When it comes to a VoIP network, the news is usually pretty good. When it comes to high-bandwidth, low-latency environments, there is almost no difference in the quality between an unencrypted VoIP call and the same call that is made over an SSL. What's even cooler is that a VoIP call made over a typical broadband connection, when encrypted, is of a better quality than the messages that were unencrypted.

VoIP has arrived as a mainstream application and equipment sales have topped over one billion dollars this year. In fact, within the next eight years, this system will account for more than ninety percent of the market. However, there are some security risks associated with a VoIP network.

Securing Your Network

Security is a top priority when you are replacing the world's oldest, largest and most changeable communication network. No individual security measure can eliminate an attack against your VoIP network, but there are things you can do to make the attacks useless.

The main type of fraud is identity and information theft with your VoIP network. Many attacks are focused on the VoIP endpoints. The operating systems, internet protocols, applications and management interfaces of the VoIP hard phones and computer running softphones all stand the chance of unauthorized access. This can be done through viruses and worms and may also create a denial-of-service attack that exploits common Internet protocols and VoIP protocols as well.

The protocol your VoIP network has does not adequately provide call-party authentication. The end-to-end integrity protection and confidentiality measures are also not adequately set up. Until these areas have security features, attackers have many vectors they can use to exploit. Protocols do not encrypt the call-signally packets and voice streams, so identities, credentials and phone numbers of callers can be captured using traffic-collection tools. These tools are known as sniffers.

The attacker can then use this information to impersonate a user to a customer representative or self-service portal, where he can change the calling plan to permit 900 numbers or the international plan. A business's personal information can also be obtained by listening to voice mail messages that are sent over the network.

All of these areas need to be thoroughly thought through and systems implemented to ensure control over the fraudulent people that exist in this crooked world today. Do everything you can to be sure this doesn't happen to you!