Voice over IP Software Risk Alert
Fortify Software recently warned companies using Voice over IP (VoIP) private branch exchange (PBX) software to be aware that the complex program code involved with Internet telephony can make such systems vulnerable to hacker attacks. The company’s warning comes after the FBI announced that users of Asterisk VoIP PBX software should upgrade to the latest edition of the package to avoid a security flaw that lets hackers dial into their telephone systems.
According to Fortify, the problem facing small business users of VoIP systems is that although the PBX is hooked up to the regular telephone network and a company’s broadband Internet connection, most firms’ IT security resources do not extend their complete protective envelope around the PBX platform. This means that VoIP users who think their telephone system is covered by, for example, a firewall application, could wake up with a nasty surprise on the phone bill front, after their PBX system has been compromised.
Fortify added that many VoIP applications are either open source, freeware or shareware, meaning they have not usually undergone code auditing and program vulnerability analysis. That’s not to say that such software is not capable of performing the required function. Firms need to be aware of the risks involved.
In Asterisk’s case, for example, a number of vendors have installed the PBX software on a specialist diskless server that not only increases security levels, but also boosts reliability and call quality. This is clearly a step forward, and may be an option for any company worried about their VoIP system security.
Tags: Business Continuity, Disaster Recovery, network security, Telecommunications, Voice over IP
