Download - SpeechTEK 2009: Securing Cloud Telephony Aug2009

SpeechTEK 2009

Dan York, CISSPDirector of Conversations, VoxeoBest Practices Chair, VoIP Security Alliance (VOIPSA)[email protected]

Securing Cloud Telephony

Security concerns in telephony are not new…

Image courtesy of the Computer History Museum

Nor are our attempts to protect against threats…

Image courtesy of Mike Sandman – http://www.sandman.com/

Privacy

Compliance

Cost Avoidance

Availability

Business Continuity

Confidence

Mobility

http://www.amazon.com/gp/product/images/1597491691/sr=8-2/qid=1174470038/ref=dp_image_0/104-6664099-8482355?ie=UTF8&n=283155&s=books&qid=1174470038&sr=8-2


http://www.amazon.com/gp/reader/1555583326/ref=sib_dp_pt/104-6664099-8482355

http://www.amazon.com/gp/reader/1555583326/ref=sib_dp_pt/104-6664099-8482355





TDM security is relatively simple...

TDMSwitch

PSTNGateways

PhysicalWiringVoicemail

IVR

Voicemail PhysicalWiring

DatabasesDirectories

E-mailSystems

WebServers

VoIP security is more complex

OperatingSystems

Firewalls

DesktopPCs

Voice overIP

NetworkSwitches

WirelessDevices

IVR

PSTNGateways

InstantMessaging

Standards

Internet

ConfidentialityIntegrityAvailability

Voice Application Diagram

VoiceBrowser(on svr)

WebSvr

HTTP

VoiceXMLor

CCXML

App/DBSvr?Phone Audio

PHPperl python

Java???

ruby

XMLXML

servlets

Voice Transport

WebSvr

HTTP

VoiceXMLor

CCXML

App/DBSvr?

PHPperl python

Java???

ruby

XMLXML

servlets


Phone Audio

Internet/WAN

Internet/WAN

PSTN

Voice TransportVoice

Browser(on svr)

Phone

PSTN PBXPhoneVoice

Browser(on svr)

TDM

PSTN IP-PBXPhoneVoice

Browser(on svr)

SIP

PSTNSIP

ServiceProvider

PhoneVoice

Browser(on svr)

SIP


Phone

SIP

Voice Transport - SIP

PSTNVoice

Browser(on svr)

Phone

PSTN PBXPhoneVoice

Browser(on svr)

TDM

Internet/WAN

Internet/WAN

PSTN IP-PBXPhoneVoice

Browser(on svr)

SIP

PSTNSIP

ServiceProvider

PhoneVoice

Browser(on svr)

SIP


Phone

SIP

Voice Authentication


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Who are you talking to?

Voice Biometrics


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

VoiceBiometrics

AuthSvr

Web Transport

PHPperl python

Java???

ruby

XMLXML

servlets



WebSvr

HTTP

VoiceXMLor

CCXML

Phone Audio

PHPperl python

Java???

ruby

XMLXML

servlets


HTTP

VoiceXMLor

CCXML

App/DB Server Transport

App/DBSvr?Web

Svr

Server Security


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Management Interfaces


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

APIs


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Local Storage / Logging


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Call Recording


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Web Interaction - Authentication


WebSvr

HTTP

VoiceXMLor

CCXML

App/DBSvr?Phone

PHPperl python

Java???

ruby

XMLXML

servlets

WebSvr

Web Interaction - XSS/Injection


WebSvr

HTTP

VoiceXMLor

CCXML

App/DBSvr?Phone

PHPperl python

Java???

ruby

XMLXML

servlets

WebSvr

Input validation?

External Interaction


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

App/DBSvr

?

Moving Into The Cloud

Location - Single network/server


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Location - Distributed


WebSvr

HTTP

VoiceXMLor

CCXML



WebSvr

HTTP

VoiceXMLor

CCXML


Location - Distributed


WebSvr

HTTP

VoiceXMLor

CCXML


Location - Into the cloud


WebSvr

HTTP

VoiceXMLor

CCXML


PHPperl python

Java???

ruby

XMLXML

servlets

Location - Distributed/Cloud


WebSvr

HTTP

VoiceXMLor

CCXML



WebSvr

HTTP

VoiceXMLor

CCXML


Location - Distributed/Cloud


WebSvr

HTTP

VoiceXMLor

CCXML


Location - Hybrid


WebSvr

HTTP

VoiceXMLor

CCXML



WebSvr

HTTP

VoiceXMLor

CCXML

App/DBSvr?

Can You Trust The CloudTo Be There?

Location/network questions

• What level of network connectivity do you have available?• What kind of availability guarantees / Service Level Agreements (SLAs) do

you have in place? • What kind of geographic redundancy is built into your underlying network? • What kind of network redundancy is built into your underlying network? • What kind of physical redundancy is built into your data centers?• What kind of monitoring do you perform? • What kind of scalability is in the cloud computing platform? • What kind of security, both network and physical, is part of the platform? • What kind of security policies and procedures are in place?• What kind of patch management plans?• Will firewall traversal be necessary (for instance, for a SIP trunk) and if so,

how?• How scalable is the solution?• Do you have appropriately-trained and available staff?

Distributed Architectures


WebSvr

App/DBSvr

Phone Audio


ASR

WebSvr

App/DBSvr

MRCP

App/DBSvr

Geography

ConfidentialityIntegrityAvailability

Thank you!

Dan York, CISSPDirector of Conversations, VoxeoBest Practices Chair, VoIP Security Alliance (VOIPSA)[email protected]

Download - SpeechTEK 2009: Securing Cloud Telephony Aug2009

Top Related