Network Security: VoIP Security on Data NetworkA Guide

Errol A. Blake
4192 Medlock River Court Snellville, GA 30039 (678) 367-7170 ErrolBlake@gmail.com

ABSTRACT
Information Security has emerged as one of the biggest concerns that network administrators and other stakeholders face today. Most data custodians face Information Security risks on a daily basis; thus, it is up to Information Security professionals to research these threats and exploits to secure private information from unauthorized access and mismanagement. It can be easily stated that familiarity with a particular technology can be helpful in securing information. It can also be stated that new and emerging technologies are harder to secure, but not impossible. This paper will consider and focus on both technical and legal aspects, and approaches on how to secure Voice over Internet Protocol (VoIP) Data Networks facility to facility traffic in particular. Both technical and legal aspects are important in protecting VoIP Networks. This paper will take the following approach: The History of VoIP and short comings, Security Issues of VoIP (current gaps), Current Solutions for the current security issues, Future Solutions for VoIP security and Future concerns more specifically the passing of Communications Assistance to Law Enforcement Act (CALEA) and its impact on VoIP security. Commission (FCC), Communications Assistance to Law Enforcement Act (CALEA), Health Insurance Portability and Accountability Act (HIPAA)

1. Introduction
According to the Federal Communications Commission (FCC), Voice over Internet Protocol (VoIP) is a technology that allows one to make voice calls using a broadband Internet connection instead of a regular (or analog) phone line (Frequently Asked, 2007). Prior to comprehending how to secure VoIP networks, one must understand the technology, how it works and how it is mostly used. VoIP services convert ones voice into a digital signal that travels over the Internet. When calling a regular phone number, the signal is converted to a regular telephone signal before it reaches the destination. VoIP can allow one to make a call directly from a computer, a special VoIP phone, or a traditional phone connected to a special adapter. In addition, wireless "hot spots" in locations such as airports, parks, and cafes allow one to connect to the Internet and may enable the use of VoIP service wirelessly. According to Internet Security Systems, (2004), VoIP is an evolving telephony solution that brings voice and data traffic together on the same IP-based network. As a result, VoIP is becoming an increasingly appealing alternative for more enterprises seeking to gain cost efficiencies and enhanced features. Enterprises wishing to exploit the advantages of switching voice calls to the IP network must understand that maintaining security of those packets is an integral part of the overall VoIP deployment. Focusing on quality of service and throughput is certainly important, but ensuring the integrity of voice transmissions and guarding against malicious activities and access is crucial to the success of the evolving solution. Clearly one can see that there are issues when data is transmitted over the Internet. Data Communications and Networking, and Information Security classes have proven that the Internet is probably the most un-trusted medium through which data can be transmitted; thus, security issues are definitely involved.

Categories and Subject Descriptors

K.4 [Information Security]: Management of Information. K.4.4 [Computers and Society]: Ecommerce and Security. K.6.5 [Management of Information Systems]: Organization Security, Policy and Protection.

General Terms
Management, Performance, Security, Legal Aspects

Keywords
Information Technology (IT), Information Security (InfoSec), IP Security (IPSec), Voice Over Internet Protocol VoIP), TCP, Point to Point Protocol (PPP), VPN, VLAN, Federal Communications
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Information Security Curriculum Development Conference07, September 28-29, 2007, Kennesaw, Georgia, USA. Copyright 2007 ACM 978-1-59593-909-8/00/0007$5.00.

2. Literature Review 2.1 History

The history of VoIP is provided by whichvoip.com. It is important to note that whichvoip.com was not the first company to use the VoIP technology; a company by the name of Vocaltec claimed that honor; however whichvoip.com was founded by one of Vocaltecs key employees. This particular website clearly relates the history of VoIP: The history of VoIP shows that this technology started as far back as 1995, when a small company called Vocaltec released the first Internet phone software. This software was designed to run on a home PC and much like the PC phones used today, it utilized sound cards, microphones and speakers. The software was called Internet Phone and used the H.323 protocol instead of the SIP protocol that is more prevalent today. It was the Skype of the mid 90s. A major drawback in 1995 was the lack of broadband availability, and as such, this software used modems which resulted in poor voice quality when compared to a normal telephone call. However, this was still a major milestone as it represented the first ever IP Phone. By 1998, VoIP traffic had grown to represent approximately 1% of all voice traffic in the United States. Entrepreneurs were jumping on the bandwagon and were creating devices which enabled PC-to-phone and phone-to-phone communication. Networking manufacturers such as Cisco and Lucent introduced equipment that could route and switch the VoIP traffic and as a result by the year 2000, VoIP traffic accounted for more than 3% of all voice traffic. Now, in 2005, major voice quality issues have long since been addressed and VoIP traffic can be prioritized over data traffic to ensure reliable, clear sounding, unbroken telephone calls. Revenue from VoIP equipment sales alone are projected to reach around $3 billion this year and are being forecast to be over $8.5 billion by the end of 2008. (The History of VoIP, 2007) There are benefits to have a VoIP solution at ones home or company, for an example. One pays one low monthly fee that covers all telephone calls. At this present time there are no unexplained taxes or regulatory fees on ones telephone/Internet bill. There are no taxes charged for Internet based phone calls, which is one reason why the service is so cheap. Long distance and international calling are much cheaper, than the regular modem lines. VoIP has evolved tremendously. There was an issue of not being able to make 911 calls. In May 2005, the FCC adopted rules that respond to the threat that such misunderstandings pose to public safety. The FCC adopted rules requiring providers of interconnected VoIP services to supply 911 emergency calling capabilities to their customers as a mandatory feature of the service by November 28, 2005. (Frequently Asked, 2007) The beauty about this technology is that the Internet has no boundaries. According to whichvoip.com The Internet does not care whether you're calling someone who lives a block away or your cousin in Australia. This is why the VoIP service providers

can give you such great rates for long distance and international calls. (History of VoIP, 2007) However, there are disadvantages with VoIP. According to the FCC, If one considering replacing your traditional telephone service with VoIP, there are some possible differences, which are: some VoIP services don't work during power outages and the service provider may not offer backup power. Not all VoIP services connect directly to emergency services through 9-1-1 (this issue is being resolved, e911). Lastly, VoIP providers may or may not offer directory assistance/white page listings. (Frequently Asked, 2007) Yes, one will have to agree that one of the biggest drawbacks or short coming in the way of VoIP solution is its dependency on the Internet connection. For an example if your connection is down due to some reasons, you will probably fail to make calls. With dial up connection, you can make local calls, but if the broadband connection is down, you cannot make calls to any international location. Another important shortcoming of VoIP solution is its reliance upon power supply. Usually, a PSTN (land line) phone will keep working even the power goes off. Contrary to it, VoIP phones stops working if the power is off. This way, you may suffer some loses if your making calls that are very important. Draven, (2007) states that, The entire process of VoIP solution is attached to Internet; it may be infected by Internet viruses. Besides, Internet hacking is also one of the severe problems threatening the entire process of VoIP. While you are using this service, it is important that you consider such issues. It may help you being better prepared to meet with some shortcomings gifted by VoIP. Also, one may agree that VoIP seemingly is a revolutionary technology, and more and more businesses are leaning towards it. The fundamental rule of business is to make as much money, while spending less. Since VoIP is a hot market more and more institutions are implementing VoIP networks or using VoIP technology on their networks. A VoIP network is susceptible to the usual attacks that plague all data networks; viruses, spam, data sniffing, phishing, toll fraud, hacking attempts, hijacked calls, intrusions, mismanaged identities/ identity thefts, Denial of Service (DoS) attacks, and lost and stolen data are just a few from an evolving list.

3. Current Security Issues within VoIP

Networks Technical Aspect

The article Hype vs. reality in VoIP security enlightened some concerns about VoIP technology; where Dzucbeck, (2007) states that the issue is IP itself. IP was never designed with security in mind. The security issues with IP made VoIP networks vulnerable. VoIP as an emerging technology was created without security in mind. A possible reason for the security void in VoIP is explained as follows: VoIP networks exist and operate in a state of high vulnerability simply due to the nature of how and under what metrics they are initially deployed. Organizations deploying VoIP today initiate the process with a primary or sole focus on throughput and quality of

service. Security issues are often secondary if considered at all. Service quality is and always will be an important component of voice transmission in both analog and digital forms. However, organizations must realize that voice in a digital packet form is highly susceptible to the same or possibly greater number of attacks as the core data network (Internet Security Systems, 2004). This paper will focus on voice spam/spit, toll fraud, brute force attempt, DoS attacks, and eavesdroppers, which are prevalent security issues within vulnerable VoIP networks. To understand these issues a brief description is necessary. According to SearchVoIP.com, Voice Spam, or SPIT, is a term used in VoIP networking, in which VoIP systems are susceptible to abuse by malicious parties who initiate unsolicited and unwanted communications. Parties such as Telemarketers, prank callers, and other telephone system abusers are likely to target VoIP systems (VoIP Spam, 2007). The definition clearly shows a susceptibility problem. The conventional telephone system has a technology feature that is known as caller ID; where one can see who exactly is calling ones phone. But how can one know who is calling the VoIP network, is it a business stakeholder or unwanted spam? Toll fraud is one of the top five threats to VoIP networks. Aginsky (1995) defines toll fraud as the unauthorized use of a company's phone system. It is theft of long-distance services by a) an unrelated third party, b) a staff member of a long-distance carrier, local telco or vendor, or c) the user's staff member (Aginsky, 1995). Rather, more simplistically, toll fraud (or service) refers to unauthorized access to a legal VoIP network. After gaining access, unauthorized users make long distance calls, especially to international toll numbers. Toll frauds are known to occur mainly in the corporate setting. Brute force attempt occurs when the attacker attempts to bypass a security check by attempting possible options until finding one that works. The attacker attempts to exhaust the search space as efficiently as possible. VoIP networks are known to be particularly susceptible to DoS and Distributed DoS attacks. A Denial of Service (DoS) is an attack designed to disable or disrupt VoIP service delivery by overwhelming the network and bringing it down by sending malformed packets or by exhausting resources that flood the service until it can no longer process legitimate requests (Curran, 2007). The flooding can create resource exhaustion, long term busy signals, and force disconnects of in session calls. Lastly, eavesdropping on VoIP networks or calls takes place when unauthorized third parties monitor call signal packets. By eavesdropping, third parties can learn user names, passwords, and phone numbers thereby gaining control over calling plans, voicemail, call forwarding, and billing information. More importantly, third parties may also gain access to confidential business and personal information by eavesdropping on actual VoIP based conversations. Internet Security Systems (2004) provides a brief description as to how VoIP is susceptible. VoIP utilizes several protocols for establishing, maintaining, transporting and terminating the voice calls represented by digitized voice packets. The call or

session management protocols (Session Initiation Protocol or SIP and H.323) are responsible for establishing, maintaining and terminating the call and are susceptible to common attacks such as attempts to overflow one of the central administration/call processing and management applications buffer, which the attacker uses to establish root access.

4. Current Solutions - Technical Aspect

In the case of VoIP spam, the session initiated protocol (SIP) is the industry standard for managing VoIP calls. SIP manages VoIP calls by delivering the callers identity so that the receiving party can decide whether he or she would accept or decline the call. According to Rosenberg (2006), The basic mechanism for caller ID in the core SIP specification (RFC 3261) works much as it does in email; where the caller information has a form header field, including the address. This form of security worked well in a perfect Internet, but one knows that the Internet is not so perfect and this technology was exploited. Another caller ID security RFC was passed, known as P-Asserted-ID (RFC 3325) published in November 2002 by the IETF (Rosenberg, 2006). The P-Asserted-ID was based on a Network-verified caller ID services. Rosenberg (2006) states further, The assertions of identity are not cryptographic. There is no way to securely verify that the domain of the caller is the one that asserted the identity present in the message, thus in larger interconnected networks, the value of P-Asserted-ID was based on trustworthiness of the least trustworthy network in the group. In spite of the progress and set backs, a new technique, known as SIP Identity (RFC 4474), was published in August 2006 (Rosenberg, 2006). RFC 4474 is the most reliable secure caller ID mechanism today. The technology is similar to the three way handshake that is known in TCPconnection oriented networking. Rosenberg (2006) offers an illustration: The caller for an example Bill, has a SIP uniform resource indicator of sip:bill@example.com, which Bills phone places into the from header field of its SIP messages. When Bill makes a call, Bills phone emits a SIP INVITE and sends this to the server for example.com. The server challenges the message, asking for Bills phone to provide credentials. These credentials verify that the caller is indeed Bill and that the from field is accurate. The example.com server applies a cryptographic signature over portions of the message and includes that signature, along with the http URL for getting its certificate, into the SIP message. The called party retrieves this certificate and checks the signature. If it is validated, it provides strong assurance that the caller really is in the domain example.com. The RFC 4474 mechanism as explained by Rosenberg is the most widely used in the industry to avoid spam. However, there are some concerns with the RFC 4474 mechanism. The concern is the act of spoofing. Spoofing is gaining access to a system by posing as an authorized user. By assuming the identity of another, the attacker attempts to forge or intercede in a chain of communication, thereby being able to use the resources of email, IP or a website to perform malicious attacks. Rosenbergs example above also illuminate an over looked issue; the issue of viruses in VoIP phones. Clearly one can

see that a special phone is used to make VoIP calls. These phones are connected to the Internet; being connected to the Internet put the connected device at risk. These risks involve virus infection and VoIP phone hacking. One must remember that the VoIP phones are little computers or calling devices with a computer chip. There are tools out there that allow hackers the possibility to reboot phones, flood IP telephony phones with calls, force hangups, reassign devices to other users and overload phones with meretricious traffic. Toll fraud is a very serious security issue on VoIP networks. Toll fraud is a serious threat because it utilizes the enterprise resources such as bandwidth. Bandwidth utilization leads to network latency. Toll Fraud it is listed as one of the top five threats to VoIP networks. PBX toll fraud as it is often called is widespread and very organized. The "hackers" have their own communication network on the Internet, have their own magazine, called 2600 The Hacker Quarterly, and they meet monthly in more than 15 U.S. cities and five different countries. They know everything network administrators would like to hide about their PBX. Some of them have even programmed PBXs, voice mail systems, ACDs and other telecommunication equipment. They know how to get in, access "secret" passwords, and manipulate data, long-distance routing tables and even your "personal" mail boxes. Sathish (2006) confirms the vulnerability of VoIP networks: VoIP applications are especially vulnerable to toll frauds because they form an integral part of the IP network unlike regularly monitored PBX systems managed by separate groups. VoIP Toll frauds lead to heavy financial burden for companies managing the network. An argument can be made that if a fixed rate is established regardless of how long one uses VoIP services, how can the company experience high financial losses, when cost is zero? It is possible for an attacker to come into the network via SIP then make an invite or call to Uzbekistan through conventional lines. The fact that conventional or land lines may be used to make calls one can see how the company may have huge financial losses. Materna (2006) strengthens the point made of huge financial losses. Edwin Pena was charged for defrauding 15 VoIP service providers of services by hacking into their networks and reselling VoIP calls. Federal prosecutors charged that Edwin Pena hacked into VoIP service provider networks to obtain minutes for free, and then resold them to his customers, generating more than $1 million from the stolen services. Sathish (2006) further states, Keeping your network away for the Internet is a good practice. One will have to agree with the quote; the 15 service providers defrauded by Edwin Pena, the lost revenue from more than 10 million minutes of VoIP calls illustrates the impact of leaving VoIP vulnerable. Sathish claims that the University of Houston is a pioneer in this security approach; the institution has put its call manager and network out of direct access from the Internet; its IP PBXs are in a domain separate from its other servers and access is restricted. Moreover, the most efficient way of preventing such fraud is having strong encryption policies in place. Policies are the foundation for information security, or in this case, VoIP security. By establishing policies, one can follow a guide to help protect the network in a standardized way as the CIO sees fit. Brute force attempt is a concern within the VoIP realm. Fortunately, it is one of the oldest techniques used, wherein the attacker tries to bypass a security check by attempting possible

options until finding one that works. Sathish (2006) offers the following solution: Monitor and track traffic patterns on your VoIP network. Monitoring tools and intrusion detection systems can help identify attempts to break into your VoIP network. Scrutinizing your VoIP logs can bring to light irregularities such as international calls made at odd hours or to countries your organization has no ties with (toll fraud), multiple log-on attempts like in a brute-force attempt to crack a password, or a surge in voice traffic during off-peak hours (voice spam). Intrusion detection and other monitoring tools are the best way to detect brute force attempt. DoS occurs when an attacker overwhelms the network and brings it down by sending malformed packets or by exhausting resources that flood the service until it can no longer process legitimate requests. Curran (2006) explains the simplicity of intercepting VoIP traffic: Since most VoIP traffic is transmitted unencrypted, it is susceptible to eavesdropping by an attacker using a common packet sniffer to capture the packets. It can provide attackers with the user identities, PINs, and SIP phone numbers required for identity theft. Most literature implements the same security practices to mitigate or prevent DoS and eavesdropping. Sathish (2006) states that one should restrict all VoIP data to one Virtual Local Area Network (VLAN): Cisco recommends separate VLANs for voice and data; this helps prioritize voice over data and also keeps traffic on the voice network hidden from those connected to the data network. VLANs are also useful in protecting against toll fraud, DoS attacks, and eavesdroppers listening in and taking over conversations because a VLAN is a closed loop of servers or computers that does not allow any other computer access to its network/facilities; with the lack of a PC to launch attacks, a VoIP network is quite safe. If there is an attack, the disruption caused will be minimal.

5. Future Solutions
Future trends, or rather a more advanced trend in VoIP communication, will include sending VoIP traffic from one network to another. One must Encrypt VoIP communications, because its not enough to just encrypt the data packets that are sent out, you have to encrypt call signaling too. Encrypting voice packets prevents voice injections where interceptors can insert their own words into the conversation, giving it a whole new meaning (Sathish, 2006). The two most common methods of encryption are the Secure Real Time Protocol (SRTP), which encrypts communication between endpoints; and Transport Level Security (TLS), which encrypts the entire call process (in UDP packets). Another mechanism that can be used is VPNs. VoIP networks are attractive because of their quality of service and throughput, thus one should ensure that the selected encryption method is efficient and fast. Otherwise, performance and throughput may be negatively impacted. Another solution involves IP Security (IPSec), a set of protocols developed by the IETF to support secure exchange of packets at the IP layer. IPSec has been deployed widely to implement Virtual Private Networks (VPNs) (Webopedia, 2007). IPSec is widely used to provide secure access to corporate private networks. Since other authors (Sathish 2006) suggest that it is

wise to have VoIP applications or platforms separated on a VLAN or use VPNs when accessing those VLAN, it would be a good practice to use IPSec. The construction of a Virtual Private Network (VPN), involves multiple segments of a private network, which are linked over a public network using encrypted tunnels. This configuration allows applications on the private network to communicate securely without any local cryptographic support since the VPN routers perform the encryption and decryption. IPSec is well suited for this environment. If one is transmitting data from one VoIP network to another, individuals may suggest using point to point protocol (PPP), but since IPSec operates directly on the IP packetsthe transmitting of IP packets between packets within and outside the networkPPP is not necessary. Authors at freesoft.org, (2007) states that Using PPP over an encrypted TCP connection, any packet lost in the public network would trigger a TCP retransmission, thus stalling the link until the packet is delivered. Since VoIP networks are attractive because of their quality of service and throughput, latency is not needed in VoIP networks. In order to have this quality of service and throughput between networks, it may be wise to run VoIP traffic through IPSec because IPSec utilizes RTP that is used in VoIP: Running VoIP traffic through a TCP/PPP tunnel would largely defeat the RTP protocol used for VoIP (freesoft.org, 2007). Another future solution is illustrated in the article VoIP Hacking Exposed. With regards to spoofing and VoIP phone hacking, Leyden (2006) states that Security researchers released 13 new tools designed to illustrate generic flaws on insecure VoIP systems. These tools, released to assist penetration testers and corporate sys admin, illustrated how it might be possible to overload phones with spurious traffic, flood IP telephony phones with calls, force hang-ups, reboot phones or reassign devices to other users. The tools all target systems using Sessions Initiation Protocol (SIP). Most current systems from leading vendors such as Cisco and Nortel are moving from proprietary protocols towards SIP, so the threats outlined are more for future reference than current use. By providing system administrators with these tools, administrators can find vulnerabilities. After vulnerability is detected administrators can develop possible ways to secure the network or device from the potential threat.

Greene (2006) further question, How would you limit it to voice? VoIP streams are a combination of voice and data. The apparatus used would have to capture everything (Greene, 2006). It seems as though that the law stipulates that only voice calls or transmission should be tapped, but it is virtually impossible to only capture voice calls without intruding on sensitive material transmitted in data packets. The complexity of capturing voice calls is further articulate in Greenes (2006) article Net Pioneers Sound Security Alarm over VoIP Wiretaps. The article states that: If you wanted to listen to a specific user, you'd have to know the [media access control (MAC)] addresses associated with the call. Without those, given that individual devices can call from anywhere as long as they are attached to the Internet, sorting individual calls would be nearly impossible. (Greene, 2006) However, there are special cases in which it is possible to know the MAC addresses of the devices making a call. A VoIP call center environment may enable Network administrators and C level management the ability to know the MAC address of all devices connection to their routers or making calls. In a VoIP call center environment one knows the MAC address of each machine involved, so one could readily track calls to and from them (Greene, 2006) Wiretapping is a vulnerability that others besides law enforcement could exploit. An example of how the new wiretapping law can exploit VoIP networks is stated below: In the hands of malicious parties, a tap could grab any type of traffic passing through the router and be an access point for man-in-the-middle attacks, in which data in a stream is altered. By opening up the communications to an unacknowledged third party, wiretapping is a designed security breach; the combination of wiretapping with remote delivery elevates the risk that communications security can be violated with minimal risk of discovery. If misused, the technology could yield identity information about individuals as well as passwords. (Greene, 2006) The best or safest way to avoid traffic being compromised (manin the middle attacks or, in this case, wiretaps) especially from one network to another is to encrypt the data either via VPNs, or from one endpoint device to another. Greene (2006) strengthens the point of encrypting data: CALEA may represent a potential VoIP vulnerability but it's not the only one. You could have one of the computers in your office infected with spyware that monitors traffic going by, including voice packets. The spyware could be organized to sort who calls whom, so whoever put the spyware there could pick and choose whom they want to listen to. It would be pick-andchoose wiretapping from the other side of the world . . . So encrypting all VoIP traffic that must be kept secret makes sense. CALEA poses major problems for VoIP networks and VoIP providers. Many obstacles must be overcome, some of which involve VoIP architectures, privacy laws compliance, exploits, and developing devices to monitor when a tap is in progress. If one does a Google or search in any search engine for

6. Future Concerns Legal Aspect

A future concern or security issue for VoIP providers or VoIP networks that send VoIP traffic to and from other networks is the passing of the Communications Assistance to Law Enforcement Act (CALEA) to Voice over IP. The FCC has set May 14, 2007, as the date VoIP service providers must comply with the federal wiretapping law, CALEA. It is important to note that at the time of writing this paper, the law has not taken effect. VoIP businesses must now research and take steps to counter the risks the new law poses on VoIP networks. Greene (2006) refers to CALEA wire-tapping as an architected security breach that could be exploited by unauthorized parties. Greene states further that it is difficult to isolate voice packets among data packets mixed in a stream; even legitimate use of wiretaps will inevitably result in capturing more than just the phone calls authorized by CALEA court orders.

VoIP architectures, one will find many PDF documents and white papers of different VoIP architectures, which are not standardized. Implementation of devices to allow wire taps will be difficult, costing VoIP providers and consumers financially. There are VoIP call centers that have to follow strict guidelines when it comes to customer privacy, especially when they are taking calls for medical institutions. Health Insurance Portability and Accountability Act (HIPAA) enacted by the U.S. Congress in 1996, mandates that individual medical records be kept private and secure, whether in use, transmitted or stored. Developing devices to monitor when a tap is in progress will be difficult to develop, because of the different VoIP architectures. CALEA creates an opening, or an alternative route, that hackers can exploit, thus causing VoIP providers and network administrators grief, stress, their jobs and possibly their lives.

VoIP carriers. Calls were then forwarded between servers and service providers to cover their tracks and enabling Penas two companies Miami Tech and Consulting and Fortes Telecom to collect on charges from calls. Materna (2006) states, within the VoIP network, various security architectures and solutions should be deployed to protect VoIP services from security threats during their lifecycle. Any security architectures and solutions deployed must be VoIP aware so they do not impact VoIP service quality and reliability. This means, for example, that firewalls should be able to deal with SIP specific requirements such as dynamic port ranges, call initiations from external sources and NAT (maybe PAT too) functionality without causing latency. The sources mentioned in this paper recommend deploying multi-layer security infrastructure that provides both perimeter and internal network protection. The multi-layer security infrastructure may consist of a number of security devices and host based applications to protect VoIP networks. These devices may include VoIP Network Intrusion Prevention Systems (NIPS), VoIP DoS defenses, VoIP Network Intrusion Detection Systems (IDS), authentication, authorization, and accounting (AAA) servers, IPSec encryption engines with Low Latency Queuing (LLQ) and VoIP anti-virus software. In information security it is widely accepted that no matter how effective the prevention method and/or protection mechanism in place may be, an attacker may successfully penetrate all the defenses and wreak havoc on the network whether it is a telephony, data, or VoIP infrastructure. It is important to constantly monitor the network for breaches in its defenses. Legislation in general is supposed to help and protect society, but it can also be an infringement on ones privacy. Privacy infringement by the government is an ongoing debate as stated in the following: CALEA rulings appear to reflect a long- standing debate surrounding the merits and dangers of potential government access to private and public communications facilities, and especially over the freewheeling Internet. Academics, citizens'-rights and privacy-protection groups, and vendor/service provider corporations with vested interests in an open World Wide Web see substantial personal-freedom and privacy-infringement possibilities. (Telecom Policy Report, 2005) Privacy infringement may be another topic to discuss in VoIP security or Information Security. However, this paper has identified security issues or threats against which one may take some form of action to counter or mitigate, but others exist that one will have to deal with. The legal aspect is also important in VoIP security. This paper believes that taking into consideration both the technical and legal aspects of VoIP security is equally important in securing VoIP networks. One may assume that cyber terrorists as well as terrorists to Homeland Security are using VoIP as a means of gaining an advantage to carry out devious plots against the freedom of Data Communication, Information Security, Information Technology and Homeland Security. It is

Conclusion
VoIP networks are attractive because of their quality of service and throughput. In order to have this quality of service and throughput between networks, it may be wise to have some sort of redundancy in case of failure; thus, one should build redundancy into VoIP networks. One source advises, Be prepared for the day DoS attacks or viruses threaten to bring your network crashing down create a network that tolerates failures by setting up multiple nodes, gateways, servers, power sources, and call routers, and hooking up with more than one provider. Dont stop with just putting the infrastructure in place; run frequent trials to ensure that they are working well and are ready to take over when the primary network fails (Sathish, 2006). To protect the VoIP infrastructure investment, one should also put equipment behind firewalls and create separate firewalls so that traffic crossing VLAN boundaries is restricted only to applicable protocols. Sathish (2006) states, This will prevent the spread of viruses and Trojans to servers in case clients are infected. Choose networking and security vendors who support both the Session Initiation Protocol (SIP) and the International Telecommunication Unions H.323 protocol. Firewall configurations have to be created so that the appropriate ports open and close when necessary. Lastly, one should update patches regularly; the security of a VoIP network depends on both the underlying operating system and the applications that run on it. Maintaining patch currency for both the OS and VoIP applications is imperative in protecting against threats from malware (Sathish, 2006). Patches are the simplest form of protecting both software and hardware. Patches may close holes that are in the network and some patches may even help mitigate toll fraud, voice spam/spit, brute force attempt, DoS attacks, and eavesdroppers, which are prevalent security issues within vulnerable VoIP networks. Common attacks are mostly used to crack codes. A common technique used is brute force attempt. Materna (2006) states: Pena, along with hired hacker Robert Moore, applied a very common code cracking method called brute force to identify holes in the service provider networks. Using this method, they sent millions of test calls to VoIP equipment such as call managers until they gained access to the network. They then hacked into computers at an investment company in Rye Brook, N.Y. and set up other servers, which were connected to existing

up to professionals and officials in the private and public sectors to reach an agreement that will comply with all laws in an effort to combat threats to VoIP networks. It is interesting to see how Data Communication, Information Security, Information Technology, Homeland Security and Privacy laws go hand in hand when trying to secure Voice over Internet Protocol (VoIP) Data Networks facility-to-facility traffic.

http://findarticles.com/p/articles/mi_m0PJR/is_2005_Dec_5a i_n15896054 VoIP spam from SearchVoIP.com. (2007). SearchVoIP.com. Retrieved February 9, 2007 from http://searchvoip.techtarget.com/sDefinition/0,290660,sid66_ gci1024458,00.html VOIP Toll Fraud. (2007). VoIP-news. Retrieved February 9, 2007 from http://www.voip-news.com/voip-infowiki/index.php/VoIP_toll_fraud Aginsky, A. (1995). Focus on: How to combat toll fraud Retrieved February 15, 2007 from http://www.findarticles.com/p/articles/mi_qa3629/is_199511 /ai_n8728125 Curran, P. Just how risky is a phone call over the Internet. Retrieved February 13, 2007 from http://www.microsoft.com/uk/business/security/VoIP.mspx Dzucbeck, F. (2007). Hype vs. reality in VoIP security. Retrieved February 15, 2007 form NetworkWorld.com Materna, B. (2006). VoIP Security Hacking Highlights Need for Proactive Solutions. Retrieved March 2, 2007 from http://www.tmcnet.com/channels/voip/articles/1546-voipsecurity-hack-highlights-need-proactive-solutions.htm Rosenberg, J. (2006). Secure caller ID for VoIP. Retrieved February 15, 2007 from NetworkWorld, November 27, 2006. Vol23, Num 46. www.networkworld.com Sathish, P. (2006). VoIP Security Challenges: 25 Ways to Secure your VoIP Network. Retrieved February 11, 2007 from http://www.voiplowdown.com/2006/12/voip_security_c.html Greene, T. (2006). Net pioneers sound security alarm over VoIP wiretaps. Retrieved March 2, 2007 from http://www.networkworld.com/news/2006/061906-caleavoip.html Draven, J. (2007). VoIP Phones and their Downsides http://www.voiceoverip-articles.com/voip-products/voipphones-and-their-downsides/

ACKNOWLEDGEMENTS
I would like to thank God for the strength, wisdom and patience in writing this paper. Without Him neither this paper nor any of my accomplishments were possible. My employer, Message Technologies, Inc. (MTI), provided me with the infrastructure and the knowledge of Networking and VoIP technology. The CTO of MTI provided the topic and the direction I should take in writing the paper, and offered comments in helping me improve the paper. Special thanks to the InfoSec CD for accepting this paper for the 2007 conference. Thanks to the KSU Writing Center for correcting grammatical errors. Special thanks to ACM SIGCHI for allowing me to modify templates they developed.

REFERENCES AND CITATIONS

Frequently Asked Questions. (2007). Federal Communications Commission. Retrieved February 9, 2007 from http://www.fcc.gov/voip/ Internet Security Systems, Ahead of the Threat. VoIP: The Evolving Solution and the Evolving Threat. Retrieved February 15, 2007 from http://www.iss.net/documents/whitepapers/ISS_VoIP_White _paper.pdf IPSec. (2007). Webopedia. Retrieved February 9, 2007 fromhttp://www.webopedia.com/TERM/I/IPSec.html IP Sec Protocol Overview. (2007) Freesoft.com. Retrieved February 15, 2007 from http://www.freesoft.org/CIE/Topics/141.htm The History of VoIP. (2005). WhichVoIP.com. Retrieved February 9, 2007 http://www.whichvoip.com/voip/articles/voip_history.htm Telecom Policy Report. (2005). The FCC and CALEA: What Price Collaboration? Retrieved March 27, 2007 from