Federal agencies and other organizations that are considering switching their telephone systems to Voice Over Internet Protocol (VOIP) should proceed with caution and carefully consider the security risks, says a recent report* by the National Institute of Standards and Technology (NIST).
VOIP is an important emerging technology that makes it possible to place telephone calls using a broadband Internet connection rather than traditional, circuit-based telephone lines. While it shows promise for lower cost and greater flexibility, VOIP has a very different architecture than circuit-switched telephony, and these differences result in significant security issues.
"Administrators may mistakenly assume that since digitized voice travels in packets, they can simply plug VOIP components into their already-secured networks and remain secure. However, the process is not that simple," says the NIST report. Implementing common security measures into VOIP, such as firewalls and encryption, can cause poor voice quality and blocked calls if not done carefully and with the proper equipment. Designing, deploying and securely operating a VOIP network is a complex effort that requires careful preparation, says the report.
NIST recommendations to help in the transition to secure VOIP include: develop appropriate network architecture, including separate voice and data networks where feasible and practical; ensure that the organization can manage and mitigate risks to their information, system operations, and continuity of essential operations when deploying VOIP systems; use and routinely test the security features included in VOIP systems; update VOIP software regularly and frequently; and, since worms, viruses and other malicious software are common on PCs connected to the Internet, do not use "softphone" systems that implement VOIP using a PC with a headset and special software.
*D.Kuhn, T. Walsh, S. Fries, Security Considerations for Voice Over IP Systems, NIST Special Publication 800-58, is available at
http://csrc.nist.gov/publications/nistpubs/index.html
Source: NIST
Related stories:
Intel Outlines Plans for New Category of Smarter, Purpose-Built 'System on Chip' Designs
As Internet access continues to be added to all kinds of computers and devices, Intel executives outlined a plan to use its chip design expertise, factory capacity, advanced manufacturing techniques and the economics of Moore's Law to usher in a new category of highly integrated, purpose-built and Web-savvy System on Chip (SoC) designs and products. The company also unveiled its first eight such products under its Intel EP80579 Integrated Processor family for security, storage, communications, and industrial robotics.
Motorola Demonstrates World's First WiMAX 802.16e Mobile Handoffs in Downtown Chicago
Motorola presented a mobile WiMAX experience last night that included live handoffs during an exclusive cruise along the Chicago River for media and industry analysts in town to attend WiMAX World USA. Attendees experienced uninterrupted mobile applications including web browsing, voice over IP (VoIP) calls, video streaming and MobiTV while moving past access point sites along the route of the cruise.
Microsoft a Credible VOIP Supplier? Maybe Someday
First it will have to prove that its technologies can deliver the kind of reliability and security that large enterprises expect of their voice communications equipment.
Force10 Networks Looks to Midrange
The company is hoping to extend its reach to high-end LAN switching to gain a foothold in midsize data centers and enterprise campus networks.
Packeteer, Microsoft Team Up on Branch-Office Box
The all-in-one iShaper appliance offers WAN optimization and quality-of-service prioritization in a unified platform, Packeteer says.
LignUp Aligns VOIP, SOA with App Dev Tools
The startup's updated Communications Application Server aims to simplify adding VOIP functions to Web 2.0 applications.
Extreme Pumps Up the Network
The company is offering software and switching options designed to offer richer functionality at a lower cost.
NEC Looks to Build a 'Virtual' Client Network
The company is offering a new management package called Virtual PC Center, which will combine thin client PCs, servers, a software suite and virtualization technology from VMware.