What security defenses should we expect from VoIP service providers? Although some experts say that the providers offer encryption, I've heard that that is not always the case.
The advice that you've heard is correct. Many VoIP providers do not offer encryption services due to the difficulty inherent in encrypting voice traffic without producing a noticeable degradation in speech quality. When deploying an enterprise VoIP product, carefully consider the security measures used by the tool.
First, unless your provider offers encryption, you should definitely consider placing the call manager at your site. Doing so allows for all of the benefits of a VoIP network within the walls of the organization, but preserves the traditional security of the wired PSTN for calls leaving the enterprise.
In addition, you should provide security for internal calls as well; tools like Wireshark make it easy for savvy users to identify VoIP traffic and eavesdrop on VoIP calls. The simplest thing you can do is separate voice and data traffic on your network. Create segmented VLANs for all voice devices and use both policy and technical measures to prohibit the use of data devices on those VLANs. When configuring these protections, don't forget that most VoIP phones come with a data jack designed to allow users to share a single wall jack (and VLAN assignment!) between their phones and PCs. You'll want to disable those jacks!
Dig Deeper on VLAN Security Management
Related Q&A from Mike Chapple
Cloud compliance issues are no reason for enterprises not to move to the cloud. Expert Mike Chapple explains why, as well as what to keep in mind ...continue reading
The GAO reported on SEC cybersecurity weaknesses, even though the SEC regulates cybersecurity. Expert Mike Chapple discusses the effects of this ...continue reading
Enterprise compliance can be a burden to manage, which is where a PCI ISA can be helpful. Expert Mike Chapple explains how a PCI Internal Security ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.