VoIP security auditing model based on COBIT 4.1

The article justifies the need for a specific model of VoIP security auditing that evaluates the incidence of security problems and addresses the challenges in terms of protecting IT resources. The current VoIP security problems are determined based on the analysis of auditing frameworks, and a model based on COBIT 4.1 is proposed to address these problems. As an innovation, the model includes the security culture plan and social engineering from the approach of the user as an IT service customer. In this work, we present the validation of the surveys using Cronbach's alpha and the results of the statistical average of the surveys applied to experts in social engineering and security auditing in VoIP. The proposed VoIP security auditing model, called VoIPSAM, considers four domains – plan and organise, acquire and implement, delivery and support. and monitor and evaluate – which consider specific security policies for its application.

This paper presents a new robust mutual authentication scheme known as SA-SIP for the protection of Session Initiation Protocol (SIP) in VoIP systems. This scheme differs in incorporating an additional version of the Secure PAKE that makes it possible to achieve mutual authentication while avoiding storing secret information on clients. This innovation helps to solve a critical issue of physical attacks on credentials stored during the traditional authentication process. The importance of this work, therefore, is to perform enhancement to both security and performance in SIP-based VoIP systems. First, since PAKE is incorporated in the proposed scheme, some of the attacks such as man-in-the-middle, impersonation, registration hijacking, and denial of service are eliminated but at the same time, the existing security of VoIP is also improved by eliminating the vulnerability of existing systems where credentials are usually stored. Second, the scheme is proven theoretically using the formal tool, ProVerif. Finally, the result of the performance analysis is that SA-SIP still has low computational complexity which makes the proposed scheme suitable for deployment in practical systems. Thus, by providing both security and performance characteristics SA-SIP has the advantage of being an effective and high-impact change in VoIP security.

Crypto Phones represent an important approach for end-to-end VoIP security, claiming to prevent wiretapping and session hijacking attacks without relying upon third parties. In order to establish a secure session, Crypto Phones rely upon end users to perform two tasks: (1) checksum comparison: verbally communicating and matching short checksums displayed on users' devices, and (2) speaker verification: ascertaining that the voice announcing the checksum is the voice of the legitimate user at the other end. However, the human errors in executing these tasks may adversely affect the security and usability of Crypto Phones. Particularly, failure to detect mismatching checksums or imitated voices would result in a compromise of Crypto Phones session communications. We present a human factors study, with 128 online participants, investigating the security and usability of Crypto Phones with respect to both checksum comparison and speaker verification. To mimic a realistic VoIP scenario, we conducted our study using the WebRTC platform where each participant made a call to our IVR server via a browser, and was presented with several challenges having matching and mismatching checksums, spoken in the legitimate user's voice, different speakers' voices and automatically synthesized voices. Our results show that Crypto Phones offer a weak level of security (significantly weaker than that guaranteed by the underlying protocols), and their usability is low (although might still be acceptable). Quantitatively, the overall average likelihood of failing to detect an attack session was about 25-50%, while the average likelihood of accepting a legitimate session was about 75%. Moreover, while the theory promises an exponential increase in security with increase in checksum size, we found a degradation in security when moving from 2-word checksum to 4-word checksum.

VoIP and PBX Security and Forensics

Voice over IP is a major trend in applications for wireless networks, but even so it is not immune to the risks usually related with IP networks. Proposed solutions for VoIP security are already in the market, but these solutions must take into account the real-time constraint of voice service and their mechanisms should address possible attacks and overhead associated with it. One of these solutions is to use IETF IPSec to guarantee confidentiality in order to address security design holes of wireless VoIP networks. This article performs an experimental comparison of the impact of encryption mechanisms on voice speech quality in widely deployed wireless technologies: 802.11 and Bluetooth. Evaluates the upper bound on number of simultaneous VoIP calls which can be placed in a single cell of both networks when security is applied and uses the computational model E-Model to assess quantitatively the quality of service.

Multimedia data and information systems manage, communicate, and present multimedia data including text, images, audio and video. We need to ensure that the data is protected from unauthorized access as well as malicious corruption. Digital watermarking techniques that insert hidden copyright messages into the multimedia data are needed. Furthermore, since multimedia data is being used for security applications such as surveillance and monitoring, protecting privacy of the individual is crucial.This presentation will discuss the developments and directions for securing multimedia systems. First we will first issues on incorporating security into multimedia data and information systems. We will review various security mechanisms and access control policies and discuss the applicability of these mechanisms and policies for multimedia data. Second, we will examine the developments of digital libraries, which can be considered to be special kinds of multimedia data and information systems, and discuss various developments on secure digital libraries. Access control models such as role-based access control and copyright protection methods for digital libraries will be discussed. Third, we will discuss the developments in securing multimedia communication systems including VoIP security. Emerging novel techniques in digital watermarking as well as the use of multimedia data for computer forensics analysis will also be discussed. Finally, the applications of multimedia data for surveillance and monitoring as well as video data analysis for national security applications will be discussed. Privacy violations that could occur through multimedia data mining as well as directions for privacy preserving surveillance and privacy preserving multimedia data mining will be discussed.

The Voice over IP Security Alliance (VOIPSA) established in February 2005 has emerged to help organizations understand and mitigate VoIP security risks.

We present a comprehensive survey of Voice over IP security academic research, using a set of 245 publications forming a closed cross-citation set. We classify these papers according to an extended version of the VoIP Security Alliance (VoIPSA) Threat Taxonomy. Our goal is to provide a roadmap for researchers seeking to understand existing capabilities and to identify gaps in addressing the numerous threats and vulnerabilities present in VoIP systems. We discuss the implications of our findings with respect to vulnerabilities reported in a variety of VoIP products. We identify two specific problem areas (denial of service, and service abuse) as requiring significant more attention from the research community. We also find that the overwhelming majority of the surveyed work takes a black box view of VoIP systems that avoids examining their internal structure and implementation. Such an approach may miss the mark in terms of addressing the main sources of vulnerabilities, i.e., implementation bugs and misconfigurations. Finally, we argue for further work on understanding cross-protocol and cross-mechanism vulnerabilities (emergent properties), which are the byproduct of a highly complex system-of-systems and an indication of the issues in future large-scale systems.

This Popularity of VoIP and SIP technologies has been started at last years. SIP applications will have an important place in the future. VoIP/SIP security technologies are not known as much as TCP/IP's security world. Hence, VoIP/SIP security technologies, developments and researches are very important for academic and commercial. In this study, signaling vulnerabilities of registration mechanism in Session Initiation Protocol (SIP) which is used in next generation communication environment known as Unified Communications (UC) systems has been mentioned. The results of registration removal attack which has been carried out at VoIP security laboratory environment are shared, anatomy of attack and the defense strategies for that attack type are mentioned.

VoIP is a service that changes the analogue audio signal into a digital signal and then transfers the audio information to the users after configuring it as a packet; and it has an advantage of lower price than the existing voice call service and better extensibility. However, VoIP service has a system structure that, compared to the existing PSTN (Public Switched Telephone Network), has poor call quality and is vulnerable in the security aspect. To make up these problems, TLS service was introduced to enhance the security. In practical system, however, since QoS problem occurs, it is necessary to develop the VoIP security system that can satisfy QoS at the same time in the security aspect. In this paper, a user authentication VoIP system that can provide a service according to the security and the user through providing a differential service according to the approach of the users by adding AA server at the step of configuring the existing VoIP session is suggested. It was found that the proposed system of this study provides a quicker QoS than the TLS-added system at a similar level of security. Also, it is able to provide a variety of additional services by the different users.

Although VoIP offers lower cost and greater flexibility, it can also introduce significant risks and vulnerabilities. This article explains the challenges of VoIP security and outlines steps for helping to secure an organization's VoIP network.

Obtaining VoIP security through the IPsec protocol increases packet size, thus substantially increasing the network overhead. One way of mitigating such a problem consists of multiplexing calls so that the transmission of redundant data is reduced. The performance of such technique is directly linked to the number of concurrent calls; however, in more constrained scenarios, the existence of several simultaneous calls is not a premise that may be always assumed. Expanding packets' grouping time is an approach that can improve data compression in scenarios with only a few simultaneous calls; notwithstanding, such an approach reduces the quality of calls, increasing the end-to-end delay. In this work we propose an adaptive multiplexing solution based on the E-model recommendation, which objective consists of increasing the multiplexing capacity yet respecting the expected levels of quality during conversation. Results have shown that the proposed solution makes it possible to attain a higher compression rate when compared to traditional methods in favorable scenarios and better quality in unfavorable ones.