Are you using Voice over Internet Protocol (VoIP) services for your organisation’s communications? It’s certainly a very cost effective, flexible and scalable network solution for businesses big and small. However, as with any other online technology, VoIP can be a target for hackers and cyberattack, exposing organisations to fraud and other threats.
UK businesses appear to be particularly prone to this kind of cyberthreat. A study by cybersecurity experts Nettitude observed a large amount of VoIP attacks worldwide in the first quarter of last year, with the majority against UK servers. 88 per cent of these attacks took place out of regular working hours, and many started just minutes after a new server went live.
Until recently there was a general lack of awareness about these kinds of attacks and the impact on businesses, in this post we hope to address this and provide some support for those organisations that are vulnerable to attack.
Common threats to your VoIP system
The following categories of threats have been identified by the Voice over IP Security Alliance (VOIPSA):
Social threats: Social threats can be interpreted as the misrepresentation of identity, authority, rights and content.
Eavesdropping: In this threat category, malicious users are able to monitor VoIP communications between two or more VoIP end points.
Interception and modification: This category refers to threats where a malicious user may have full access to the communication signal between two or more parties.
Service abuse: This category is one of the most common amongst attackers. Premium Rate Service (PRS) fraud is becoming more and more prevalent.
Intentional interruption of service: VoIP services are subject to denial of service (DoS) attack and resource exhaustion.
Other interruptions of service: This category of threat relates to physical threats such as loss of power.
As with any other cybersecurity threat, raising awareness is part of the solution. Many organisations are susceptible to attack because their employees are unaware of the risks and the shape an attack might take. With this information it becomes easier to implement cybersecurity prevention strategies, and also helps employees to spot suspicious activity before VoIP systems are compromised.
The impact of an attack on VoIP systems will vary depending on what is targeted, but includes:
Finance loss: One of the most common reasons for a VoIP security breach is so that attackers can make long distance or premium rate calls.
Denial of service: The performance of your VoIP system can be affected by numerous failed attempts to log in and register. This could make the service unavailable for your legitimate users.
Data breach: If other systems such as administration, billing or CRMs are integrated with your VoIP system, this data could be accessed, including personal details such as phone numbers, email addresses and other confidential information.
These are all compelling reasons to put in place robust cybersecurity strategies that protect your VoIP network. Here’s what we recommend:
VoIP security tips to implement today
Password protection: Weak passwords are an easy entry point, but hackers can also intercept any password, PIN or key if they are shared over a VoIP channel. VoIP calls and messages exist as data packets that are sent over the network, these can be intercepted and converted from audio into text. Organisations should protect themselves by ensuring that passwords are only shared in a secure way, not via email or over the VoIP network.
VoIP-ready firewalls: Check that you have an appropriate firewall installed to protect your VoIP system, one that manages the added risks of IP-based telephony. Your VoIP provider should have this installed already.
Encryption tools: If you are particularly concerned about eavesdropping, check to see whether your VoIP service comes with encryption tools. If not, request that these are installed.
VPN: A Virtual Private Network (VPN) can be used with your VoIP network and this will encrypt all data being transferred across your network.
24/7 monitoring: With the figures from Nettitude’s study showing that 88 per cent of attacks happen out of working hours (when IT staff are unlikely to be at their desks) it makes sense to use a managed IT service that can monitor your network 24/7.
Read more: http://www.itproportal.com/2016/04/17/5-voip-security-tips-every-business-should-implement/