Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures

By Peter Thermos and Ari Takanen

Book Overview

In Securing VoIP Networks, two leading experts systematically review the security risks and vulnerabilities associated with VoIP networks and offer proven, detailed recommendations for securing them.... This description may be from another edition of this product.

• Format: Paperback
• Language: English
• ISBN: 0321437349
• ISBN13: 9780321437341
• Release Date: August 2007
• Publisher: Addison-Wesley Professional
• Length: 359 Pages
• Weight: 1.30 lbs.
• Dimensions: 0.7" x 7.1" x 9.2"

Customer Reviews

Valuable VoIP Security Information

There are many benefits to VoIP and IP-based communications. However, relying on your network infrastructure to transport your telephone communications renders your telecommunications vulnerable to virtually all of the same issues and threats as your network. On top of that, there are also unique attack vectors introduced by VoIP. As organizations race to deploy VoIP and experience the benefits, most would probably benefit from slowing down to consider the security implications and develop appropriate controls to protect their communications. In Security VoIP Networks: Threats, Vulnerabilities, and Countermeasures, authors Peter Thermos and Ari Takanen do a superb job of illustrating the insecurities of VoIP. Not to suggest that it is just so inherently insecure that it should never be used, but C-level execs, and IT managers and administrators should be familiar with the information in this book before moving forward to deploy VoIP. Chapter 2, 'VoIP Architecture and Protocols', provides a solid foundation on the basic components and technologies that make up VoIP. It is the next couple chapters that are the most valuable though. In 'VoIP Vulnerabilities', and 'Threats and Attacks', Thermos and Takanen demonstrate the weaknesses of VoIP and the simplicity with which VoIP communications can be disrupted or intercepted if not set up properly. Chapters 5 - 8 analyze different security controls and protection mechanisms. One issue I had was that it was difficult to draw a one-to-one correlation and find the security countermeasures to defend against attacks identified earlier. The information is solid though. The book wraps up by providing a look at what a VoIP security framework should entail, and architecture diagrams to help you create and deploy a secure VoIP solution.

Good introduction to VoIP security

This book was useful for understanding VoIP security protocols, including somewhat obscure ones such as SIP over TLS. The threats section looks like it will be valuable for convincing managers to take VoIP security seriously. I used the book to evaluate Microsoft's new VoIP products (I work for an analyst firm, Directions on Microsoft, that covers the company) and found it very helpful. I wish that the book were organized to relate the threats and attacks to the countermeasures more clearly -- I find it easier to understand a security protocol when someone shows me what attacks it can and can't block. I'd like to see a book like this that focuses on SIP/RTP VoIP in more depth and leaves out H.323 -- I know H.323 is more widely deployed, but SIP/RTP seems to be where the big vendors are headed. Still, these are minor quibbles -- I would recommend this book to anyone who needs an introduction to VoIP network security. Rob Helm

If you have any doubt whether VoIP is vulnerable . . .

A quick read of the first 1/3 of the book will cure you of your doubts VoIP can be attacked forever! It was almost painful reading; exploit approach after exploit approach, but I mean that in a good way like the pain you feel in your muscles after exercise. I was excited when this book came out, I have been following some of the author's Thermos and Takanen work and I think they were the perfect team for this book. I feel that Chapter 3 and 4, threats and attacks and VoIP vulnerabilities are by far the strongest chapters and they alone are worth the purchase price of the book. The majority of the rest of the book is focused on mitigating controls and it is solid writing, solid research, but not quite at the level of the pen test side of the book. Chapters 10 and 11 are invaluable to anyone considering a VoIP deployment including a deployment where you are depending on a service provider. The charts and diagrams are clear and easy to understand, the whole book team is to be commended for that, this is a complex subject. If you are even thinking about VoIP, you should read this book.