June 18, 2021
The National Security Agency (NSA) recently released mitigations and best practices that system administrators should follow if they want to secure Unified Communications (UC) and Voice and Video over IP (VVoIP) call-processing systems.
UC and VVoIP are call-processing systems used in enterprise environments for various purposes such as video conferencing, instant messaging and project collaboration.
Because these communication systems are highly integrated with other IT devices in corporate networks, they also increase the vulnerability by introducing new vulnerabilities and the potential for covert access to an organization’s communications.
In addition, inadequately secured UC/VVoIP devices are exposed to the same security risks and are targeted by cyberattackers through spyware, viruses, software vulnerabilities and other malicious means if they are not sufficiently secured and configured.
Administrators should take important steps to minimize the risk of their organization’s corporate network being attacked by the use of UC/VVoIP systems:
- Segment enterprise network using Virtual Local Area Networks (VLANs) to separate voice and video traffic from data traffic.
- Use access control lists and routing rules to limit access to devices across VLANs.
- Implement layer 2 protections and Address Resolution Protocol (ARP) and IP spoofing defenses.
- Secure PSTN gateways and Internet perimeters by authenticating all UC/VVoIP connections.
- Always keep software updated to mitigate UC/VVoIP software vulnerabilities.
- Authenticate and encrypt signalling and media traffic to prevent impersonation and eavesdropping by malicious actors.
- Deploy session border controllers (SBCs) to monitor UC/VVoIP traffic and audit call data records (CDRs) using fraud detection solutions to prevent fraud.
- Maintain backups of software configurations and installations to ensure availability.
- Use identification cards, biometrics, or other electronic means to control physical access to secure areas with network and UC/VVoIP infrastructure.
For more information, read the original story in BleepingComputer.
