1. Private Branch eXchange (PBX)
sanmi fakiyesi

2. PBX overview PBXs are also referred to as:
PABX – Private Automatic Branch eXchange
EPABX–Electronic Private Automatic Branch eXchange
PBXs make connections among the internal telephones of a private org – usually a business and also connect them to the public switched telephone network (PSTN) via trunk lines.

3. Purpose of PBX
One of the principal purposes of a PBX is to save the cost of requiring a line for each user to the telephone company’s central office.
it is easier to call someone within a PBX because only three or four digits need to be dialed.

4. PBX issues
A private branch exchange (PBX) is a sophisticated computer-based switch that can be thought of as essentially a small, in-house phone company for the org. that operates it.
As part of organization’s communication infrastructures, it security is a concern.
PBX has moved from analog technology to software-based digital technology.
As a result of it capabilities and therefore deployment by orgs, new doors of opportunities have been opened to the intruders to exploit the system.

5. Current trends Currently there are four distinct types of PBX in use
PBX (Private and circuit switched)
Hosted/Virtual PBX
IP PBX (Private and packet switched)
Mobile PBX

6. Attributes of today’s PBX
Ability to use more than two telephone trunk (multiple phone) lines.
The use of digital phone that permit integrated voice/data workstations.
Scalable computer-based PBX system.
Distributed arch. with multiple switches in hierarchical or meshed configuration to provide enhanced reliability.
Non-blocking configurations where all attached devices can be engaged in calls simultaneously.
The network of lines within the PBX.
An operator console or switchboard for a human operator.

7. PBX Risks Some of the threats to PBX are: Theft of service
Disclosure of information without authorization either by deliberate action or by accident
Data modification – reordering, deletion or modification
Unauthorized access
Denial of service
Traffic analysis – a passive attack

8. PBX Peculiar Threats & Vulnerabilities
External access/control – PBXs require remote maintenance by vendor/updates by the manufacturer instead of relying on local administrators to make OS updates and patches which exposes the coy to large pool of outside parties.
Feature richness –the wide variety of features available on PBX provide the possibility of unexpected attacks. (e.g a feature may be used by an attacker in a manner that was not intended by its designers) -see exhibit 5.4 on page 435 for PBX features and corresponding risks

9. Other weaknesses
Uncontrolled definition of direct inward dial (DID) lines, which would allow an external party to request a dial tone locally, and then make an unauthorized long-distance phone call.
Lack of system access controls for long-distance phone calls (e.g unchanged default system vendor password, 24/7 availability of PBX lines).
Lack of blocking controls for long-distance phone calls to particular numbers (e.g hot nos or cellular nos).
Lack of control over the nos destined for fax machines and modems.
Not activating the option to register calls, which enables the use of call-tracking logs.

10. PBX SECURITY
Configure and secure separate and dedicated administrative ports.
Control the definition of DID lines to avoid an external party requesting a dial tone locally, disabling that person’s ability to make unauthorized long-distance calls.
Establish system access controls over long-distance phone calls.
Block controls for LDCs to particular nos.
Establish control over the nos destined for fax machines and modems.
Activate the option to register calls, enabling the use of call-tracking logs.

11. PBX SECURITY -contd Physical security of the PBX facilities.
Usage of appropriate anti-tamper devices on critical hardware components.
Where the vendor/manufacturer needs a remote access to the switch, dial-back modem usage is a basic precaution.
Establish strong authentication of external technicians.
Keep maintenance terminals in a locked, restricted area.
Turn off maintenance features when not needed, if possible.
Regular updates of software patches.
Deployment of PBX firewall to enhance it protection.