1. www.arcbus.com ISSA June 2005 Luncheon Are You Ready for VOIP? Tim McCreight – CISSP CPP ARC Business Solutions Inc.

2. www.arcbus.com Warning: This presentation contains violence, coarse language, mature themes and honest opinions. Viewer discretion is advised.

3. www.arcbus.com Agenda Introduction to VoIP Marketing Pitch Security Concerns What you should be asking… Question and Answer Session

4. www.arcbus.com

7. VOIP in the News

8. www.arcbus.com Intro to VOIP - Internet Uses an analog phone & adaptor Can use a PC Plugs into DSL or broadband Connects to other IP users, or PSTN Examples: Vonage, Skype

9. www.arcbus.com Intro to VoIP – IP PBX Platform resides on your premise Makes use of existing infrastructure Blends data and voice within your network Separates traffic to the PSTN Security is primarily your concern

10. www.arcbus.com Intro to VoIP – Hosted Solution Platform is now hosted by your IXC/ILEC/CLEC You share an access point with the Service Provider Blends data and voice from your network to the SP SP’s security now becomes a critical component Image available from www.networkmagazine.com, January 2004 issue

11. www.arcbus.com Hosted IP Scenario - Example

12. www.arcbus.com “Have we got a deal for you…” One network No additional CAPEX Cost savings on staff and network Mobility Cool features! Help for road warriors Advanced feature sets Not quite 5 9’s, but close…

13. www.arcbus.com Those Mysterious 9’s 99.999 percent uptime = 5 minutes unscheduled outage in one year 99.9 percent uptime = 8.8 HOURS of unscheduled outage 99 percent uptime = 87.6 HOURS of unscheduled outage

14. www.arcbus.com …And now the bad news… User expectations E911 concerns and limitations Man in the middle attacks, et al. Network congestion DDOS vulnerabilities Spam over Internet Telephony (SPiT) SIP/H.323 Vulnerabilities

15. www.arcbus.com More Security Concerns Impersonation, LD fraud Packet inspection – ntwk and app layer Remote access – yours and vendors Insecure paths Policies and procedures Vendor response and security Network monitoring

16. www.arcbus.com What You Should Be Asking Service Level Agreements Security Defenses in Place – at Carrier Security Operation Centre – at Carrier CIRT Team in place – at Carrier and you! Response to Incidents by Carrier Protection from other customers within Carrier network Fraud protection

17. www.arcbus.com …more Questions Cost to upgrade IS/IT equipment for QoS, PoE, etc. throughout your network Appropriate firewall at YOUR perimeter, to monitor traffic between you and the carrier What controls do YOU have in place: AV, IDS, patch management, policies… E911 issues: mitigation strategies, etc.

18. www.arcbus.com Q & A Session

19. www.arcbus.com

20. Presented By: Tim McCreight, CISSP CPP Director, Security Consulting Division ARC Business Solutions Inc. (780)702-5022 ext. 106 tmccreight@arcbus.com