2. Agenda Voice Security Architecture VoIP Risk VoIP threats Service disruption Design Consideration Attacks

3. Telephony hacker had high degree of skill Cybercrime activity include: - DOS for extortion - Hijacking for reselling Voice traffic need different treatment to data Security control,policies and technology is essential to protecting assets

4. Good security starts with good architecture Three basic Voip paradigm System evolved from Traditional PBX System evolved from data switch platform System design for VoIP

5. Voice change risk by adding : Complexity New Access point New device and protocols Risk categories that affected is: Line safety Confidentially & Availability Operational & Financial Reputation

6. VoIP threats is: Service disruption Service interception Service fraud and abuse

7. VoIP threats is: Service disruption Service interception Service fraud and abuse

8. VoIP threats is: Service disruption Service interception Service fraud and abuse

9. Poor design Attack on PBX include malware DOS Equipment failure or rogue device

10. Separate data and voice network Use PVlan Use NAT Use Switching device to limit User Agent interference Consider UPN(User Personalized Network ) Consider Scalability End-to end security

11. Common voice attack Eavesdropping Packet spoofing and masquerading Replay attacks Hijacking and malicious call Voice mail bombing, SPAM,…