SIP
SIP trunking raises a few security concerns that IT planners must address. SIP trunking creates a new vector for attacking enterprise phone systems. In most VOIP architectures the PSTN serves as a firebreak between the enterprise phone system and the rest of the world. Risk of attack from the Internet is low as the VOIP system is physically and potentially logically isolated from the outside. Introducing SIP trunking changes this, as the enterprise phone system is now vulnerable to IP-based attacks via the SIP trunk. Session border controllers or SIP-aware firewalls can mitigate security concerns. VOIP traffic carried via SIP trunk across a service provider network is often not encrypted, meaning that the opportunity exists for a rogue person to listen in on private conversations via comprise of service provider networks. Make sure your security analysts are involved in your SIP trunking procurement and deployment efforts to assess the risks and determine necessary mitigation requirements.
