| ID Number: G00124016 |
Voice Over IP Communications Must Be Secured
15 November 2004 David L. Fraley Voice over IP has unique attributes when compared with other forms of traffic that run on IP networks. Accordingly, it must be treated differently to ensure next-generation network communications security.
* | Recipients who do not own this document will receive a summary only.
| Browse Topics
| Advanced Search
| Ask an Analyst
| Rate This Document
| Downloads:
|  | voice_over_ip_c.pdf (56.5KB) |

| Analysis
| Voice over Internet Protocol (VoIP) works, and its feature set is sufficiently robust to replace equivalent time division multiplexing (TDM) devices. Moreover, VoIP features are becoming more intertwined with the World Wide Web, significantly increasing functionality. Because VoIP has gained a substantial installed base, vendors are thinking about ways to ensure VoIP security. CIOs and network managers are concerned about how to secure VoIP so that it provides the same level of security as TDM and the public switched telephone network (PSTN) that are in place. However, when properly configured, VoIP can easily be as secure — in some cases, even more secure — than TDM and the PSTN. The key is to use communications devices and IP networks that are specifically designed to secure VoIP communications. Examples include using encryption, virtual local-area networks (VLANs) and lower-layer security techniques. It is important to have a proportional security policy, that is, spend an appropriate amount. Securing VoIP Is Unique Securing voice communications is technically different from securing more-traditional data streams. These issues include surrounding guaranteed bandwidth, delay, jitter, packet loss and the timely delivery of signaling messages. VoIP has unique requirements because of its extreme sensitivity to delay and jitter. When securing VoIP, planners must take into account traditional IP threats and VoIP-specific threats. The massive adoption of industry-standard protocols leaves VoIP vulnerable to generic protocol and vendor-specific vulnerabilities. Any security measure must cope with these constraints. Measures such as encryption will affect consumed bandwidth and required processing power in VoIP network nodes. Real-time requirements mean that a limited number of security gateways can be placed on the end-to-end stream. Securing VoIP streams and maintaining quality of service (QOS) requires a delicate balance. It would be easy to use a combination of traditional IP security techniques, payload and signaling encryption. While this combination would produce secure VoIP communications, the delay could degrade communications to the point that they are not understandable. Two basic kinds of VoIP communications are call setup (signaling) and payload (VoIP packets). Call setup delay is not nearly as important as payload transport. A call setup time of a few seconds is acceptable. Accordingly, allowing a few tenths of a second to encrypt signaling traffic is acceptable. The tolerance for delay in voice communications is documented in the International Telecommunication Union standard G.114 described as follows: Toll quality is defined as communications with an end-to-end delay not exceeding 150 milliseconds (ms). Near-toll quality is defined as having delays between 150 ms and 400 ms. Nontoll quality is defined as voice communications delays exceeding 400 ms. Payload delay for many domestic VoIP calls is in the 100-to-125-ms range. When considering that VoIP is already close to the maximum-allowable delay to retain toll quality, any condition that adds a small amount of delay will be noticeable. As the added delay approaches 250 ms, voice communications rapidly becomes unacceptable. Types of Vulnerabilities VoIP is vulnerable to many types of malicious activity. Signaling and payload are vulnerable to traditional IP threats, including viruses, worms, IP spoofing, password attacks and man-in-the-middle attacks. Payload and, to a lesser extent, signaling are vulnerable to denial-of-service (DOS) attacks. The goal of signaling attacks is to disrupt the call or gain illegitimate access to the communications stream. Broadly speaking, signaling attacks can be grouped in the following categories: Registration hijacking Impersonating a server Tampering with message bodies Tearing down sessions DOS Securing Private vs. Public Network Communications Securing VoIP communications is significantly different on private vs. public networks. The primary difference is the ability to determine the destination IP address. In private and public network applications, the caller dials a traditional telephone number. In a private network application, the IP PBX or similar device already knows the destination IP address that is associated with that telephone number. In a public network application, on the other hand, the IP address of the destination telephone or other communications device is not known, assuming that the call will traverse two or more service provider networks. In keeping with the need to know the endpoint IP address and other reasons to modify a Session Initiation Protocol (SIP) invite message, public network signaling is much more complex to secure. An assumption of public network SIP signaling is that VoIP users will be unwilling, probably forever, to stop using telephone numbers and start dialing IP addresses. Although IP version 6, the next-generation IP, will reduce VoIP signaling complexity somewhat, its increased address length will further reinforce users' desires to retain traditional telephone numbers. Network Types and VoIP Security The following are basic types of VoIP network configurations: LANs WANs and metropolitan-area networks (MANs) The public Internet Next-generation network (NGN) public VoIP networks The type of network has implications for security and QOS. The more control that an administrator has over the VoIP network, the easier it is to secure and provide a consistently high QOS. In this sense, LANs are the most secure, followed by WANs and MANs and Internet-based systems. LAN-Only VoIP LAN-only VoIP provides the most secure network environment possible because its switched 100-Mbps Ethernet gives the network administrator great control. VLANs should be deployed in converged LANs. LAN-only VoIP uses a TDM connection to the PSTN. This is made possible by using a media gateway that converts TDM to IP. In a LAN-only environment, VoIP is generally not subject to DOS attacks because it works behind the firewall and because of the TDM-PSTN connection. When wireless LANs are in place, it is recommended to use wireless LAN encryption, either Wireless Fidelity Protected Access or virtual private networks (VPNs), for VoIP. Finally, encrypting VoIP traffic that runs on a LAN faces obstacles because of low-latency, high-bandwidth network characteristics, which are generally considered a secure space. Private Network In a private network, VoIP runs across WANs and MANs; it is the next-most-secure VoIP network environment, after LANs, WANs and MANs connecting multiple LANs. The type of WAN and MAN connection significantly influences security and QOS. It's important to note whether the connections are a direct fiber connection (on a MAN) or a VPN that has guaranteed QOS; the QOS service-level agreements (SLAs) should guarantee delay, packet loss and jitter (packets arriving out of the proper time sequence) parameters. An important engineering concern is to ensure sufficient bandwidth on the WAN/MAN links. Insufficient bandwidth can compromise QOS and security. When VoIP traffic leaves the IP network, it is converted to TDM by a media gateway and handed off to the PSTN. Depending on the WAN/MAN configuration, VoIP traffic is subject to DOS attacks that can introduce delays to the voice stream. Encrypted VoIP traffic across the WAN or MAN is a realistic option if the delay calculations support encryption. Internet VoIP In this case, VoIP is transmitted across the Internet. The Internet provides no QOS parameters or SLA guarantees, and the latency, packet loss and jitter can vary significantly. The trade-off here is that lower-quality connections mean lower costs — often no incremental cost for making the VoIP call. Public network VoIP traffic is the most susceptible to spoofing or other types of manipulation. In this environment, some form of VoIP traffic encryption is needed to guarantee privacy. However, sending encrypted data across public networks can add significant latency and make call quality hard to maintain. NGN Public VoIP From a security perspective, the NGN will be characterized by QOS parameters that will be an inherent component of the network. VoIP signaling will be similar to the hierarchical nature of PSTN signaling. However, the big difference between PSTN and NGN signaling is that NGN signaling will use the same protocol from the edge to the core (SIP and others). In the PSTN, multiple signaling protocols are in use (Transaction Capabilities Application Part, Integrated Services Digital Network User Part and PBX proprietary). In the NGN, traffic will be end-to-end VoIP, with a significant percentage traversing multiple service providers’ networks before reaching its destination. VoIP signaling will be secured by traditional IP security techniques, such as Transport Layer Security, Secure Multipurpose Internet Mail Extensions and Secure Real-Time Transport Protocol. Bottom Line The securing of voice communications is not just an IT issue. It affects such executives as the chief counsel, CIO and CEO. However, Voice over IP is less secure than most forms of time division multiplexing communications. It can be at least as secure through the implementation of a homogeneous solution and the use of best practices. To achieve a high-quality secure VoIP environment, security must be a primary consideration in every IP communications decision.
| Return to Top
Key Issues How will voice-data convergence affect telephony in the next five years? How will enterprises identify critical infrastructure dependencies and risks? What is the right choice of network topology, given certain redundancy requirements, as well as geographic and demographic parameters? What are the most-effective technologies and best practices to protect networks, systems, applications and data? What technologies may expose enterprise IT systems and data to damaging security breaches? What does an IT security director need to know about enterprise risk management? How will telephony technologies and architectures evolve in the next five years?
| Return to Top
|  | Strategic Planning Assumption(s) |
| Voice over IP communications will continue to use traditional telephone numbering as the primary addressing scheme through 2011 (0.9 probability). |
| Voice over IP communications will continue to be less secure than time division multiplexing communications through 2006 (0.8 probability). |
| Deployed IP PBX, IP-phone-supporting encryption and other security techniques will not be common through 2005 (0.9 probability). |
| By 2008, denial of service attacks will regularly be used to disrupt Voice over IP communications (0.7 probability). |
| By 2006, convergence-specific viruses/worms will begin to attack Voice over IP-specific equipment (0.8 probability). |
|  | Acronym Key |
DOS | denial of service
MAN | metropolitan-area network
NGN | next-generation network
PSTN | public switched telephone network
QOS | quality of service
SIP | Session Initiation Protocol
SLA | service-level agreement
TDM | time division multiplexing
VLAN | virtual local-area network
VoIP | voice over Internet Protocol
VPN | virtual private network

| Browse Topics: Security Strategies Packet Voice Services |
| © 2005 Gartner, Inc. and/or its Affiliates. All Rights Reserved. Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The opinions expressed herein are subject to change without notice. |

Resource Id: 461418