NET.4.2 VoIP

The conditions required for the use of VoIP MUST be specified. Among other things, it MUST be decided whether to switch completely or partially to VoIP. Special requirements for the availability of VoIP or the confidentiality and integrity of telephone calls or signalling information SHOULD be determined in advance. Suitable signalling and media transport protocols MUST be selected prior to use.

It SHOULD be decided whether and how VoIP infrastructure should be connected to public (data) networks. The capacities and design of existing data networks SHOULD be taken into account during planning.

End device functions that are not required MUST be disabled. The corresponding configuration settings MUST NOT be changed without authorisation. All end-device security functions SHOULD be tested prior to productive use. The security mechanisms and parameters used SHOULD be documented.

A decision MUST be taken as to how external callers will be able to access VoIP architecture. IT systems from insecure networks MUST be prevented from establishing direct data connections to an organisation's VoIP components. If all incoming and outgoing connections are to be handled via a central IT system, it SHOULD be ensured that all signalling and voice information between the public and private data networks in question is only exchanged via this authorised IT system.

VoIP components MUST be configured to satisfy the protection needs at hand in a suitable manner. The default configurations of VoIP middleware MUST be adapted before it is put into productive operation. All installation and configuration steps SHOULD be documented such that the installation and configuration can be understood and repeated by a qualified third party based on the documentation. All the services of VoIP middleware that are not required MUST be disabled.

The central security requirements for VoIP and the security level to be achieved SHOULD be included in an organisation-wide security policy. This security policy SHOULD detail all the general security-related requirements of the organisation in question. In addition, the policy SHOULD regulate the requirements for the operation and use of VoIP components. The different VoIP functions, such as voicemail, SHOULD be considered in this regard. The VoIP security policy SHOULD be available and known by all the persons and groups involved.

A decision SHOULD be taken as to whether and which voice and signalling information should be encrypted. In general, all VoIP data packets leaving a secure LAN SHOULD be protected by suitable security mechanisms. Users SHOULD be informed about the use of VoIP encryption.

Before VoIP components are purchased, a requirements list SHOULD be created. The list of requirements SHOULD be used to evaluate the products available on the market. The requirements list SHOULD include all the characteristics necessary to achieve the desired security level. The manner in which the products available on the market can be evaluated according to the requirements list SHOULD be regulated.

Users of VoIP end devices SHOULD be aware of the basic VoIP threats and security safeguards. In addition, they SHOULD select suitable passwords to secure voicemails.

When VoIP components are decommissioned or replaced, all security-related information SHOULD be deleted from the devices. After data is deleted, it SHOULD be verified that the data was deleted successfully. Confidential information SHOULD also be deleted from backup media. All labels, especially on end devices, SHOULD be removed before disposal. Safeguards for deleting security-related information which are compatible with the applicable conditions of contracts and guarantees SHOULD be clarified in advance with manufacturers, retailers, or service providers.

Organisations SHOULD check whether their firewalls can be adapted for the use of VoIP. If this is not the case, an additional firewall SHOULD be purchased and installed.

The integrity and confidentiality of signalling information SHOULD be ensured by appropriate cryptographic procedures. Along with the actual payloads, authentication data SHOULD also be continuously encrypted. Access to VoIP gateways SHOULD be restricted to the greatest possible extent with the help of VoIP addresses and H.323 identities. Additional end-to-end security mechanisms SHOULD be used for media transport and signalling. The way in which signalling is protected SHOULD be documented.

For transmissions using the Real-Time Transport Protocol (RTP), media data and information for controlling such data SHOULD be appropriately protected. The user data SHOULD be protected by the use of Secure Real-Time Transport Protocol (SRTP) and Secure Real-Time Control Protocol (SRTCP). The security-relevant options for implementing the protocols SHOULD be documented.

VoIP networks SHOULD be separated from data networks in a suitable manner. The way in which devices that need to access VoIP and data networks are to be dealt with SHOULD be regulated. VoIP end devices in a VoIP network SHOULD ONLY be able to establish the intended VoIP connections to other IT systems.