securing unified communications systems
Post on 20-May-2015
1.388 Views
Preview:
DESCRIPTION
TRANSCRIPT
Securing Communications!
SpeechTEK New York 2010!Dan York, CISSP
Director of Conversations, Voxeo Best Practices Chair, VoIP Security Alliance Author, Seven Deadliest UC Attacks!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
www.7ducattacks.com
About Dan York!
www.blueboxpodcast.com
www.voipsa.org www.voxeo.com
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
About Voxeo!
Founded in 1999
World’s largest hosted VoiceXML and CCXML platform – Over 82,000 hosted ports globally; hundreds of premise deployments
Over 150,000 developers using Voxeo platforms
The Voxeo difference: Unlocked Communications, Customer Obsession Teams, Communications Passion
www.voxeo.com
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
SIP Proxy
A
Alice Bob Media (RTP, MSRP, etc.)
SIP SIP
SIP Proxy
B SIP
The Change VoIP Brings!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Internet
Alice Bob Media
SIP SIP
SIP Proxy
A SIP
SIP Proxy
B
SIP Proxy
N
SIP Proxy
D SIP
SIP Proxy
C SIP SIP
Media Proxy
A
Media Proxy
B Media Media
The Larger Reality!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Physical Wiring
PBX
Voicemail
PSTN Gateways
Once Upon A Time!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Physical Wiring
IP Network
IP-PBX
Voicemail
PSTN Gateways
Mobile Devices
IM Networks
Web Servers
Email Servers
Desktop PCs
Operating Systems
Firewalls
Internet
Directory Servers
VoIP
CRM Systems
Social Networks
Database Servers
Application Servers
1. Understand Your Ecosystem!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
2. Understand Your Endpoints!
IP Phones, Smartphones, Softphones
What services are running on them?
Default passwords?
How do you patch/secure them?
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
SIP Proxy
A
Alice Bob
SIP SIP
SIP Proxy
B
SIP Proxy
N SIP SIP
Media Media Eve
3. Secure Your Media!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Alice Bob Media
Media Proxy
A
Media Proxy
B Media Media
Internet
Secure Media – Hop By Hop!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Alice Bob Media
Media Proxy
A
Media Proxy
B Media Media
Internet
Secure Media – End to End!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
SIP Proxy
A
Alice Bob
SIP SIP
SIP Proxy
B
SIP Proxy
N SIP
Media
Eve SIP SIP
4. Secure Your Signalling!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Signalling Attacks!
Toll Fraud
Identity Theft
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
PBX
Corp HQ
Carrier PSTN
Internet
Traditional Telephony!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
PBX
Corp HQ
ITSP
Internet
PSTN
IP Communications!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
PBX
Corp HQ
ITSP
Internet PSTN
PBX
Office A
Failover!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
PBX
Corp HQ
PSTN
ITSP (Boston)
Internet ITSP (Paris)
ITSP (Tokyo)
Redundancy / Geography!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
5. Secure Your PSTN Connectivity!
Attacks • Toll Fraud
• Denial of Service
• Spam
Solutions • Encryption
• Strong Authentication
• Transport Security
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
6. Secure Your Identity!
Attacks • Fraud
• Identity Theft
• Social Engineering
Solutions • Education
• Lock Down Spoofing
• Strong Identity
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
UC System
Corp HQ
Internet Firewall WiFi Café
Router
Mobile UC
client
Laptop UC
client
Mobile Data
Network
7. Secure Distributed Systems!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
UC System
Corp HQ
UC System
Office A
Corporate Network
Company A
UC System
Corp HQ
UC System
Office A
Corporate Network
Company B
Internet
How Do You Securely Federate?!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
IM
Corp HQ
Corporate Network
Presence
Call Control
IVR IM
Office A
Presence
Call Control
Voicemail IM
Office B
Presence
Call Control
PSTN
Internet
What if the Cloud Isnʼt There?!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Questions About the Cloud!
What kind of availability guarantees / Service Level Agreements (SLAs) does the platform vendor provide?
What kind of geographic redundancy is built into the underlying network?
What kind of network redundancy is built into the underlying network?
What kind of physical redundancy is built into the data centers?
What kind of monitoring does the vendor perform?
What kind of scalability is in the cloud computing platform?
What kind of security, both network and physical, is part of the computing platform?
Finally, what will the vendor do if there is downtime? Will the downtime be reflected in your bill?
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
The Way It Used To Be!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
ITSP
PSTN
ITSP
ITSP ITSP
ITSP
ITSP ITSP ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP
ITSP ITSP
ITSP
ITSP
ITSP
ITSP ITSP
ITSP ITSP
ITSP
ITSP
Today...!
© Voxeo Corporation © Voxeo Corporation © Voxeo Corporation
Resources!
VoIP Security Alliance • www.voipsa.org • www.voipsa.org/blog
Hacking Exposed: VoIP • www.hackingvoip.com
Seven Deadliest Unified Communications Attacks • www.7ducattacks.com
top related