What security defenses should we expect from VoIP service providers? Although some experts say that the providers offer encryption, I've heard that that is not always the case.
The advice that you've heard is correct. Many VoIP providers do not offer encryption services due to the difficulty inherent in encrypting voice traffic without producing a noticeable degradation in speech quality. When deploying an enterprise VoIP product, carefully consider the security measures used by the tool.
First, unless your provider offers encryption, you should definitely consider placing the call manager at your site. Doing so allows for all of the benefits of a VoIP network within the walls of the organization, but preserves the traditional security of the wired PSTN for calls leaving the enterprise.
In addition, you should provide security for internal calls as well; tools like Wireshark make it easy for savvy users to identify VoIP traffic and eavesdrop on VoIP calls. The simplest thing you can do is separate voice and data traffic on your network. Create segmented VLANs for all voice devices and use both policy and technical measures to prohibit the use of data devices on those VLANs. When configuring these protections, don't forget that most VoIP phones come with a data jack designed to allow users to share a single wall jack (and VLAN assignment!) between their phones and PCs. You'll want to disable those jacks!
Dig Deeper on VLAN Security Management
Related Q&A from Mike Chapple
Here are some important criteria for hiring a partner to review your information security program, with a focus on HIPAA and HITECH compliance.continue reading
New guidance from the PCI SSC includes some essential aspects of tokenization security and what merchants need to know about tokenization products.continue reading
HIPAA data breach reporting now uses an electronic Web portal, so what does this mean for covered entities? Expert Mike Chapple explains.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.