations.
Lastly, consider a completely separate, and appropriately hardened, network for VoIP traffic. Using an IP-based private branch exchange (PBX (News - Alert)) system can allow hardware to just power PBX software, reducing the number of potential failure points. Using firewalls and access control lists can also help.
Not every business is really a target of VoIP eavesdropping, so this may seem like overkill to some. That being said, it's hard to tell which businesses are and aren't being targeted, so anyone who's got any traffic going out over VoIP—and that's an increasingly large number of firms these days—is a potential target. That makes protection more of a preventative measure, almost like buying insurance, and few question the wisdom of that move.
Protecting a business against VoIP eavesdropping may seem like an excess of caution, but the alternative—explaining to customers how data was stolen—isn't much better. An ounce of prevention is still worth a pound of cure, and VoIP eavesdropping is no different.
Edited by Alicia Young