Industry
Part of Making sense of VoIP systems: live or die on the network path
VoIP Systems Security: Everyday Fraud Defenses
VoIP systems security starts with limiting destinations, protecting credentials and monitoring call activity to reduce toll-fraud risk.
VoIP systems security matters because a compromised phone system does not usually leak your files. It places calls, thousands of them, to destinations that pay the person placing them. The loss arrives as a bill, and it arrives fast.
What to take away
- Set a hard limit on international and premium destinations. Most businesses can block the entire list and add back the four countries they call.
- Every handset and every app account has a password. Default and sequential passwords are how systems get taken, not clever attacks.
- Watch call volume and spend, and alert on a change. Fraud is visible in the first hour and expensive by the third.
Where the money goes
Phone-system fraud generates calls to numbers whose termination fees are shared with the party sending the traffic. Calls to these destinations can turn compromised access into billable traffic.
VoIP fraud controls and what they stop
Control
- Destination blocking by default
- Most fraud attempts
- Concurrent call ceiling
- Volume that pays
- Out-of-hours restrictions
- The preferred window
- Spend and volume alerting
- Nothing, shortens loss
What it stops
- Destination blocking by default
- Occasional country request
- Concurrent call ceiling
- Nothing above real peak
- Out-of-hours restrictions
- Inconvenience for late staff
- Spend and volume alerting
- One-time setup
Cost to you
- Destination blocking by default
- Concurrent call ceiling
- Out-of-hours restrictions
- Spend and volume alerting
The attacker does not need your data. They need your system to dial at volume, often out of hours. Which part they get into—an endpoint, the service, or the path—is described in the voip systems overview.
That shapes the defenses:
What it stops
- Destination blocking by default
- The majority of fraud attempts, because the profitable destinations are few
- A concurrent call ceiling
- Volume, which is what makes fraud pay
- Out-of-hours restrictions
- The window fraud prefers
- Spend and volume alerting
- Nothing, but it shortens the loss
Cost to you
- Destination blocking by default
- An occasional request to add a country
- A concurrent call ceiling
- Nothing, if the ceiling is set above your real peak
- Out-of-hours restrictions
- Some inconvenience for staff who work late
- Spend and volume alerting
- Setting it up once
NIST Special Publication 800-58, Security Considerations for Voice Over IP Systems, predates the current products and is still correct about the structure: voice on a data network inherits the data network's problems and adds a billing relationship on top.
The three ways in
Weak or default device credentials. Handsets ship with known passwords and
Closing the three ways in
- Change every default handset password
- Keep handset admin off the internet
- Restrict where registrations are accepted
- Use long generated account passwords
- Add MFA to the admin portal
- Limit who holds portal access
web interfaces. If a phone's administration page is reachable from the internet, it is being tried. Change every default, and do not expose handset administration outside the building.
Registration open to the world. A phone account that will accept a registration from anywhere will eventually accept one from somebody else. Restrict where registrations are accepted from where the provider allows it, and use long, generated passwords for accounts rather than anything a person chose. NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, is the reference for why length beats complexity rules.
Protect the administrative account for your phone service first, including the account that controls your business phone numbers.
It can add users, change routing, lift limits. It deserves multi-factor authentication and a short list of people.
Encryption, and what it is for
Signaling and media can each be encrypted. Ask the provider whether both are, whether it is on by default, and whether turning it on costs anything. Encryption protects the content of calls from somebody positioned on the path. It does nothing about fraud, which is committed with valid credentials. Do not let a conversation about encryption stand in for the destination limits, which are what actually saves money.
Inside the building, keeping phones on their own segment limits what a compromised computer can reach, and it limits what a compromised handset can reach as well. That is ordinary network hygiene rather than a phone feature, and configuring the switch and the router that carry the phones belongs with setup and troubleshooting.
What to do in the first hour
- Disable outbound calling on the affected accounts, or set the concurrent ceiling to zero. Stop the meter before you investigate.
- Change the credentials on those accounts and on the administrative portal.
- Ask the provider for a call detail export covering the period.
- Tell the provider in writing that you believe the traffic is fraudulent, the same day. Whether any of it is written off is a commercial question, and the answer is worse if you waited.
- Write down what happened while it is fresh. NIST Special Publication 800-61, Computer Security Incident Handling Guide, provides a useful structure for that record even at a small scale.
Common questions
Are we too small to be a target?
Targeting is automatic. Systems are found by scanning, and a small business with no limits set is a better target than a large one with a monitored platform.
Does the provider absorb fraudulent charges?
Whether the provider absorbs fraudulent charges depends on your contract. Before service, check its provisions on unauthorized calls, billing disputes, and how quickly you must report suspected fraud. Ask the provider to confirm in writing whether charges incurred before notice can be waived.
Can staff use their own phones safely?
Yes, with an app tied to an account you control and can disable. The risk is not the device; it is an account that outlives the employment.
Should we record calls?
Only with a clear reason, a retention period, and the consent rules for your jurisdiction checked first. For example, California Penal Code section 632 addresses recording confidential communications in California; requirements vary by state and circumstances. A recording archive is a data risk you did not have before, and it sits with the other voip systems features that arrive with obligations attached.
