common misconceptions alan d. percy director of market development [email protected] the...
TRANSCRIPT
![Page 1: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/1.jpg)
![Page 2: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/2.jpg)
Common Misconceptions
Alan D. PercyDirector of Market [email protected]
The Truth of Enterprise SIP
Security
![Page 3: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/3.jpg)
3
Threat is widely recognized
“Security Is IP Networking's Downside”Gartner Report, 2006
“SIP is not an easy protocol to secure.”RFC 3261
“T.J. Max theft is believed largest hack ever”AP Newswire, March 30, 2007
“…SIP is vulnerable to certain attacks.”RFC 3329
![Page 4: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/4.jpg)
4
Known Threats
• Known SIP Security Threats:– Theft of services (unauthorized use of your network)– Recording and eavesdropping– Call Detail Capturing (tracking who you call and for
how long)– Spoofing and Man-in-the-middle (Phone Phishing)– Denial of Service Attacks– Registration Flooding– Malformed Messages– Unsolicited incoming calling (SPIT)– Trojan horse devices– Viruses and Worms– and more.
![Page 5: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/5.jpg)
5
Three Misconceptions about Security
![Page 6: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/6.jpg)
6
Misconception #1
Eavesdropping VoIP
is easy
![Page 7: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/7.jpg)
7
IP-PBX SIP Architecture
Media Gateway
LAN Switch
PSTN
PSTN SIP
SIP Phones
SIP
T1/E1
Secure Facility
Secured with
SIP/TLSSRTP
IP-PBX
![Page 8: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/8.jpg)
8
Points of Risk
Signaling
Media
IP
Management
SIP/TLS
SRTP
HTTPS
![Page 9: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/9.jpg)
9
Misconception #2
SIP Trunking is easy to secure with a
SIP Firewall
![Page 10: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/10.jpg)
10
SIP Trunking is at Risk
• SIP Trunking without correct protection is open to DoS attack, theft of service and other threats too!
![Page 11: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/11.jpg)
11
Protecting Against DoS Attacks
One of two approaches:
1. Use PSTN Trunking• Cannot execute a DoS attack over a PSTN circuit• Media gateway insulates enterprise from outside world• Enterprise uses PSTN as a “moat” around SIP Island
2. Secure SIP Trunks with SBC• Firewalls do not fully protect against DoS• Many SIP Security devices don’t support SIP/TLS or
SRTP• Protect with an Enterprise-class Session Border
Controller
![Page 12: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/12.jpg)
12
SBC – Includes DoS Filtering and Rate Limiting
ICMP
ARP Request
ARP Response
DTMF
SIP - Invite
SIP - Register
SIP- Response
SIP - Unknown
SIP - Other
SIP - Register
SIP - Other
DoS Filters
Un-Solicited SIP Traffic
Established SIP Signaling “Pinholes”
nRT - HI
nRT - LO
Best Effort
Port
SIP App Server
Traffic Management/Shaping maintain per queue rate, size and discard policy
RADIUS
VRRP
Dispatcher
Rate Limiting &Prioritization
Application Intelligence
![Page 13: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/13.jpg)
13
Misconception #3
Security is very expensive
![Page 14: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/14.jpg)
14
AudioCodes Solutions with Security
Mediant 2000Scalable Digital Media GatewayMediant 1000
Modular Media Gateway
MediaPack MP-11xAnalog Media Gateway
All support HTTPS, SIP/TLS, and SRTP
Mediant 1000 MSBGwith Integrated SBC
![Page 15: Common Misconceptions Alan D. Percy Director of Market Development Alan.percy@audiocodes.com The Truth of Enterprise SIP Security](https://reader035.vdocuments.mx/reader035/viewer/2022062715/56649db55503460f94aa67ec/html5/thumbnails/15.jpg)
15
Good Security Practices for Enterprises
Deploy encryption security (SIP/TLS and SRTP) Secure the front door (trunk lines)
PSTN Trunking or Enterprise SBC
Secure the back door (set and manage the passwords) Control access Manage software on
all the devices in the system
Eliminate WiFi access Keep an audit trail