The problem with VoIP Security
If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!
I was quoted in a recent Boston Globe article on VoIP security. Someone is always raising the red flag of FUD when they see a quote that screams “beware.” And yes, my company provides VoIP Security services. But I’m not trying to scare anyone into buying my services. If you think I am off the ball on the true danger within VoIP technology consider the following:
Everytime I’ve speak about VoIP security I have always cut the vendors a lot of slack. VoIP code is inherently complex and difficult to make secure. I don’t think vendors are ignoring the problem, its just difficult to get right. The fact remains that not many people are talking about this fundamentel insecurity in VoIP products. Bad code. And in that since its like 1999 all over again.
I agree with your pro-active approach by setting bad code on number one. But don’t forget that code is written by humans and they make mistakes. Always.
Take buffer overflows, we have been knowing them for years and still every day those vulnerabilities pop up.
It will take a generation and education changes to produce coders with a security mindset. At the end of the day, it’s the responsibility of you and me, security pros to provide the confidentiality of VoIP.
Not coders they deliver complex functionality.
For now, the companies spend more time in Return On Investment and functionality requirements…
If a VoIP connection can not match up with normal PSTN, it just won’t be deployed.