Voice over IP Security (Networking Technology and over one million other books are available for Amazon Kindle. Learn more
Only 1 left in stock.
Ships from and sold by Amazon.com.
Gift-wrap available.
Voice over IP Security has been added to your Cart
+ $3.99 shipping
Used: Very Good | Details
Condition: Used: Very Good
Comment: Former Library book. Great condition for a used book! Minimal wear. 100% Money Back Guarantee. Shipped to over one million happy customers. Your purchase benefits world literacy!
Access codes and supplements are not guaranteed with used items.
Have one to sell? Sell on Amazon
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See this image

Voice over IP Security Paperback – September 19, 2008

6 customer reviews
ISBN-13: 978-1587054693 ISBN-10: 1587054698 Edition: 1st

Buy New
Price: $60.00
11 New from $30.00 19 Used from $0.03
Amazon Price New from Used from
Kindle
"Please retry"
Paperback
"Please retry"
$60.00
$30.00 $0.03
Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student


Hero Quick Promo
Save up to 90% on Textbooks
Rent textbooks, buy textbooks, or get up to 80% back when you sell us your books. Shop Now
$60.00 FREE Shipping. Only 1 left in stock. Ships from and sold by Amazon.com. Gift-wrap available.

Editorial Reviews

About the Author

Patrick Park has been working on product design, network architecture design, testing, and consulting for more than 10 years. Currently, Patrick works for Cisco as a VoIP test engineer focusing on the security and interoperability testing of rich media collaboration gateways. Before Patrick joined Cisco, he worked for Covad Communications (a VoIP service provider) as a VoIP security engineer focusing on the design and deployment of secure network architecture and lawful interception (under the Communications Assistance for Law Enforcement Act [CALEA]) with various tools and solutions. Patrick graduated from Pusan National University in South Korea, where he majored in computer engineering. While attending graduate school, he wrote the book Web Server Programming with PHP. Patrick lives with his wife and children in Los Gatos, California.

Excerpt. © Reprinted by permission. All rights reserved.

Introduction

Introduction

Voice over Internet Protocol (VoIP) has been popular in the telecommunications world since its emergence in the late 90s, as a new technology transporting multimedia over the IP network. In this book, the multimedia (or rich media) includes not only voice, but also video, instant message, presence data, and fax data over the IP network.

Today people commonly make phone calls with IP phones or client software (such as Skype or iChat) on their computer, or send instant messages to their friends. This gives them convenience and cost savings. Many telecommunications companies and other organizations have been switching their legacy phone infrastructure to a VoIP network, which reduces costs for lines, equipment, manpower, and maintenance.

However, the benefits of VoIP are not free. There are disadvantages to using VoIP. The integrated rich media makes it difficult to design the network architecture. Multiple VoIP protocols and different methods of implementation create serious interoperability issues. Integration with existing data networks creates quality of service issues. The fact that so many network elements are involved through open (or public) networks creates serious security issues, because each element and network has vulnerable factors.

The security issues especially are becoming more serious because traditional security devices (such as firewalls) and protocols (such as encryption) cannot protect VoIP services or networks from recent intelligent threats.

This book focuses on the important topic of VoIP security by analyzing current and potential threats to demonstrating the methods of prevention.

Goals and Methods

The most important goal of this book is to give you correct and practical answers for the following questions:

  • What are the current and potential threats?

  • What are the impacts of those threats?

  • Why are current data security devices not able to protect against recent intelligent threats?

  • How can you protect VoIP services and networks from those threats?

  • What is lawful interception and how do you implement it?

One key methodology used in this book is to give you hands-on experience of current well-known threats by simulating them with publicly available tools. Through the simulation, you can realize the characteristics and impacts of those threats and have a better understanding of mitigation.

Another key methodology is to give you detailed examples of protection methods with protocols, products, and architecture so that you may apply them to real VoIP service environments.

This book also gives you clarification of VoIP security concepts, definitions, standards, requirements, limitations, and related terms.

Who Should Read This Book

This book is NOT designed to give you information about VoIP in general which is available almost everywhere. Instead, this book focuses on VoIP security and gives practical information to people like those in the following list:

  • Managers or engineers who are planning to employ VoIP systems in their organizations

  • System engineers or architects who design and implement VoIP networks

  • Network administrators who administer, upgrade, or secure networks that include VoIP elements

  • Security consultants who perform security assessments for VoIP environments

  • Developers who implement VoIP products or solutions

  • Researchers and analysts who are interested in VoIP security

This book assumes that the readers have some minimal knowledge of networking (such as TCP/IP), operating systems, and VoIP in general (such as IP phones).

How This Book Is Organized

Although this book could be read cover to cover, it is designed to be flexible and allow you to easily move between chapters and sections of chapters to cover just the material that you need more work with.

This book consists of three parts. Part I, "VoIP Security Fundamentals," contains Chapters 1 through 5 and covers VoIP security fundamentals that are essential to understand current threats and security practices. Part II, "VoIP Security Best Practices," contains Chapters 6 through 9 and demonstrates VoIP security best practices with the detailed analysis and simulation of current threats. Part III, "Lawful Interception (CALEA)," contains Chapters 10 through 11 and covers another aspect of VoIP security, Lawful Interception, from basic concept to real implementation.

Chapter 1, "Working with VoIP," provides an overview of VoIP and its vulnerability in general. Chapters 2 through 11 are the core chapters and can be read in any order. If you do intend to read them all, the order in the book is an excellent sequence to use.

The core chapters, Chapters 2 through 11, cover the following topics:

  • Chapter 2, "VoIP Threat Taxonomy"—This chapter defines VoIP threat taxonomy, based on four different categories: threats against availability, confidentiality, integrity, and social context. This chapter is not intended to provide exhaustive lists of current and potential threats, but to define the taxonomy for identifying the threat in the first place, measuring the current and potential impact, and helping implementers to develop protection methods and secure service architecture. Twenty-two typical threats are introduced with examples and features.

  • Chapter 3, "Security Profiles in VoIP Protocols"—This chapter introduces the security profiles of VoIP protocols: SIP, H.323, and MGCP. The content shows how each protocol defines specific security mechanisms and recommends combined solution with other security protocols, such as IPSec, TLS, and SRTP.

  • Chapter 4, "Cryptography"—This chapter provides a high-level understanding of cryptographic algorithms with comprehensible figures, avoiding mathematical details. Well-known cryptographic algorithms are introduced, such as DES, 3DES, AES, RAS, DSA, and hash functions (MD5, SHA, and HMAC). This chapter also covers the mechanism of key management, focusing on key distribution.

  • Chapter 5, "VoIP Network Elements"—This chapter covers what devices are involved in the VoIP network architecture, and how they work for secure services. Session Border Controller, VoIP-aware firewalls, NAT servers, lawful interception servers, customer premise equipment, call processing servers, and media gateways are introduced.

  • Chapter 6, "Analysis and Simulation of Current Threats"—This chapter covers two main topics: detailed analysis and hands-on simulation of most common threats, and the guidelines for mitigation. For the analysis, it examines the detailed patterns, usage examples, and impacts of the threats. For the simulation, it introduces negative testing tools that are available on the Internet so that you can have hands-on experience. The threats that this chapter covers are DoS, malformed messages, sniffing (eavesdropping), spoofing (identity theft), and VoIP spam (voice, instant message, and presence spam).

  • Chapter 7, "Protection with VoIP Protocol"—This chapter demonstrates the details of how to make VoIP service secure with SIP and other supplementary protocols. It focuses on the methodology of protection in these five categories: authentication, encryption, transport and network layer security, threat model and prevention, and limitations.

  • Chapter 8, "Protection with Session Border Controller"—This chapter examines security issues on the VoIP network borders, and provides the methodology of preventing the issues with an SBC. This chapter includes the details of SBC functionality (such as network topology hiding, DoS protection, overload prevention, NAT traversal, and lawful interception), as well as the method of designing service architecture with an SBC in terms of high availability, secure network connectivity, virtualization, and optimization of traffic flow.

  • Chapter 9, "Protection with Enterprise Network Devices"—This chapter demonstrates how to protect the enterprise VoIP network with Cisco devices for practical information. Cisco firewalls, Unified Communications Manager, Unified Communications Manager Express, IP phone, and multilayer switches are used. This chapter includes security features, usage examples, and configuration guidelines for those devices.

  • Chapter 10, "Lawful Interception Fundamentals"—This chapter covers the fundamentals of lawful interception. The topics are definition, background information, requirements from law enforcement agents, the reference model from an architectural perspective, functional specifications, request/response interface, and operational considerations.

  • Chapter 11, "Lawful Interception Implementation"—This chapter demonstrates how to implement lawful interception into the VoIP service environment. It focuses on how the interception request and response work between functional modules, based on industry specifications.


© Copyright Pearson Education. All rights reserved.

NO_CONTENT_IN_FEATURE

Shop the new tech.book(store)
New! Introducing the tech.book(store), a hub for Software Developers and Architects, Networking Administrators, TPMs, and other technology professionals to find highly-rated and highly-relevant career resources. Shop books on programming and big data, or read this week's blog posts by authors and thought-leaders in the tech industry. > Shop now

Product Details

  • Paperback: 384 pages
  • Publisher: Cisco Press; 1 edition (September 19, 2008)
  • Language: English
  • ISBN-10: 1587054698
  • ISBN-13: 978-1587054693
  • Product Dimensions: 7.3 x 0.8 x 8.9 inches
  • Shipping Weight: 1.4 pounds (View shipping rates and policies)
  • Average Customer Review: 4.2 out of 5 stars  See all reviews (6 customer reviews)
  • Amazon Best Sellers Rank: #2,754,390 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

5 star
17%
4 star
83%
3 star
0%
2 star
0%
1 star
0%
See all 6 customer reviews
Share your thoughts with other customers

Most Helpful Customer Reviews

6 of 6 people found the following review helpful By Stephen Northcutt on September 29, 2008
Format: Paperback
I have been carrying this book around with me for a couple weeks now and had a couple long plane flights as well. This is a difficult book to review. The author clearly knows his stuff and the threat treatment is great. However, the material is all over the map. The subtitle talks about good security practices and the book is short on that to be candid. Bottom line, if you are considering a VoIP deployment or wondering how secure/robust your existing deployment is, this is a must read.

My favorite "I never thought of that" scenario in the book was a simple power outage. What if you have twenty thousand IP phones and the power drops . . . then when it is restored all 20k phones start banging the server causing an outage.
1 Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
5 of 5 people found the following review helpful By W Boudville HALL OF FAMETOP 1000 REVIEWERVINE VOICE on September 13, 2008
Format: Paperback
Voice over Internet Protocol has emerged as a very popular way to do cheap (often free) long distance phone calls. But there is a huge amount of complexity beneath VoIP, that most users and even sysadmins are blissfully unaware of. The authors of this book perform a valuable service by educating the reader about current and, perhaps more importantly, possible future attacks.

A major source of weakness in VoIP is shown to be due to interoperability issues between different underlying protocols or applications. In turn, a major reason for this is that when the protocols were defined, the authors of the defining documents unwittingly left ambiguities in the specifications. Then when vendors implemented VoIP products based on those protocols, different vendors might reasonably have interpreted the documents differently.

Another source of weakness in security, as compared to traditional phone calls, is that tapping the latter often requires physical access to a phone line or a switching exchange. But VoIP at a low enough level is just like anything else that uses the Internet. Packets are routed through arbitrary third parties on the Internet. Those might have been subverted via remote attacks, so the VoIP cracker could be anywhere in the world.

The book then spends most of its time suggesting protective measures. Including, most interestingly, how to simulate current and possibly future threats. This gives you practical hands on experience in role playing the adversary. Something necessary to fully devise technical solutions.

But even if you do not do the latter, the book is useful simply in making you aware of the danger. So that for "sensitive" conversations, you might advise users to minimise the use of VoIP, perhaps by using standard land lines.
1 Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
3 of 3 people found the following review helpful By Ramon on December 14, 2008
Format: Paperback
The book provides a good general overview of VoIP security, covering multiple topics involved on securing a VoIP infrastructure, from network devices to VoIP servers, plus secure VoIP protocols. In my opinion, the best chapters are chapter 8 and 10 & 11, Session Border Controllers (SBC's) and Lawful Interception (LI), respectively; it is difficult to find books covering these topics still today, although these are two of the major areas regarding VoIP security nowadays.

SBC's are the VoIP security element by design and therefore a key device in any VoIP infrastructure. The book covers SBC's types, access and peering, expected SBC functionality and capabilities (such as DoS protection, translation and NAT features, LI, high availability and load balancing, etc) and offers a brief introduction to its architecture design concepts.

Lawful Interception (LI) by law enforcement (LE), or LI by LE :), is one of the main VoIP research topics today, especially when strong security features are added, such as signaling and media encryption, that difficult the interception tasks. The last two chapters cover the fundamentals of LI on VoIP networks (following the Cisco model, as there are three other standards), describing the different elements, fucntions, and interfaces involved. It is a theoretical chapter followed by some practical advice to implement LI, very detailed and Cisco-based.

The book starts with an introductory overview of VoIP, its benefits and drawbacks, and some security concerns. Then it provides another VoIP threat taxonomy, a good generic overview that lacks some VoIP threats and complements (or simply provides another perspective to) the IETF draft and VOIPSA VoIP threat taxonomies.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

Set up an Amazon Giveaway

Amazon Giveaway allows you to run promotional giveaways in order to create buzz, reward your audience, and attract new followers and customers. Learn more
Voice over IP Security
This item: Voice over IP Security
Price: $60.00
Ships from and sold by Amazon.com

What Other Items Do Customers Buy After Viewing This Item?