VoIP Security and the Circle of Trust

Now is the time to build our castle walls and moats before The Bad Guys do to VoIP what they did to email, according to security experts. With 90 percent of today's email messages spam, another 5 percent phishing -- email attacks soliciting financial and personal information that are tailored to look like legit email – and 3 percent carrying viruses, SMTP has been seriously abused.

Will VoIP go down the same path? Security experts have been talking about SPIT (Spam over Internet Telephony) and vishing (voice phishing) for a couple of years, as well as probing existing implementations of VoIP for vulnerabilities. VoIPshield, which also happens to sell security solutions, says the entire industry is not taking security seriously enough because no one has "felt any pain" yet. Bad guys are likely in the recon phase.

Pinning down vulnerabilities and existing flaws in VoIP is relatively straightforward, but blocking exploits and spam could pose more significant challenges. There's no pre-screening process (yet) for a VoIP call, unlike the anti-virus and anti-spam filters on e-mail. Researchers are looking at analyzing signals and signals in audio packets along with building a "circle of trust" filter for inbound callers; think of it as the LinkedIn method of security, with known callers getting the highest rating while people who are three and four levels removed from you receiving a lower one.

For more:
- Government Computer News weighs in on VoIP Spam and malware. [1]

Related articles:
Survey: U.S. firms lax about VoIP security [2]
VoIPshield Laboratories Uncovers Over 100 Vulnerabilities in Leading Enterprise VoIP Systems [3]