Tag Archives: software

The journey into the cloud – making the right choices

Posted on by
Reply

The cloud is now, quite literally, everywhere. IT end-users interact with the cloud on a daily basis, organizations are engaged in cloud services at all times, and the cloud powers much of the way business operates today. The business benefits of cloud computing are now well-established and acknowledged, yet 37% of IT decision makers think staff have bought cloud services outside of the IT department without permission – meaning not everyone has thought the process through as well as they probably should have.

The cloud journey has now become a strategic imperative and no longer just a tactical IT choice – greater flexibility, improved productivity, increased collaboration, remote working and greatly reduced CAPEX can all be found through a smart cloud policy. But as with any strategic business initiative, making the right choices of suppliers, partners and relationships is the route to these dividends. And put simply, the cloud has gone mainstream.

So how do you ensure that you get these choices right and maximize the benefits of cloud computing to your organization while minimizing risk? Well, in all honesty, it genuinely depends on where you are starting from.

The greenfield approach

Companies and organizations which are taking a “greenfield approach” to cloud computing face a different set of challenges. Coming from this angle, the most beneficial way forward can be the lease and configure model. Instead of having to go on out and buy expensive hardware, and then also manage it, organizations are finding value in the managed services route. The main advantage here to “greenfield companies” is that they can simply pay a leasing fee and have their cloud solution specified and configured precisely to meet their needs.

What this means is that start-up companies or start-up divisions can operate independently and go straight into the cloud. They don’t need to set anything up, whether that is databases or ERP tools, and they are freeing themselves from risk and also responsibility. They enjoy all the benefits of the “greenfield approach”, under which they can test out new initiatives and processes, while just paying a fee for their expert partner to service their storage, virtual machines and applications in the cloud. It can very much be argued that companies in this category can make the move to the cloud more easily than their more established counterparts.

brownfield transformation

More mature companies and organizations can face a more complicated time of it however. If they have greater experience, have existing IT assets on their balance sheet and have a range of business processes in place, then they face a trickier journey into the cloud. By being in the “brownfield” category they can’t simply plug into managed cloud services without a transformation journey – they have totransform their existing operations and systems to the new environment.

These companies also have to address the financial equation which centers on those existing assets, while also managing greater levels of fear, uncertainty and risk than their “greenfield” peers. Meaning they are often in the market for a trusted third party who they can partner with and agree on the required Service Level Agreements (SLAs).

changing times for the CIO

Each of these approaches however means a range of challenges for the CIO. In days gone by the CIO needed to have in-depth technical skills and knowledge, and true IT project management expertise – today the CIO needs to be much more commercially and partnership savvy.

Today’s CIO must specialize in partnerships and relationships, SLAs and vendor management – in essence, the CIO has transformed too, from technologists to commercial decision-maker. In addition to far greater commercial know-how in general, today’s CIO needs to be much more marketing aware to leverage the opportunities that social media and mobile cloud apps offer in marketing leverage.

So whether the “greenfield” or “brownfield” approach, the burden when formulating that essential cloud strategy falls on the company CIO and IT department. They no longer have to build, install and operate systems, they need to specify, partner, transition, configure and manage commercial outcomes. The worldwide cloud market is forecast to grow from $40.7 billion in 2011 to $241 billion in 2020, and research regularly places cloud high among CIO priorities.

So a different way of thinking is required, since organizations are no longer just picking products and boxes, they are picking partners and service providers.  The old approach of buying the market leading product vendor to reduce the risk of technical obsolescence no longer applies. CIOs are now charged with helping make corporate IT agile, flexible and relevant to market discontinuities. Cloud computing, as a disruptive technology, was always going to disrupt the CIO’s traditional way of doing things. CIO’s now need to help reduce the risk of business model obsolescence.

The pace of technological change is accelerating and driving business model change. The CIO challenge has moved from technology obsolescence to business model obsolescence if IT cannot support the business model changes.

Gordon

Six tips for mobile device management security

Posted on by
Reply

There has been a lot of discussion this year about the increasing influx of consumer devices being used for both professional and personal purposes. Many organisations are feeling a little overwhelmed as they try to work out appropriate security levels and device management boundaries. When you take into consideration all the platform and application updates chewing through corporate bandwidth, plus the potential for rogue applications and malware to gain illicit access to company data, there are many headaches for security managers to deal with.

Here are six tips to help get the efficient and secure management of mobile devices under control:

1. Have a strong mobile policy

This may seem like an obvious tip, but there is often a clear disconnect between employees and employers’ expectations of how consumer devices will be used in the enterprise. Research from IDC found that not only were workers using their devices at twice the rate, they also tended to think employers were far more permissive of the use of consumer devices than they actually were. It is therefore very important to have a mobile use policy clearly defined to avoid these kinds of misunderstandings.

A mobile usage policy is a framework that defines who the users are and what devices, platforms and applications they can and can’t use. Enterprises must clearly define policies around reimbursement for services and what applications users can access via personal devices, along with clear guidance on who controls the data on devices.

2. Create an inventory of assets

How can you be assured of the security of employees’ mobile devices if you don’t know how many are out there and what they are? Implementing a robust and regularly updated inventory management system is a vital part of any mobile device management system. While many businesses do have an inventory of fixed and wireless assets, the majority of them are not updated and validated on a regular basis, leading to the potential for security issues to slip through the cracks via unknown devices or inappropriate usage. Businesses with accurate inventories have much clearer insight into their telecommunication environments and as such, more reliable information on which to base policy decisions.

3. Ensure proper configuration of devices

The sheer number of different devices and platforms out there can make the configuration of devices a challenging process. Factor in entry level handsets, smartphones, tablets with different operating systems and employees working in numerous different locations and the issue becomes even more complex. However, if a device is enrolled with a mobile device management server, a configuration profile defined and managed by IT admin can be implemented, enabling the device to interact with enterprise systems. An appropriate level of encryption can also be added to any commands coming from the server to ensure that settings cannot be altered without proper authorisation.

4. Implement appropriate security

Despite the influx of consumer devices into the workplace, many organisations haven’t implemented stronger security controls in response, leaving them at risk of security breaches or loss of sensitive data. Data encryption is a powerful piece of the mobile security puzzle and yet many businesses do not use it on a regular basis. In addition to implementing data encryption, enterprises need to inform workers about the risks of failing to comply with security protocols – there is a good chance that they are unaware of the risks associated with using their personal devices for professional purposes.

5. Regulate application protocols

Taking into consideration that there are thousands upon thousands of mobile applications out there, strong protocols need to be instituted for the deployment of any new applications and the management of existing applications. Malware is steadily creeping into the app world, so even applications from the app store need to be checked before they are allowed into the enterprise. Such malicious applications can take over the mobile device and operate in the background without the user knowing, searching for sensitive information such as passwords or banking details.

6. Provide training and end-user support

A relatively small percentage of the overall functionality of the average mobile device is used on a regular basis. With devices becoming more and more sophisticated, users could end up massively under-utilising all the functions that are at their disposal. As a result, most enterprises would benefit from providing user training, including how to set up email, device customisation, application selection and usage, understanding browser capabilities, using instant messaging, and mobile data services and understanding device functions and shortcuts. Support and training can increase worker efficiency and also reduce security risks, as employees better understand how their devices work.

Managing employee mobility doesn’t need to be a nightmare. With the right systems put into place, employees and employers alike can reap the benefits of mobility.

Original Publication

Mobility and the mobile workspace: the new demands on the CIO

Posted on by
Reply

Technology, as we knew it, is no longer relevant. Every day we are bowled over with a new app, toy or technique. We are moving to a world of smart technology at a pace that is almost impossible to keep up with.

The era of “smart technology” spans the time of smart phones, 3D printers, and beyond. A recent survey by Forrester Research anticipates that shipments of wearable computing devices will reach almost 30 million units this year. This realm is undefined and endless, and relates to anything from items tracking physical activity, to Bluetooth connected watches and the much anticipated Google glasses. 3D printers, currently fitting the bill for the art world alone, are expected to cost less than some PC’s by 2016, at under $2000.00 US dollars. The possibility is endless.

And now, with tablets expected to outsell laptops this year, this mobility aspect is become less and less a preference or request but rather a demand of employees.

The role that consumerism and trend technology plays in driving business structures and styles can no longer be ignored. Gartner expects that 80 percent of organisations will support a workforce using tablets by the end of 2013. This expectation will have a flow on effect: whether organisations are supplying the tablets, or supplying the application and platform for a personal device to be used in a corporate manner.

Regardless of the process, the outcome is the same. Business is changing, and it is becoming increasingly difficult to keep up. The majority of organisations across the world, are not ready to house these technologies. The time has come for a new approach.

The context surrounding this change is also moving at what appears to be the speed of light. Faster broadband availability and the increasing availability of 4G networks will help enhance the way employees use mobile devices, and give further incentive to those considering investing in one.

From the perspective of the CIO, these new networks could redefine business practice and process, offering potentially game changing opportunities.

Working in parallel to these advances is the announcement of new privacy laws legislation. This herald’s big change on the horizon, changes that the CIO needs to understand and incorporate.

To throw a spanner in the works, let’s consider all of these advances in the context of the cloud.

Couple this with Gartner’s expectation that by 2014, 90 per cent of organisations will support corporate applications on personal devices, and you have a problem.

Data is now a defining factor. If the majority of employees start using devices, like tablets, to access both corporate applications and personal data and data security have the potential to spiral out of control. So pertinent questions are begging to be answered:

How safe is the cloud?
What is actually stored in the cloud?
How it is stored?

The list goes on. The combination of the growth in mobility and the continued dominance and reliance on the cloud means CIOs must start considering their organisational structure and if it can cater to this changing environment.

There is no time like the present to consider how to manage risk in the mobile cloud space – what privacy safe guards and good parameters are in place, and what needs to change.

1. Define your organisational policies in relation to Bring Your Own Device (BYOD)

BYOD is a phenomenon occurring in every organisation regardless of size and structure. You must assess whether or not BYOD can have a negative effect on your organisations workings – Is your bandwidth being compromised? Is it introducing large security risks to your network?

Your organisation may decide to ban BYOD and supply devices, or alternatively to create a more structured and regimented use of BYOD through the use of dedicated access points and tracking usage and activity.

Assessing current usage patterns and doing a cost analysis is a good step towards understanding employee and business requirements alike.

2. Assess network based security policies

This is especially relevant for companies who encourage the use of BYOD and don’t offer other devices. Setting these policies up can be difficult and time consuming, but it is an effective way of regulating consumer behaviours and enforcing some hard limits.

Often the issue with BYOD is that there is no limit defined, so building from the bottom up will allow you to gain an understanding of current usage, expectations, and develop a framework to cater these to the organisation’s security benefit.

3. Manage risk across multiple device platforms

Mobility trends encompass smart phones, tablets, PCs, laptops and the next generation of wearable computing devices, including items like the Jawbone UP system. This then becomes a multi-platform environment.

When your employees are reading emails on a smart phone, updating documents on a tablet, and downloading information on a laptop, there is inherent risk. For CIOs, managing risk becomes so much more difficult because each platform is different, and so each platform needs a tailored policy. Investigating and investing in a security policy that addresses all known device platforms will dramatically reduce risk and secure organisational information.

4. Controlling data on the cloud – centrally managing user accounts

Because the cloud is an essential storage device, you need to understand how to control the data you are storing. When you have multiple users in multiple locations moving in and out of your cloud, there is an increased likelihood that something could go wrong. You need to control the way your users can use the cloud, and what they can access. Your cloud service provider should allow you to manage user accounts, create shared folders to enhance collaboration, restrict access based on managerial level, and other tailored solutions to ensure a secure space when dealing with a mobile workforce.

5. Develop a policy plan and take control

The development of a security policy should be organic. After running through steps one through four – define, assess, manage and control – you should already understand what you need in your organisation’s policy.

Your policy should aim to minimise the use of rogue cloud usage by employees, ultimately reducing the likelihood of unfriendly events such as data leakage, malware outbreaks, or hacker theft. To be sure nothing slips through the cracks, develop a list of your top ten concerns, and then make sure these are addressed in your policy.

Some questions you might like to consider include: do we have an existing policy we need to adapt? Where is our data going to be stored? Does the service provider have any ownership of your data? What is the financial credibility of the provider? If things go wrong, what is our exit strategy?

Original Publication

 

How to secure an outsourced project

Posted on by
Reply

Despite our desire for simplicity, IT continues to become more complex. Decentralised applications or client-server models have become the norm. Smartphones and tablets are pushing mobile computing into a new era and changing user behaviour. Cloud has significantly altered the way we provide IT solutions and how we meet business needs with technical solutions.

Long gone are the days when a single person could master and manage an entire enterprise network. Today, many businesses lack the dedicated staff and financial resources to manage their ever expanding IT needs. Faced with this situation, a growing number of companies contract out part of their IT to external suppliers.

While many articles have explored the security issues linked with cloud services, there are still many people who fail to recognise the same arguments apply to other outsourcing services. In fact, the challenge of managing risks and security in a diverse IT environment remains the same; whether it’s cloud, outsourcing or managed services, the reality is you are handing control of your business’ devices or applications to someone else.

The security challenge

The challenge for many businesses is deciding the level of security controls and risks your company is willing to accept – you can choose a fully-dedicated environment where security levels are dictated by your organisation, or you can use a public environment in which you accept the default setup.

Today’s Chief Security Officer is assigned the task of managing security risks associated with these changes and must come up with appropriate solutions to alleviate them. For many businesses, the move to an outsourced model presents an opportunity to increase the level of network security. It could even be the trigger for a security upgrade.

 Establishing an outsourced project

Outsourcers will generally set technical, physical and organisational security controls that will be applied across all of the outsourcer’s services. This creates a baseline and spreads the cost of security across its client base. It is essential to understand your outsourcer’s baseline and request additional security if your project requires it.

Before entering into an outsourcing agreement, it is also important to consider legal matters. If the outsourcer is providing a “standard” service, it up to your company to ensure that your legal requirements are met – for example, regional data storage compliance and confidentiality legislation.

 Managing multiple outsourcers

Outsourcer management is often neglected despite the fact that many companies outsource different parts of a project to a range of suppliers. For example, one company might handle the telephony infrastructure, while another manages WAN. In this situation it is essential to ensure both outsourcers deliver the same level of security for their services. It is also crucial to establish clear communication between the various outsourcers and internal departments – especially during periods of disruption or change.

 Incident management

Incident management (both poor and effective) has significant legal, reputational and operational impacts. It is essential to establish a process that dictates when a security incident is detected by your outsourcers, it is adequately evaluated, and reported to you within a predetermined timeframe.

Before entering an outsourcing agreement, ensure that the outsourcer’s obligations are clearly stated and check to confirm the outsourcer doesn’t have any legal constraints that are incompatible with your business.

Conclusion

Whatever part of your IT or process is outsourced, it is essential to ensure all security aspects are fully considered and met, and each outsourcer delivers the same level of security for their services. Detailed consideration of these challenges will allow businesses to benefit from the cost and productivity gains offered by outsourcing, while maintaining strategic security plan of the business.

Today’s CSO must take a 360 degree view of the project in order to ensure requirements are met and managed efficiently, and incidents will be detected and dealt with correctly.

Original Publication

Six tips for mobile device management security

Posted on by
Reply

There has been a lot of discussion this year about the increasing influx of consumer devices being used for both professional and personal purposes. Many organisations are feeling a little overwhelmed as they try to work out appropriate security levels and device management boundaries. When you take into consideration all the platform and application updates chewing through corporate bandwidth, plus the potential for rogue applications and malware to gain illicit access to company data, there are many headaches for security managers to deal with.

Here are six tips to help get the efficient and secure management of mobile devices under control:

1. Have a strong mobile policy

This may seem like an obvious tip, but there is often a clear disconnect between employees and employers’ expectations of how consumer devices will be used in the enterprise. Research from IDC found that not only were workers using their devices at twice the rate, they also tended to think employers were far more permissive of the use of consumer devices than they actually were. It is therefore very important to have a mobile use policy clearly defined to avoid these kinds of misunderstandings.

A mobile usage policy is a framework that defines who the users are and what devices, platforms and applications they can and can’t use. Enterprises must clearly define policies around reimbursement for services and what applications users can access via personal devices, along with clear guidance on who controls the data on devices.

2. Create an inventory of assets

How can you be assured of the security of employees’ mobile devices if you don’t know how many are out there and what they are? Implementing a robust and regularly updated inventory management system is a vital part of any mobile device management system. While many businesses do have an inventory of fixed and wireless assets, the majority of them are not updated and validated on a regular basis, leading to the potential for security issues to slip through the cracks via unknown devices or inappropriate usage. Businesses with accurate inventories have much clearer insight into their telecommunication environments and as such, more reliable information on which to base policy decisions.

3. Ensure proper configuration of devices

The sheer number of different devices and platforms out there can make the configuration of devices a challenging process. Factor in entry level handsets, smartphones, tablets with different operating systems and employees working in numerous different locations and the issue becomes even more complex. However, if a device is enrolled with a mobile device management server, a configuration profile defined and managed by IT admin can be implemented, enabling the device to interact with enterprise systems. An appropriate level of encryption can also be added to any commands coming from the server to ensure that settings cannot be altered without proper authorisation.

4. Implement appropriate security

Despite the influx of consumer devices into the workplace, many organisations haven’t implemented stronger security controls in response, leaving them at risk of security breaches or loss of sensitive data. Data encryption is a powerful piece of the mobile security puzzle and yet many businesses do not use it on a regular basis. In addition to implementing data encryption, enterprises need to inform workers about the risks of failing to comply with security protocols – there is a good chance that they are unaware of the risks associated with using their personal devices for professional purposes.

5. Regulate application protocols

Taking into consideration that there are thousands upon thousands of mobile applications out there, strong protocols need to be instituted for the deployment of any new applications and the management of existing applications. Malware is steadily creeping into the app world, so even applications from the app store need to be checked before they are allowed into the enterprise. Such malicious applications can take over the mobile device and operate in the background without the user knowing, searching for sensitive information such as passwords or banking details.

6. Provide training and end-user support

A relatively small percentage of the overall functionality of the average mobile device is used on a regular basis. With devices becoming more and more sophisticated, users could end up massively under-utilising all the functions that are at their disposal. As a result, most enterprises would benefit from providing user training, including how to set up email, device customisation, application selection and usage, understanding browser capabilities, using instant messaging, and mobile data services and understanding device functions and shortcuts. Support and training can increase worker efficiency and also reduce security risks, as employees better understand how their devices work.

Managing employee mobility doesn’t need to be a nightmare. With the right systems put into place, employees and employers alike can reap the benefits of mobility.

Original Publication

The magic of mobility vs the safety of security

Posted on by
Reply

Mobility has become a key part of business operations in recent years. Smartphones and tablets have become an accepted part of everyday business as the workforce becomes more and more dispersed, with managers expecting their employees to remain connected and productive while they are away from the office.

However, rather than being issued a separate device, employees are increasingly using their personal devices for business purposes – opening a big can of worms around what is the appropriate level of security on a personal device used for work.

Next-generation opportunities

Basic applications such as email, calendaring and syncing contacts on smartphones or mobile access to CRM and ERP systems are just the beginning. Before long, companies will be deploying and utilising next-generation apps with consumer-like functionality – such as using GPS, the camera and social networks. For example, a marketing manager may snap a photo of a competitor’s billboard and tag it in a database for market research, or use social networks during a meeting to access information for reference or demonstration.

The real challenge for businesses is how to balance this revolution in technology and ways of working with the need to maintain organisational security. IT departments may want to disable camera functions on smartphones to protect data, or ensure that any data on an employee’s phone is encrypted, but users are unlikely to accept such major limitations on their personal devices.

Mobile Enterprise Challenge

In the past, most IT departments have tried to manage the increased complexity of mobile devices by limiting the number of platforms supported, such as only allowing a BlackBerry as a smartphone, or Windows laptops for computing. However, this approach is no longer particularly practical as the influx of consumer devices into the workplace continues to rise. Trying to force such a policy onto employees would likely result in poor adoption of the service.

So what is a business to do? All in all, the mobile enterprise needs the same support as offered to standard PCs. As mobile devices have become progressively more complex, they have the same issues as PCs, such as data security, data management and application support. Plus, with companies embracing more than just one mobile platform, the IT department will need to invest in tools that can manage devices powered by different operating systems. Typical mobile device issues that will need to be secured and managed include assets and settings, passwords, connectivity control and software deployments and updates.

Mobile strategies

Obviously, the biggest potential management headache for IT departments is security. Considering the average smartphone has 8GBs of memory, employees have enough potential to put a serious amount of corporate data at risk through a compromised device, or by losing it altogether.

Designing an appropriate security policy is crucial for mobile application deployment as it gives enterprises the platform and confidence to do so much more with their mobile strategy. There are three cornerstones of security that need to be covered when developing a mobile device strategy:

  • Confidentiality: ensure that data is not shown to the wrong people
  • Integrity: ensure that it is not possible to make unauthorised changes to either data or the system
  • Availability: ensure that the data is available at all times for authorised users.

Security tools also need to be able to support a range of activity such as patch management, keeping applications secure with no vulnerabilities, protecting against malicious code and blocking unauthorised device access to corporate resources. In addition, they also need to give the enterprise the ability to remotely lock or wipe devices and enforce the encryption of confidential data.

Taking the time to develop an appropriate mobility strategy is vital for enterprises. With the right protocols and security in place, employers and employees alike can reap the benefits of increased flexibility and efficiency.

Original Publication

IP voice security: are you susceptible or strong?

Posted on by
Reply

Undoubtedly, corporations are realising the benefits of IP voice systems. Voice over internet protocol (VoIP) can bring substantial cost savings and productivity enhancements to a business by transforming its circuit-switched networks to IP packet switching networks and running voice and data applications over a single infrastructure. However, businesses need to be aware that there are potential risks involved, they need to take some necessary steps to protect their interests.

When voice and data are merged onto a single network, voice becomes an application on the network and is, therefore, exposed to the same threats as data applications. These threats include infrastructure and application-based attacks, denial-of-service (DoS) attacks, eavesdropping, toll fraud and protocol-specific attacks. However, with the right procedures in place, VoIP security risks and threats can be managed and mitigated—maximising the benefits of VoIP while minimising exposure.

Infrastructure and application-based attacks

In VoIP, voice is essentially an application on the data network, fine-tuned to maintain voice-quality performance. VoIP equipment and end-point devices such as IP phones are becoming standardised and commoditised just like other data components such as PCs—meaning that VoIP is just as vulnerable to cyber-attacks. Hackers can exploit voice devices and disrupt the network from normal service and/or perform criminal actions such as data theft.

IT managers need to maintain current patch levels on all IT and network equipment and applications, and have appropriate anti-virus software installed and up-to-date. Virtual local area networks (VLANs) can also be implemented and used to protect voice traffic from data network attacks. By implementing application gateways between trusted and untrusted zones of the network, a VLAN will complement the protection offered by corporate firewalls.

Denial-of-service (DoS) attacks

A DoS attack occurs when someone deliberately floods a particular network with so much illegitimate traffic that it blocks legitimate traffic. Obviously, if your voice traffic is being transmitted over the same network, a DoS attack will have significant impact on business operations.

DoS attacks are difficult to stop and prevent, but proper intrusion prevention practices, special network devices and proper patch updates can minimise the risk of exposure. In order to prevent data network problems from affecting voice traffic, voice and data traffic should logically be separated from administrative traffic. Traffic shaping can also provide another layer of protection and control for the network.

Eavesdropping

Intercepting data traffic is a trivial endeavour for most hackers so it stands to reason that with voice and data convergence, the same can be said for voice traffic over the network. Many tools are freely available to collect packets associated with VoIP conversations and reassemble them for illicit purposes. Two measures that can be taken to prevent eavesdropping include isolating VoIP traffic using virtual private networks (VPNs) and applying encryption on voice packets. However, IT managers need to carefully evaluate the use of encryption of VoIP as it can increase latency in the network. Encryption of voice data could be selectively applied based on business requirements, for example, encryption and decryption can be used only for those conversations over untrusted networks. When choosing a managed service provider, companies should ensure that appropriate security protocols are actively used by the potential provider to ensure secure conversations within the network.

Toll fraud

Just as with traditional voice systems, toll fraud cannot be ignored when considering VoIP systems. Using toll fraud, attackers gain unauthorised access to a private branch exchange (PBX) call-control system to make long-distance or international calls, which can mean significant financial impact to the business. Poor implementation of authentication processes could allow calls from unauthorised IP phones and/or allow unauthorised use of the VoIP network. Companies need to impose proper control for access to VoIP systems, including gateways and switches, in order to avoid the occurrence or toll fraud. Centralisation of management and configuration control is also recommended.

Protocol-specific threats

Since VoIP was developed on an open standard, the protocols that support communications are well known and thus vulnerable to probing for their weaknesses and security flaws. Session initiation protocol (SIP) is gaining popularity – SIP is a session and call-control protocol, components of which are used by standards-based IP PBX and IP telephony systems. In addition to the standard IP vulnerabilities, SIP brings additional risks.

SIP is a text-based protocol, like the common HTTP and SMTP. Therefore attackers can easily monitor and analyse traffic and then transition into various application-level attacks. Attacks can include impersonation of registration for system access, unauthorised access to corporate directory information, taking control of calls to disrupt business and also placing unsolicited calls and voice messages. Obviously, in a malicious attack, this could be highly detrimental to a business. It managers need to be aware of these vulnerabilities and thus implement strong authentication and authorisation processes.

IP voice security

While convergence and VoIP implementations are fast becoming mainstream among multinational corporations, they are, at the same time, posing serious security challenges. Whether you are planning to build your own converged network or utilise the services of a managed service provider, the primary goal should be the implementation of VoIP security that is properly built and validated, with ongoing management support. Security has to be managed through proactive monitoring, event management, remediation and regular follow-up to ensure a stable and reliable corporate communications infrastructure. However, with the right security in place, VoIP can be a valuable asset to a company.

Original Publication