Re: VOIP: RTP vs SRTP



From my experience using IPSec VPN (and now SSL-VPN) for securing VoIP has
been pretty strait forward, for remote soft-clients and site-2-site calls. It secures both the signaling and media traffic. This is assuming that the IPSec environment/concentrators can support QoS - i.e. DiffServ to prioritize and expedite VoIP traffic over HTTP or FTP for example.

On the LAN it gets a little more complicated in that you don't want a bunch of potential bottlenecks (firewalls) creating jitter, latency and delay which can impair overall voice quality. In the LAN VLAN segmentation can help as part of a layered defense, but its not fool proof, i.e. dsniff tools. Therefore the LAN infrastructure needs to be able to detect Arp Spoofing, DHCP server spoofing, etc. while enforcing L2-4 firewall policy at the individual switch port. In this type of LAN infrastructure VLAN segmentatation and policy enforcement can help preserve VoIP quality in the case of broadcast storm or massive traffic flloods via DDoS.

802.1x helps at least authenticate the VoIP hard sets and other devices on the network. It can also help to dynamically assign the device and/or user to the appropriate VLAN. Look for IP Phones that support 802.1x for authentication. It helps.

With SIP in particular there are many different sessions and call states active simultaneously. Also there may be more than just voice in a SIP "call" i.e. video, IM, presence, etc. In a multimedia/VoIP call many ports are opened dynamically which makes firewall rule/policy creation and implementation very difficult. Imagine a VoIP conference call for a simple case.

Finally, NAT - if not done correctly (i.e. SIP-NAT ALG's) will break most conversations.

On the IDS/IPS front remember that VoIP media traffic is relatively small packets which require real-time performance. Inspection of a lot of small packets at a high rate can be very costly on the throughput/performance of the IDS/IPS if they can even identify the traffic at all.

What's getting popular right now are Application Layer Gateways/Firewalls for multimedia. They've been available in the VoIP/ISP space for a little while now and are now coming to the enterprise space. Most will provide encryption, NAT capability, and "Pin-Hole" firewall capabilities based on the session and call state. I've seen them from Sipera (www.sipera.com) and Nortel (www.nortel.com).

At the end of the day a layered defense is your best bet, but don't forget about the QoS requirements.

----- Original Message ----- From: "Ken Kousky" <kkousky@xxxxxxxxxx>
To: "'Chris Serafin'" <chris@xxxxxxxxxxxxxxxx>; <defragz@xxxxxxxxxxx>; <pen-test@xxxxxxxxxxxxxxxxx>
Cc: "Mike Brown" <MBrown@xxxxxxxxxx>
Sent: Sunday, March 12, 2006 12:14 PM
Subject: RE: VOIP: RTP vs SRTP


There's no question that VoIP Security is a BIG issue. Most management
surveys say that it's the first or second reason given for why companies are
delaying on VoIP.

VoIPSA is certainly a resource, as NIST. They publish a free report (it's
really a 100 page book) on Securing VoIP and it's probably the best guide in
the industry. It's also a great VoIP primer and best of all, you've already
paid for it in your tax dollars so you can download it at no cost. (The
administration has not reclassified it as top secret yet)

It's at:
http://www.csrc.nist.gov/publications/nistpubs/800-58/SP800-58-final.pdf

The most important lessons here are the recommendations to avoid soft phones
and to segment VoIP on a VLAN will prevent many of the desired voip benefits
so the security frameworks don't map to reality.

If you'd like to present your work in this field or just learn a more about
VoIP security join us at the Second Annual Voip Security Conference hosted
by IP3 and Illinois Institute of Technology:

Call for Speakers and Sponsors
The 2nd Annual
Managing VoIP Security Conference
(MVSC 2006)
May 17-18, 2006

IIT- Illinois Institute of Technology
Herman Union Building- Conference Center
Chicago, Illinois, USA
www.voip-wifi.net
or visit:
www.ip3seminars.com/conf.htm






-----Original Message-----
From: Chris Serafin [mailto:chris@xxxxxxxxxxxxxxxx]
Sent: Friday, March 10, 2006 11:55 AM
To: defragz@xxxxxxxxxxx; pen-test@xxxxxxxxxxxxxxxxx
Subject: RE: VOIP: RTP vs SRTP

I have been thinking of writing a paper about a VoIP security also. I my
experience [solely Cisco voip] there is absolutely no security in place for
any VoIP.

Chris Serafin
IT Security / VoIP Engineer
chris@xxxxxxxxxxxxxxxx

-----Original Message-----
From: defragz@xxxxxxxxxxx [mailto:defragz@xxxxxxxxxxx]
Sent: Friday, March 10, 2006 2:23 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: VOIP: RTP vs SRTP

Hello list,

Planning some internal presentations on VoIP, I was wondering if SRTP
(Secure Real Time Protocol) is now really in use, as a secure replacement of
RTP.

More generally, from your experience, and from what you have seen in "real
life", do you thing that VoIP security is getting better? Do people use
crypto to protect both data and signalling?
I will love to hear your feedbacks...
-Franck


----------------------------------------------------------------------------
--
This List Sponsored by: Cenzic

Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to
proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).

Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx
----------------------------------------------------------------------------
--




----------------------------------------------------------------------------
--
This List Sponsored by: Cenzic

Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to
proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).

Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx
----------------------------------------------------------------------------
--


------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx
------------------------------------------------------------------------------





------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request@xxxxxxxxxx
------------------------------------------------------------------------------



Relevant Pages

  • RE: VOIP: RTP vs SRTP
    ... Subject: VOIP: RTP vs SRTP ... I have been thinking of writing a paper about a VoIP security also. ... vulnerability management needs. ... Download FREE whitepaper on how a managed service can help you: ...
    (Pen-Test)
  • VOIP: RTP vs SRTP
    ... Planning some internal presentations on VoIP, I was wondering if SRTP (Secure Real Time Protocol) is now really in use, as a secure replacement of RTP. ... Concerned about Web Application Security? ... vulnerability management needs. ...
    (Pen-Test)
  • RE: Converged Network Assessment - VoIP Security
    ... VoIP Conference 2006 participants requirements: ... CPD Network Security Technologies ... Converged Network Assessment - VoIP Security ... convergence is going to have a lot to do with integrating VoIP ...
    (Pen-Test)
  • Risks Digest 24.32
    ... Report on security risks of applying CALEA to VoIP ...
    (comp.risks)
  • RE: VOIP: RTP vs SRTP
    ... I have been thinking of writing a paper about a VoIP security also. ... vulnerability management needs. ... Download FREE whitepaper on how a managed service can help you: ...
    (Pen-Test)