Securing VoIP Networks: Threats, Vulnerabilities, Countermeasures / Edition 1

Paperback (Print)
Used and New from Other Sellers
Used and New from Other Sellers
from $1.99
Usually ships in 1-2 business days
(Save 96%)
Other sellers (Paperback)
  • All (11) from $1.99   
  • New (6) from $39.39   
  • Used (5) from $1.99   

Overview

In Securing VoIP Networks, two leading experts systematically review the security risks and vulnerabilities associated with VoIP networks and offer proven, detailed recommendations for securing them. Drawing on case studies from their own fieldwork, the authors address VoIP security from the perspective of real-world network implementers, managers, and security specialists. The authors identify key threats to VoIP networks, including eavesdropping, unauthorized access, denial of service, masquerading, and fraud; and review vulnerabilities in protocol design, network architecture, software, and system configuration that place networks at risk. They discuss the advantages and tradeoffs associated with protection mechanisms built into SIP, SRTP, and other VoIP protocols; and review key management solutions such as MIKEY and ZRTP. Next, they present a complete security framework for enterprise VoIP networks, and provide detailed architectural guidance for both service providers and enterprise users.

1 Introduction

2 VoIP Architectures and Protocols

3 Threats and Attacks

4 VoIP Vulnerabilites

5 Signaling Protection Mechanisms

6 Media Protection Mechanisms

7 Key Management Mechanisms

8 VoIP and Network Security Controls

9 A Security Framework for Enterprise VoIP Networks

10 Provider Architectures and Security

11 Enterprise Architectures and Security

Read More Show Less

Product Details

  • ISBN-13: 9780321437341
  • Publisher: Addison-Wesley
  • Publication date: 8/15/2007
  • Edition description: New Edition
  • Edition number: 1
  • Pages: 384
  • Sales rank: 926,106
  • Product dimensions: 6.99 (w) x 9.28 (h) x 0.69 (d)

Meet the Author

Peter Thermos is CTO of Palindrome Technologies, which provides information

security consulting services to government and commercial organizations.

Peter started his career at Bellcore (now Telcordia) as a member of the technical

staff and later as a principal technical expert on key information security and

assurance tasks. He is a frequent speaker at conferences and industry forums

including the IEEE, MIS, IEC, ISACA, VON, and others. Peter is also known

for his contributions to the security community for discovering software

vulnerabilities, the release of SiVuS (The First VoIP Vulnerability Scanner)

and the vopsecurity.org Forum. Peter holds a Masters Degree in Computer

Science from Columbia University where he is currently furthering his

graduate studies.

Ari Takanen is founder and CTO of Codenomicon. Since 1998, Ari has

focused on information security issues in next-generation networks and security

critical environments. He began at Oulu University Secure Programming Group

(OUSPG) as a contributing member to PROTOS research that studied information

security and reliability errors in WAP, SNMP, LDAP, and VoIP implementations.

Ari and his company, Codenomicon Ltd. provide and commercialize automated

tools using a systematic approach to test a multitude of interfaces on mission-critical

software, VoIP platforms, Internet-routing infrastructure, and 3G devices.

Codenomicon and the University of Oulu aim to ensure new technologies are

accepted by the general public, by providing means of measuring and ensuring

quality in networked software. Ari has been speaking at numerous security and

testing conferences on four continents and has been invited to speak at leading

universities and international corporations.

Read More Show Less

Read an Excerpt

PrefacePreface

Communication between people has changed with the invention of the telephone. The ability to communicate across continents in real-time has also helped our society in several dimensions including entertainment, trade, finance, and defense. But this new capability did not come without an investment. Building an international telephony infrastructure has required the cooperation of both commercial and government organizations to evolve into what it is today. It has also led to the formation of international standard bodies that both direct and support the industry towards an interoperable communication networks.

IP networks are the next step from the traditional telecommunications. For a while, IP family of protocols was only used in the Internet, and the main applications were file transfers and e-mail. With the World Wide Web, the Internet changed into a global and always open information distribution channel. And finally with the advent of VoIP, the Internet is becoming a real-time communication media that integrates with all the earlier multimedia capabilities.

Traditional telecommunication networks are critical to the survival of our society. The PSTN is a closed network and its operational intricacies are known to a few select individuals who have devoted much of their lives to building it. Although operations in PSTN are not entirely a secret, they were and still remain proprietary for several reasons such as competitive advantage and national defense. The PSTN was and remains a closed infrastructure that concentrated its intelligence in its core network elements and left the edge devices very simplistic. The equipment and resources to operate a TDMnetwork require a substantial financial investment. This lack of direct access to core network elements from subscribers and the high price of connectivity alleviated the risk for attacks. Ergo, subscribers demonstrate greater trust for communications through the PSTN compared to the Internet. This is a misconceived trust once you start analyzing the PSTN components and protocols and realize the lack of protection mechanisms.

In the earlier days of the Internet, security was appalling. The Internet was an open network where anyone could attack anyone anonymously and many of the attack tools were, and still are, available. As such, security research became a standard practice in government, commercial, and academic worlds with globally known research groups in organizations such as DARPA, DISA, CERIAS, MIT CIS, Bellcore, Bell Labs, and many others. Things became a bit more complicated with the transition of critical services such as telephony on the Internet along with other multimedia applications such as video and gaming. And due to the performance, availability, and privacy requirements of these applications, their security requires new approaches and methods compared to traditional IP security. Nevertheless the traditional security objectives apply such as confidentiality, integrity, and availability of services.

Before gaining the interest of the academia, the topic of Internet security has been a secret science, or not even a science. The security field was a competition between hackers and system administrators, in a constant race of "patch and penetrate." Very few people knew what they actually were fixing in the systems when they applied new security updates or patches. And very few hackers understood what the attack tools actually did when they penetrated the services they wanted access to. People spoke of threats, attacks, and security measures that needed to be applied to protect from these attacks. The actual core reasons that enabled the existence of the attacks were not understood. For most of the users of communication systems, these weaknesses were hidden in complex, hard-to- understand protocols and components used in the implementations.

VoIP has been discussed at length in many textbooks and thus we avoid long discussions of its origins and details on introductory concepts. Instead the book focuses on the details associated with the security of multimedia communications including VoIP. Our purpose is to extend your knowledge of vulnerabilities, attacks, and protection mechanisms of VoIP and generally Internet multimedia applications. We deviate from listing a series of security tools and products and instead provide detailed discussions on actual attacks and vulnerabilities in the network design, implementation, and configuration and protection mechanisms for signaling and media streams, architectural recommendations, and organizational strategy—thus enabling you to understand and implement the best countermeasures that are applicable to your environment.

The book is structured so that we start by briefly explaining VoIP networks, and then go through the threats, attacks, and vulnerabilities to enable you to understand how VoIP attacks are made possible and their impact. The book discusses in great detail various attacks (published and unpublished) for eavesdropping, unauthorized access, impersonation, and service disruption. These attacks are used as proof of concept, but at the same time they also expose the reader to real-life weaknesses and serve as a mechanism to promote comprehension. In addition, this book discusses VoIP vulnerabilities, their structure, and their categorization as they have been investigated in enterprise and carrier environments.

Following VoIP vulnerabilities and attacks, the book discusses in great detail a number of protection mechanisms. In order to protect against current and emerging threats, there a number of areas that need to be considered when deploying VoIP. The book provides extensive coverage on the intricacies, strengths, and limitations of the protection mechanisms including SIPS, H.235, SRTP, MIKEY, ZTP, and others. Furthermore, the book focuses on identifying a VoIP security framework as a starting point for enterprise networks and provides several recommendations. Security architectures in enterprise and carrier environments are also discussed.

This first edition of the book aims in establishing the landscape of the current state of VoIP security and provides an insight to administrators, architects, security professionals, management personnel, and students who are interested in understanding VoIP security in detail.

© Copyright Pearson Education. All rights reserved.

Read More Show Less

Table of Contents

Chapter 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

Chapter 2: VoIP Architectures and Protocols . . . . . . . . . . . . . . . . . .29

Chapter 3: Threats and Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

Chapter 4: VoIP Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . .127

Chapter 5: Signaling Protection Mechanisms . . . . . . . . . . . . . . . . .165

Chapter 6: Media Protection Mechanisms . . . . . . . . . . . . . . . . . . .217

Chapter 7: Key Management Mechanisms . . . . . . . . . . . . . . . . . . .231

Chapter 8: VoIP and Network Security Controls . . . . . . . . . . . . . .263

Chapter 9: A Security Framework for Enterprise VoIP Networks . .297

Chapter 10: Provider Architectures and Security . . . . . . . . . . . . . . .315

Chapter 11: Enterprise Architectures and Security . . . . . . . . . . . . . .334

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .345

Read More Show Less

Preface

Preface

Communication between people has changed with the invention of the telephone. The ability to communicate across continents in real-time has also helped our society in several dimensions including entertainment, trade, finance, and defense. But this new capability did not come without an investment. Building an international telephony infrastructure has required the cooperation of both commercial and government organizations to evolve into what it is today. It has also led to the formation of international standard bodies that both direct and support the industry towards an interoperable communication networks.

IP networks are the next step from the traditional telecommunications. For a while, IP family of protocols was only used in the Internet, and the main applications were file transfers and e-mail. With the World Wide Web, the Internet changed into a global and always open information distribution channel. And finally with the advent of VoIP, the Internet is becoming a real-time communication media that integrates with all the earlier multimedia capabilities.

Traditional telecommunication networks are critical to the survival of our society. The PSTN is a closed network and its operational intricacies are known to a few select individuals who have devoted much of their lives to building it. Although operations in PSTN are not entirely a secret, they were and still remain proprietary for several reasons such as competitive advantage and national defense. The PSTN was and remains a closed infrastructure that concentrated its intelligence in its core network elements and left the edge devices very simplistic. The equipment and resources to operate a TDM network require a substantial financial investment. This lack of direct access to core network elements from subscribers and the high price of connectivity alleviated the risk for attacks. Ergo, subscribers demonstrate greater trust for communications through the PSTN compared to the Internet. This is a misconceived trust once you start analyzing the PSTN components and protocols and realize the lack of protection mechanisms.

In the earlier days of the Internet, security was appalling. The Internet was an open network where anyone could attack anyone anonymously and many of the attack tools were, and still are, available. As such, security research became a standard practice in government, commercial, and academic worlds with globally known research groups in organizations such as DARPA, DISA, CERIAS, MIT CIS, Bellcore, Bell Labs, and many others. Things became a bit more complicated with the transition of critical services such as telephony on the Internet along with other multimedia applications such as video and gaming. And due to the performance, availability, and privacy requirements of these applications, their security requires new approaches and methods compared to traditional IP security. Nevertheless the traditional security objectives apply such as confidentiality, integrity, and availability of services.

Before gaining the interest of the academia, the topic of Internet security has been a secret science, or not even a science. The security field was a competition between hackers and system administrators, in a constant race of "patch and penetrate." Very few people knew what they actually were fixing in the systems when they applied new security updates or patches. And very few hackers understood what the attack tools actually did when they penetrated the services they wanted access to. People spoke of threats, attacks, and security measures that needed to be applied to protect from these attacks. The actual core reasons that enabled the existence of the attacks were not understood. For most of the users of communication systems, these weaknesses were hidden in complex, hard-to- understand protocols and components used in the implementations.

VoIP has been discussed at length in many textbooks and thus we avoid long discussions of its origins and details on introductory concepts. Instead the book focuses on the details associated with the security of multimedia communications including VoIP. Our purpose is to extend your knowledge of vulnerabilities, attacks, and protection mechanisms of VoIP and generally Internet multimedia applications. We deviate from listing a series of security tools and products and instead provide detailed discussions on actual attacks and vulnerabilities in the network design, implementation, and configuration and protection mechanisms for signaling and media streams, architectural recommendations, and organizational strategy—thus enabling you to understand and implement the best countermeasures that are applicable to your environment.

The book is structured so that we start by briefly explaining VoIP networks, and then go through the threats, attacks, and vulnerabilities to enable you to understand how VoIP attacks are made possible and their impact. The book discusses in great detail various attacks (published and unpublished) for eavesdropping, unauthorized access, impersonation, and service disruption. These attacks are used as proof of concept, but at the same time they also expose the reader to real-life weaknesses and serve as a mechanism to promote comprehension. In addition, this book discusses VoIP vulnerabilities, their structure, and their categorization as they have been investigated in enterprise and carrier environments.

Following VoIP vulnerabilities and attacks, the book discusses in great detail a number of protection mechanisms. In order to protect against current and emerging threats, there a number of areas that need to be considered when deploying VoIP. The book provides extensive coverage on the intricacies, strengths, and limitations of the protection mechanisms including SIPS, H.235, SRTP, MIKEY, ZTP, and others. Furthermore, the book focuses on identifying a VoIP security framework as a starting point for enterprise networks and provides several recommendations. Security architectures in enterprise and carrier environments are also discussed.

This first edition of the book aims in establishing the landscape of the current state of VoIP security and provides an insight to administrators, architects, security professionals, management personnel, and students who are interested in understanding VoIP security in detail.

© Copyright Pearson Education. All rights reserved.

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star

(0)

4 Star

(0)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)