IPTCOMM 2008 Heidelberg. VoIP Security: Do Claims of Threats Justify Continued Research Efforts? Jonathan Zar. Pingalo VOIPSA
|
|
- Rhoda Copeland
- 8 years ago
- Views:
Transcription
1 IPTCOMM 2008 Heidelberg VoIP Security: Do Claims of Threats Justify Continued Research Efforts? Jonathan Zar Pingalo VOIPSA Eric Chen NTT Information Sharing Platform Laboratories VOIPSA 1
2 Lots of Activity Within VoIP Security 2
3 Industry Activity VoIP Security Alliance VOIPSA s mission is to promote the current state of VoIP security research, VoIP security education and awareness, and free VoIP testing methodologies and tools. Membership includes: Mitel, Avaya, Nortel, Siemens, Alcatel, Extreme Networks, NTT. Now over 100 members on the Technical Board of Advisors Projects: Threat Taxonomy, Security Requirements, Security Research, Best Practices, Testing Public VOIPSEC mailing list for discussion of VoIP security issues VoIP Security Threat Taxonomy released in late 2005 Current project - industry-wide Best Practices 3
4 Conference Activity 4
5 VoIP Security Books
6 Press Attention 6
7 Increasing Industrial Importance Well past the tipping point when new E1 favor IP provisioning VoIP technologies have become foundational in 3GPP and ITU Appear in 3G roadmaps Appear in ITU roadmaps Now several years into early market segments of mainstream consumer VoIP adoption Protocols widely used on all major IM platforms Carrier offerings Skype Other solutions With build out of NGN VoIP based protocols are diffusing widely Within enterprise SIP trunking has started 7
8 Public Mindshare telephone security voip security voice security 8
9 Public Mindshare (continued) telephone security voip security unified communications 9
10 R&D Decisions Matter Future results depend on allocations today Allocations are based on perceived need Misallocations are costly because its always a capital and labor trade-off impacting the course of jobs, projects, and the results from the investment Key metrics are ROI based either: True ROI where there is measurable financial return Or proxy ROI where there is an alternative return such as: Decision branches pruned Patents applied or issued Experimental candidates for commercialization 10
11 Plenty of Need 6 Billion People ~ $5 Trillion Base of Pyramid Market Gains Dramatically from ICT Investment Base of Pyramid Sources: C.K. Prahalad and World Resources Institute ICT 11
12 Methodology Mapped the risk space into a threat taxonomy Created a corpus of data of threats and vulnerabilities for the period from calendar Q4FY06 to Q2FY07 Included IMS, enterprise, and consumer risks from public and proprietary sources Included claims of threats to: VoIP enabled applications and ancillary databases real-time protocols and their implementations enabling tools and software libraries network equipment and transport endpoint devices Measured and classified the threats Synthesized results, root causes, and implications 12
13 VOIPSA VoIP Security Threat Taxonomy Refer to for more details 13
14 Results of Discovery Claims of Threats Supported by Evidence 14
15 McAfee Avert Labs Top 10 Threat Predictions for
16 11 Years of Automated Attacks Source: US Department of Defense Public Unclassified 16
17 R&D Creates Wealth Source: Hans Rosling 17
18 New VoIP Attack/Security Tools More than 80 VoIP attack/security tools known (still increasing) 18
19 Zero Day Auctions Now Include VoIP Source: WabiSabiLabi Home Page 26 June
20 VoIP Services Theft Prosecution Theft and Resale Of More Than 10 Million Minutes of VoIP Traffic Through a practice known as a Brute Force attack, [defendant] Pena and others working with him acquired the proprietary codes established by VOIP telecom providers to identify and accept authorized calls entering their networks for routing. Having penetrated the networks of VOIP telephone service providers, Pena programmed the third party s computer networks to use the illegally obtained proprietary prefix to route calls of customers of his companies. By sending calls to the VOIP telephone service providers through the unsuspecting third party s networks, the VOIP telephone service providers were unable to identify the true sender of the calls for billing purposes. Consequently, individual VOIP Telecom Providers incurred aggregate routing costs of up to approximately $300,000 per provider, without being able to identify and bill Pena. Source: Press Release and Criminal Complaint US vs. Pena (June, 2006, District of New Jersey) 20
21 End-point Vulnerabilities Testing of hard phones, wi-fi phones, and terminal adapters shows that many have weak security: open ports, default passwords, weak provisioning, weak cryptography defective software low tolerance for fuzzing and flooding Few systems in the field are verified by design In general there are no standards for robustness. Nor are they even good metrics for such a concept 21
22 End-point Vulnerability Examples (1 of 3) Senao SI-7800H VoIP wireless phone wdbrpc debug service UDP/17185 Clipcomm CPW-100E VoIP wireless handset phone open debug service TCP/60023 ZyXel P2000W (Version 2) VoIP wireless phone undocumented port UDP/9090 ACT P202S VoIP wireless phone multiple undocumented ports/services MPM HP-180W VoIP wireless desktop phone undocumented port UDP/9090 UTstarcom F1000 VoIP Wifi phone Multiple vulnerabilities Source: S. Merdinger 22
23 End-point Vulnerability Examples (2 of 3) Cisco Unified IP Phone SSH server with hard coded default user account and default password that is used for debugging Linksys WIP 330 VoIP wireless phone crash from Nmap scan Cisco 7905 VoIP phone crashing from dsniff arpspoof Clipcomm CP-100E Undocumented open port TCP/60023 allows remote access to two debugging accounts: Clip and USH Hitachi WIP-5000 HTTP index page discloses software version, phone MAC address, IP address and routing HTTP no default login credentials SNMP enabled, read/write using any credentials Undocumented open port TCP/3390 Unidata Shell Hardcoded admin login 0000 on device keypad Source: S. Merdinger 23
24 End-point Vulnerability Examples (3 of 3) Senao SI-680H VoIP Wifi phone undocumented open port Zyxel P2000W (Version1) VoIP Wifi phone multiple vulnerabilities GrandStream GXP-2000 VoIP Desktop Phonw multiple undocumented UDP ports and DoS PolyCom IP-301 VoIP Desktop Phone HTTP server DoS and undocumented TCP port 42 Linksys SPA-921 VoIP Desktop Phone HTTP server DoS Source: S. Merdinger 24
25 Results of Analysis Root Causes and Key Findings 25
26 Root Causes Data Structures Routing Course Virtual Protection Incomplete Coverage Incomplete Exception Handling Weak Identification Poor Auditability Inadequate Input Validation Presumptive and Eager Commits Defective Coverage Non-reversible Routing Non-abelian Non-transitive Processes Promiscuous Routing Costly Enforcement Non-atomic Authentication Protocol and Application Vulnerabilities Logic Trust Semantics 26
27 Key Findings Q: How important is this field? A: Quite important. The infrastructure for modern telecommunications and enterprise peering is at risk. Q: Who are the customers for R&D? A: Industry and government for the benefit of the public. Q: What are the needs? A: Robust design for all devices that touch the traffic. Improvements in the root causes areas that contribute to defects. Increased investment focused in specific areas as recommended. Regulatory support for transitional QA investment tariffs. Q: Do the facts support continued research? A: Yes. The threats are real, significant in harm, and growing. 27
28 Key Findings (continued) Q: What do the risks tell us? A: That communication software, including embedded software, and micro devices with compiled logic are vulnerable to at least 14 root cause defects and will be under sustained and malicious attack. Q: How does learning inform decision makers? A: Digital communications are prone to increasing compromise. The risks threaten both commerce and national security. The art of quality for communication software across the entire industry is substantially less than what is considered acceptable by the public everywhere in the manufacture of articles of commerce. Investment would thus be prudent. 28
29 Many Technical Opportunities End-point Security Protocol Stability RT Transactional Security Robust Implementations Metrics and Methods Authentication and Admissions for interconnecting with other carriers for DoS prevention for Phishing countermeasures Trust Logic Multiparty Signaling Payload Security Micro transactions OSS/BSS Extensions Security Transactions Advertising Commercial Zero Defects Incumbents New Large Entrants Open Source Multi-tenant Hosted Systems Privacy Hacker Ethics 29
30 Where to Focus Candidate VOIPSA Projects 30
31 Global Test-bed Project Need Create a global carrier peering test-bed for service validation and QA Attractive for entrepreneurs building new user communities and inviting to researchers in quality assurance and security Distinct from regulated network, internal network, or honey-pots Project Network contribution and establishment Developer programs for S/W, H/W, QA, pen-testing, and Web 3.0 Management, operations, and regulatory clearance Benefit Effective public large scale test-bed National means for sharing investment in Web 3.0 and security research 31
32 End Point Security Project Need MANY terminal adapters and end-points (of all types) have weak security Carriers are surrounded by these devices many of which could, if compromised, open the core network to the attack In general there are no standards to ensure end-point security or improve goods in the supply chain Project Define a roadmap for security standards for end-points Increase the ability of suppliers to source compliant goods Step-by-step raise the bar on quality Benefit Defect reduction across the value chain from end-points Practical and significant improvement in system reliability 32
33 Secure IMS Billing Project Need Support for secure advertising, micropayment, presence, location, or transaction billing Current CDR information is already vulnerable: the next generation billing models will require more detail and hence more security VoIP and IMS security research and OSS/BSS research is required in collaboration to assure the public that future generation billing systems can be trusted Project Collaborate on new service delivery billing elements, workflows and enabled security of data and data exchange Generate the learning and input for standards to assure the public Benefit Trusted commerce model for monetizing IMS 33
34 Privacy Commerce Project Need The public consistently polls in favor of privacy interests and is willing to pay for some measure of privacy either in fees or benefits Industry sector regulation of privacy worldwide increases year-by-year Missing are the market enablers for a commercial market in IMS based privacy solutions Project Explicate the technical requirements for general privacy solutions Enable the technical infrastructure Benefit ROI to drive carrier adoption of S/W and H/W enablers Better consumer privacy and business regulatory compliance 34
35 Discussion Please Join Us For Q&A Immediately After Today s Demos 35
VoIP Security. Threats and Countermeasures. Eric Chen NTT Information Sharing Platform Laboratories & VOIPSA Technical Board of Advisors
VoIP Security Threats and Countermeasures Eric Chen NTT Information Sharing Platform Laboratories & VOIPSA Technical Board of Advisors Agenda Increasing awareness of VoIP security Top VoIP security threats
More informationVOIP SECURITY: BEST PRACTICES TO SAFEGUARD YOUR NETWORK ======
VOIP SECURITY: BEST PRACTICES TO SAFEGUARD YOUR NETWORK ====== Table of Contents Introduction to VoIP Security... 2 Meet Our Expert - Momentum Telecom... 2 BroadWorks... 2 VoIP Vulnerabilities... 3 Call
More informationSecurity issues in Voice over IP: A Review
www.ijecs.in International Journal Of Engineering And Computer Science ISSN:2319-7242 Volume 3 Issue 2 February, 2014 Page No. 3879-3883 Security issues in Voice over IP: A Review Rajni a, Preeti a, Ritu
More informationVoIP Security: How Secure is Your IP Phone?
VoIP Security: How Secure is Your IP Phone? Dan York, CISSP Director of IP Technology, Office of the CTO Chair, Mitel Product Security Team Member, Board of Directors, VoIP Security Alliance (VOIPSA) ICT
More informationPENTEST. Pentest Services. VoIP & Web. www.novacybersecurity.com
PENTEST VoIP & Web Pentest Services VoIP & WEB Penetration Testing The Experinced and National VoIP/Unified Communications R&D organization, NETAŞ NOVA Pentest Services test the applications, infrastructure
More informationHow the ETM (Enterprise Telephony Management) System Relates to Session Border Controllers (SBCs) A Corporate Whitepaper by SecureLogix Corporation
How the ETM (Enterprise Telephony Management) System Relates to Session Border Controllers (SBCs) A Corporate Whitepaper by SecureLogix Corporation Introduction Enterprises are continuing to convert and
More informationRecommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings
More informationContents Introduction Why Fax over IP? How Real-time Fax over IP works Implementation with MessagePlus/Open Summary. About this document
Fax over IP Contents Introduction Why Fax over IP? How Real-time Fax over IP works Implementation with MessagePlus/Open Summary About this document This document describes how Fax over IP works in general
More informationWHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK DATE OF RELEASE: 27 th July 2012 Table of Contents 1. Introduction... 2 2. Need for securing Telecom Networks... 3 3. Security Assessment Techniques...
More informationOverview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
More informationBest Practices for Securing IP Telephony
Best Practices for Securing IP Telephony Irwin Lazar, CISSP Senior Analyst Burton Group Agenda VoIP overview VoIP risks Mitigation strategies Recommendations VoIP Overview Hosted by VoIP Functional Diagram
More informationVoIP Survivor s s Guide
VoIP Survivor s s Guide Can you really save $, improve operations, AND achieve greater security and availability? Presented by Peggy Gritt, Founder and CEO of the VoIP A non-biased organization for the
More informationCconducted at the Cisco facility and Miercom lab. Specific areas examined
Lab Testing Summary Report July 2009 Report 090708 Product Category: Unified Communications Vendor Tested: Key findings and conclusions: Cisco Unified Communications solution uses multilayered security
More informationFDIC Division of Supervision and Consumer Protection
FDIC Division of Supervision and Consumer Protection Voice over Internet Protocol (VoIP) Informational Supplement June 2005 1 Summary In an attempt to control expenses, consumers and businesses are considering
More informationCertified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
More informationDEPLOYING VoIP SECURELY
DEPLOYING VoIP SECURELY Everyone knows that Voice-over-IP (VoIP) has been experiencing rapid growth. Even still, you might be surprised to learn that: 10% of all voice traffic is now transmitted with VoIP
More informationM2M Series Routers. Port Forwarding / DMZ Setup
Introduction Port forwarding enables programs or devices running on your LAN to communicate with the internet as if they were directly connected. Many internet services and applications use designated
More informationVoice Over IP (VoIP) Denial of Service (DoS)
Introduction Voice Over IP (VoIP) Denial of Service (DoS) By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com Denial of Service (DoS) is an issue for any IP network-based
More informationInnovation in Security. Secure Enterprise U n i f i e d C o m m u n i c a t i o n to protect business assets in the 21st Century
Innovation in Security Secure Enterprise U n i f i e d C o m m u n i c a t i o n to protect business assets in the 21st Century The complete Security Solution for SIP and Unified Communications designed
More informationGrandstream Networks, Inc. UCM6100 Security Manual
Grandstream Networks, Inc. UCM6100 Security Manual Index Table of Contents OVERVIEW... 3 WEB UI ACCESS... 4 UCM6100 HTTP SERVER ACCESS... 4 PROTOCOL TYPE... 4 USER LOGIN... 4 LOGIN TIMEOUT... 5 TWO-LEVEL
More informationNetwork Security Administrator
Network Security Administrator Course ID ECC600 Course Description This course looks at the network security in defensive view. The ENSA program is designed to provide fundamental skills needed to analyze
More informationBest Practices for Outdoor Wireless Security
Best Practices for Outdoor Wireless Security This paper describes security best practices for deploying an outdoor wireless LAN. This is standard body copy, style used is Body. Customers are encouraged
More informationMitigating the Security Risks of Unified Communications
2009 International Conference on Computer Engineering and Applications IPCSIT vol.2 (2011) (2011) IACSIT Press, Singapore Mitigating the Security Risks of Unified Communications Fernando Almeida 1 +, Jose
More informationSecureCom Mobile s mission is to help people keep their private communication private.
About SecureCom Mobile SecureCom Mobile s mission is to help people keep their private communication private. We believe people have a right to share ideas with each other, confident that only the intended
More informationVerizon Columbia Research on VoIP Security A Model Academia/Industry Collaboration. Gaston Ormazabal. Verizon Laboratories.
Verizon 2009 All Rights Reserved. 1 Verizon Columbia Research on VoIP Security A Model Academia/Industry Collaboration Gaston Ormazabal Verizon Laboratories May 13, 2009 June 16, 2009 Verizon 2009 All
More informationIngate Firewall/SIParator SIP Security for the Enterprise
Ingate Firewall/SIParator SIP Security for the Enterprise Ingate Systems February, 2013 Ingate Systems AB (publ) Tel: +46 8 600 77 50 BACKGROUND... 1 1 NETWORK SECURITY... 2 2 WHY IS VOIP SECURITY IMPORTANT?...
More informationNew IBM Security Scanning Software Protects Businesses From Hackers
New IBM Security Scanning Software Protects Businesses From Hackers Chatchawun Jongudomsombut Web Application Security Situation Today HIGH AND INCREASING DEPENDENCE ON WEB SERVICES Work and business Communications
More informationChile- SIP Enabled Servers and IP PBX Market Shares, Strategies, and Forecasts, 2008 to 2014. SIP Enabled Infrastructure Implements VoIP in Chile
Chile- SIP Enabled Servers and IP PBX Market Shares, Strategies, and Forecasts, 2008 to 2014 SIP Enabled Infrastructure Implements VoIP in Chile Picture by Susie Eustis MOUNTAINS OF OPPORTUNITY CHECK OUT
More informationVoice over IP (VoIP) Vulnerabilities
Voice over IP (VoIP) Vulnerabilities The Technical Presentation Diane Davidowicz NOAA Computer Incident Response Team N-CIRT diane.davidowicz@noaa.gov "Security problems in state of the art IP-Telephony
More informationOverview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015 Tripwire Evolution 18+ Years of Innovation 1997 Tripwire File System Monitoring from open source
More informationREPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli (200607011) Chandan Kumar (200607003) Aamil Farooq (200505001) Network Audit Table of
More informationSecurity Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8
Security Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8 SR140531D 19 August 2014 Miercom www.miercom.com Overview Unify Inc. (formerly Siemens Enterprise Communications)
More informationinformation security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.
More informationEC-Council Network Security Administrator (ENSA) Duration: 5 Days Method: Instructor-Led
EC-Council Network Security Administrator (ENSA) Duration: 5 Days Method: Instructor-Led Certification: ENSA Exam 312-38 Course Description This course looks at the network security in defensive view.
More informationUsing IP Networks for voice and video: benefits and challenges
Using IP Networks for voice and video: benefits and challenges Peter Cox CEO UM Labs Ltd October 2010 About UM Labs UK Based company Founded 2008 by Peter Cox and other cofounders of Borderware Technologies
More informationFirewall Testing Methodology W H I T E P A P E R
Firewall ing W H I T E P A P E R Introduction With the deployment of application-aware firewalls, UTMs, and DPI engines, the network is becoming more intelligent at the application level With this awareness
More informationSIP A Technology Deep Dive
SIP A Technology Deep Dive Anshu Prasad Product Line Manager, Mitel June 2010 Laith Zalzalah Director, Mitel NetSolutions What is SIP? Session Initiation Protocol (SIP) is a signaling protocol for establishing
More informationCYBERTRON NETWORK SOLUTIONS
CYBERTRON NETWORK SOLUTIONS CybertTron Certified Ethical Hacker (CT-CEH) CT-CEH a Certification offered by CyberTron @Copyright 2015 CyberTron Network Solutions All Rights Reserved CyberTron Certified
More informationConducting an IP Telephony Security Assessment
Conducting an IP Telephony Security Assessment Mark D. Collier Chief Technology Officer mark.collier@securelogix.com www.securelogix.com Presentation Outline Ground rules and scope Discovery Security policy
More informationCyber Essentials. Test Specification
Cyber Essentials Test Specification Contents Scope of the Audit...2 Assumptions...3 Success Criteria...3 External systems...4 Required tests...4 Test Details...4 Internal systems...7 Tester pre-requisites...8
More informationNext Generation. VoIP Application Firewall. www.novacybersecurity.com
Next Generation VoIP Application Firewall Are you aware that you are vulnerable to all threats on the Internet? With increasing voice and video transmission over IP and emerging new technologies such as
More informationDeploying Firewalls Throughout Your Organization
Deploying Firewalls Throughout Your Organization Avoiding break-ins requires firewall filtering at multiple external and internal network perimeters. Firewalls have long provided the first line of defense
More informationWhite Paper A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK. A balancing act
A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK With organizations rushing to adopt Voice over IP (VoIP) technology to cut costs and integrate applications designed to serve customers better,
More informationFinding VoIP vulnerabilities while you sleep
Finding VoIP vulnerabilities while you sleep Background info on VoIP and previous research Introduction to VoIPER Description of some of its features Some demos and usage examples The results of my testing
More informationExecutive Summary and Purpose
ver,1.0 Hardening and Securing Opengear Devices Copyright Opengear Inc. 2013. All Rights Reserved. Information in this document is subject to change without notice and does not represent a commitment on
More informationNetwork Service, Systems and Data Communications Monitoring Policy
Network Service, Systems and Data Communications Monitoring Policy Purpose This Policy defines the environment and circumstances under which Network Service, Systems and Data Communications Monitoring
More informationCH ENSA EC-Council Network Security Administrator Detailed Course Outline
CH ENSA EC-Council Network Security Administrator Detailed Course Outline Summary Duration Vendor Audience 5 Days hands-on training EC-Council Security Professionals Level Technology Category Advance Ethical
More informationNetwork Security Policy
Network Security Policy I. PURPOSE Attacks and security incidents constitute a risk to the University's academic mission. The loss or corruption of data or unauthorized disclosure of information on campus
More informationa) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)
MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a file
More informationWhite Paper. avaya.com 1. Table of Contents. Starting Points
White Paper Session Initiation Protocol Trunking - enabling new collaboration and helping keep the network safe with an Enterprise Session Border Controller Table of Contents Executive Summary...1 Starting
More informationMedical Device Security Health Group Digital Output
Medical Device Security Health Group Digital Output Security Assessment Report for the Kodak Color Medical Imager 1000 (CMI-1000) Software Version 1.1 Part Number 1G0434 Revision 2.0 June 21, 2005 CMI-1000
More informationClosing Wireless Loopholes for PCI Compliance and Security
Closing Wireless Loopholes for PCI Compliance and Security Personal information is under attack by hackers, and credit card information is among the most valuable. While enterprises have had years to develop
More informationTelecom Testing and Security Certification. A.K.MITTAL DDG (TTSC) Department of Telecommunication Ministry of Communication & IT
Telecom Testing and Security Certification A.K.MITTAL DDG (TTSC) Department of Telecommunication Ministry of Communication & IT 1 Need for Security Testing and Certification Telecom is a vital infrastructure
More informationEnterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
More informationSession Border Controllers in Enterprise
A Light Reading Webinar Session Border Controllers in Enterprise Thursday, October 7, 2010 Hosted by Jim Hodges Senior Analyst Heavy Reading Sponsored by: Speakers Natasha Tamaskar VP Product Marketing
More informationVoice over IP. VoIP (In) Security. Presented by Darren Bilby NZISF 14 July 2005
Voice over IP VoIP (In) Security Presented by Darren Bilby NZISF 14 July 2005 Security-Assessment.com Who We Are NZ s only pure-play security firm Largest team of security professionals in NZ Offices in
More informationNetwork Security - ISA 656 Review
Network Security - ISA 656 Review Angelos Stavrou December 4, 2007 Material Test Conditions 7:20pm - 9:30pm, Thursday, Dec 11th, in the Lab (STI-128) Same style of questions as the midterm I m not asking
More informationBUILDING AN OFFENSIVE SECURITY PROGRAM BUILDING AN OFFENSIVE SECURITY PROGRAM
BUILDING AN OFFENSIVE SECURITY PROGRAM Common Gaps in Security Programs Outsourcing highly skilled security resources can be cost prohibitive. Annual assessments don t provide the coverage necessary. Software
More informationSIP Security Controllers. Product Overview
SIP Security Controllers Product Overview Document Version: V1.1 Date: October 2008 1. Introduction UM Labs have developed a range of perimeter security gateways for VoIP and other applications running
More informationApplication Notes. Introduction. Contents. Managing IP Centrex & Hosted PBX Services. Series. VoIP Performance Management. Overview.
Title Series Managing IP Centrex & Hosted PBX Services Date July 2004 VoIP Performance Management Contents Introduction... 1 Quality Management & IP Centrex Service... 2 The New VoIP Performance Management
More informationAdvanced LCR (Least Cost Router) With SIP Proxy Server
With SIP Proxy Server It s all about Reducing Cost!!! WHY ADVANCED LCR (Least Cost Routing) Advanced LCR is a product by Advanced Communications; the same parent company of AdvancedVoIP.com, a widely used
More informationManagement, Logging and Troubleshooting
CHAPTER 15 This chapter describes the following: SNMP Configuration System Logging SNMP Configuration Cisco NAC Guest Server supports management applications monitoring the system over SNMP (Simple Network
More informationAgenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
More informationVoIPon www.voipon.co.uk sales@voipon.co.uk Tel: +44 (0)1245 808195 Fax: +44 (0)1245 808299
VoiceGear/3CX Integration Guide Ver.0.1 Page 2 1. OVERVIEW... 3 1.1 SETTING UP 3CX PBX...4 1.2 SETTING UP VOICEGEAR GATEWAY...5 2. VOICEGEAR-3CX SIP INTEGRATION... 6 2.1 3CX CONFIGURATION...7 2.2 VOICEGEAR
More informationDate 10/04/2012 TB Number TB - 12004 VoIP Security Threat Reminder
VOIP SECURITY THREAT REMINDER Bulletin Authorisation Detail Author Andrew Kenyon Authorisation Wilf Wood Date 10/04/2012 TB Number TB - 12004 Description VoIP Security Threat Reminder Summary Please use
More informationPayment Card Industry (PCI) Executive Report 08/04/2014
Payment Card Industry (PCI) Executive Report 08/04/2014 ASV Scan Report Attestation of Scan Compliance Scan Customer Information Approved Scanning Vendor Information Company: A.B. Yazamut Company: Qualys
More informationFRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months
FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months MODULE: INTRODUCTION TO INFORMATION SECURITY INFORMATION SECURITY ESSENTIAL TERMINOLOGIES SECURITY
More informationVoIP Security Challenges: 25 Ways to Secure your VoIP Network from Versign Security, Dec 01, 2006
VoIP Security Challenges: 25 Ways to Secure your VoIP Network from Versign Security, Dec 01, 2006 VoIP technology has the tech geeks buzzing. It has been touted as: - the killer of telecoms - a solution
More informationHow To Protect Your Network From A Hacker Attack On Zcoo Ip Phx From A Pbx From An Ip Phone From A Cell Phone From An Uniden Ip Pho From A Sim Sims (For A Sims) From A
Contents 1. Introduction... 3 2. Embedded Security Solutions... 4 2.1 SSH Access... 4 2.2 Brutal SIP Flood... 4 2.3 SIP Register Limitation... 5 2.4 Guest calls... 5 3. Manually configure system to raise
More informationCTS2134 Introduction to Networking. Module 8.4 8.7 Network Security
CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by
More informationBridgit Conferencing Software: Security, Firewalls, Bandwidth and Scalability
Bridgit Conferencing Software: Security, Firewalls, Bandwidth and Scalability Overview... 3 Installing Bridgit Software... 4 Installing Bridgit Software Services... 4 Creating a Server Cluster... 4 Using
More informationA Brief Overview of VoIP Security. By John McCarron. Voice of Internet Protocol is the next generation telecommunications method.
A Brief Overview of VoIP Security By John McCarron Voice of Internet Protocol is the next generation telecommunications method. It allows to phone calls to be route over a data network thus saving money
More informationensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
More information7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
More informationDetailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
More informationMida TerraFaxPro. Overview. Why Deploy a Fax Server
Mida TerraFaxPro Overview TerraFaxPro is the IP Fax Server (FoIP) solution from Mida Solutions, based on the world leading Dialogic Brooktrout SR140 fax software technology. TerraFaxPro manages incoming
More informationNetwork- vs. Host-based Intrusion Detection
Network- vs. Host-based Intrusion Detection A Guide to Intrusion Detection Technology 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free: 800.776.2362 Fax: 678.443.6477
More informationAn outline of the security threats that face SIP based VoIP and other real-time applications
A Taxonomy of VoIP Security Threats An outline of the security threats that face SIP based VoIP and other real-time applications Peter Cox CTO Borderware Technologies Inc VoIP Security Threats VoIP Applications
More informationThe data which you put into our systems is yours, and we believe it should stay that way. We think that means three key things.
Privacy and Security FAQ Privacy 1. Who owns the data that organizations put into Google Apps? 2. When can Google employees access my account? 3. Who can gain access to my Google Apps administrative account?
More informationSession Manager Overview. Seattle IAUG Chapter Meeting
Session Manager Overview Seattle IAUG Chapter Meeting Agenda Session Manager continues to evolve.. Flexibility BYOD Soft Clients Endpoints SIPenablement 3 rd Party Adjuncts Centralized SIP Trunking Redundancy
More informationLeveraging innovative security solutions for government. Helping to protect government IT infrastructure, meet compliance demands and reduce costs
IBM Global Technology Services Leveraging innovative security solutions for government. Helping to protect government IT infrastructure, meet compliance demands and reduce costs Achieving a secure government
More informationBEng (Hons) Telecommunications. Examinations for 2011 2012 / Semester 1
BEng (Hons) Telecommunications Cohort: BTEL/10A/FT Examinations for 2011 2012 / Semester 1 MODULE: IP Telephony MODULE CODE: TELC3107 Duration: 2 Hours Reading time: 15 Minutes Instructions to Candidates:
More informationFabrizio Volpe. MVP Directory Services MCITP Lync 2010. @Fabriziovlp. Fabrizio.volpe@gmx.com. http://www.linkedin.com/in/fabriziov
Fabrizio Volpe MVP Directory Services MCITP Lync 2010 @Fabriziovlp Fabrizio.volpe@gmx.com http://www.linkedin.com/in/fabriziov Agenda Intro to Lync Server Lync Features : Presence Integration with Sharepoint,
More informationSiemens OpenScape Voice V7 SIP Connectivity with OpenScape SBC V7. to Integra SIP Service
Siemens OpenScape Voice V7 SIP Connectivity with OpenScape SBC V7 to Integra SIP Service February 2013 Page 1 of 47 Document History Date Version / Issue Modified by Section(s) Affected High-Level Description
More informationSECURITY TRENDS & VULNERABILITIES REVIEW 2015
SECURITY TRENDS & VULNERABILITIES REVIEW 2015 Contents 1. Introduction...3 2. Executive summary...4 3. Inputs...6 4. Statistics as of 2014. Comparative study of results obtained in 2013...7 4.1. Overall
More informationWharf T&T Limited DDoS Mitigation Service Customer Portal User Guide
Table of Content I. Note... 1 II. Login... 1 III. Real-time, Daily and Monthly Report... 3 Part A: Real-time Report... 3 Part 1: Traffic Details... 4 Part 2: Protocol Details... 5 Part B: Daily Report...
More informationHow To Implement A Cisco Vip From Scratch
Overview of Cisco VoIP Infrastructure Solution for SIP The Cisco VoIP Infrastructure Solution for SIP implements a voice-over-packet network design using SIP to provide telephony services. It lays the
More informationSecuring Remote Vendor Access with Privileged Account Security
Securing Remote Vendor Access with Privileged Account Security Table of Contents Introduction to privileged remote third-party access 3 Do you know who your remote vendors are? 3 The risk: unmanaged credentials
More informationNetwork Security In Linux: Scanning and Hacking
Network Security In Linux: Scanning and Hacking Review Lex A lexical analyzer that tokenizes an input text. Yacc A parser that parses and acts based on defined grammar rules involving tokens. How to compile
More informationDATA CENTER IPS COMPARATIVE ANALYSIS
DATA CENTER IPS COMPARATIVE ANALYSIS Security 2014 Thomas Skybakmoen, Jason Pappalexis Tested Products Fortinet FortiGate 5140B, Juniper SRX 5800, McAfee NS- 9300, Sourcefire 8290-2 Data Center Overview
More informationmobile unified communications client and docking station
FREQUENTLY ASKED QUESTIONS mobile unified communications client and docking station What are the target customer characteristics of a Mobile UC subscriber? + Verizon Wireless as mobile carrier. Mobile
More informationHONEYD (OPEN SOURCE HONEYPOT SOFTWARE)
HONEYD (OPEN SOURCE HONEYPOT SOFTWARE) Author: Avinash Singh Avinash Singh is a Technical Evangelist currently worksing at Appin Technology Lab, Noida. Educational Qualification: B.Tech from Punjab Technical
More informationTLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
More informationProject 2: Firewall Design (Phase I)
Project 2: Firewall Design (Phase I) CS 161 - Joseph/Tygar November 12, 2006 1 Edits If we need to make clarifications or corrections to this document after distributing it, we will post a new version
More informationBlack Box Analysis and Attacks of Nortel VoIP Implementations
Black Box Analysis and Attacks of Nortel VoIP Implementations Richard Gowman, CISSP Eldon Sprickerhoff, CISSP CISA www.esentire.com Copyright 2007 esentire, Inc. Who we are... esentire, Inc. Based out
More informationAchieving PCI Compliance Using F5 Products
Achieving PCI Compliance Using F5 Products Overview In April 2000, Visa launched its Cardholder Information Security Program (CISP) -- a set of mandates designed to protect its cardholders from identity
More informationTo ensure you successfully install Timico VoIP for Business you must follow the steps in sequence:
To ensure you successfully install Timico VoIP for Business you must follow the steps in sequence: Firewall Settings - you may need to check with your technical department Step 1 Install Hardware Step
More informationVoIP some threats, security attacks and security mechanisms. Lars Strand RiskNet Open Workshop Oslo, 24. June 2009
VoIP some threats, security attacks and security mechanisms Lars Strand RiskNet Open Workshop Oslo, 24. June 2009 "It's appalling how much worse VoIP is compared to the PSTN. If these problems aren't fixed,
More informationGuidance Regarding Skype and Other P2P VoIP Solutions
Guidance Regarding Skype and Other P2P VoIP Solutions Ver. 1.1 June 2012 Guidance Regarding Skype and Other P2P VoIP Solutions Scope This paper relates to the use of peer-to-peer (P2P) VoIP protocols,
More informationiscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi Agenda Introduction iscsi Attacks Enumeration Authorization Authentication iscsi Defenses Information Security Partners (isec) isec Partners Independent
More information