Here's yet more spreading of VoIP security FUD. This time, by eWeek's David Coursey (thanks to Russell Shaw for noting this article in his blog)
In this article, Coursey argues that enterprise VoIP installations should be stopped due to threats from VoIP spam, unauthorized wiretapping, unauthorized speaker-phone activation among other threats.
As I've stated earlier, I think the security concerns around VoIP have been greatly overblown. SPIT (Spam of IP Telephony) is not a threat for enterprises, since their VoIP systems aren't connected via IP to anything. All calls from/to their VoIP system are via the PSTN. There is no threat of attack on their phones from the public Internet unless basic security practices are completely ignored. In fact, the real threat of VoIP spam is that VoIP will be leveraged in remote parts of the world to enable cheap or free telemarketing, which will plague not only IP phones, but any phone reachable via the PSTN.
Sure, in theory one can set up a SIP server and open it up to the Internet, but enterprises aren't going to do that (at least those who are minimally security conscious). Rather, enterprises who want to enable IP reachability of their VoIP system will do so via private peering or the use of managed peering fabrics. The only threat of VoIP spam would be from publicly facing portals such as "click-to-talk" applications on web sites.
With regard to wiretapping, VoIP is harder to tap than traditional voice. One can't just attach alligator clips at a closet or a terminal on the street. Rather one must span the Ethernet port of the phone they wish to tap, meaning that they need to be able to log into the local Ethernet switch (again, basic security practices would prevent this by logging all administrative access to the switch). In addition, many enterprise VoIP systems offer encryption, something that is not easily implemented in the PSTN.
Yes, there is the threat of someone remotely exploiting a phone to turn on the speaker without a user's knowledge, but one can also put a remote wireless microphone in an office, possibly easier than activating the speaker phone (and I'd be willing to bet this flaw will be fixed in enterprise systems in the not so distant future.
So again, there are threats to VoIP systems, but right now they are being completely overblown by some, and while enterprises should understand the risks, they should also understand that mitigation techniques and best practices exist, and can be implemented to minimize the risk and potentially offer even more secure communications than what is currently being used.
