VoIP, common sense and security

I recently hosted a voice-over-IP seminar in New York. On the taxi ride from LaGuardia to midtown, my driver mentioned that he was a student taking network classes. When I told him I was going to be speaking on VoIP, he immediately asked, “But is it secure?”

My answer was no, but it’s a helluva lot more secure than the cell phone you were just talking on.

I’ll admit it: Security is a tough issue. It’s a lot safer and more convenient not to do something than to move forward if there is a security issue that can come back to haunt you. Consequently, security has recently become one of the major reasons given for delaying the implementation of VoIP.

The ultimate decision point for all security issues should be how difficult it is to gain access to confidential information, not whether it is theoretically possible to intercept the information. All information can be compromised. Our job is to make sure that the effort required to gain access to the information is several orders of magnitude greater than the intrinsic value of the information. So what are the major security concerns about VoIP and how real are they?

No. 1 on the list is usually the fact that Ethernet is a shared-medium technology. Ethernet switching has negated this concern. Essentially all Ethernet connections are switched, which means that you have a dedicated path to your desktop.

What about sending information over the Internet? I have yet to hear of a documented case of information being pirated while in transit over the Internet. It’s not worth the trouble. Further, most VoIP implementations today are over corporate intranets.

What about sniffing VoIP packets? Possible, but unlikely. One could quite reasonably argue that VoIP is more secure than traditional voice because the transmission protocol is significantly more difficult to decode than traditional digital voice.

Denial-of-service (DoS) attacks? A DoS attack could cripple your VoIP implementation. But keep two facts in mind. DoS attacks occur primarily on the Internet, and, again, corporate VoIP tends to be on an intranet. And you already should be taking appropriate measures to safeguard your servers from DoS attacks for data applications. These same measures work for VoIP.

Voice is intrinsically unsecure, whether it’s VoIP or traditional voice. The greatest risk for voice security is somebody hearing your conversation over the cubicle wall. And tapping into traditional PBXs doesn’t take rocket science.

Ultimately, your organization must decide whether VoIP is sufficiently secure for you to move ahead. But as you make that decision, be sure that it’s a reasonable, fact-based assessment and not an attempt to hide from reality.

Taylor is president of Distributed Networking Associates Inc. and editor/publisher of Webtorials.com. He can be reached at taylor@webtorials.com.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now