Voice over IP (VoIP) implementations have soared in the past four to five years, with a huge assortment of both self-managed solutions and managed-service offerings. While there have been many articles written about specific security aspects of VoIP, with a core set of consistent major threats showing up in every survey, there’s also good reason to focus more broadly on safeguarding VoIP services in the enterprise network than the specific threats. Surely denial of service (DoS) attacks, worms or viruses, and eavesdropping on calls all raise concern. VoIP spam gets a lot of attention as well in some sectors.

Whether we call it “Security 101” or simply fundamental good practice, there are three fundamental security concerns– confidentiality, integrity, and availability–that apply directly to the notion of safeguarding our network services. In addressing how to deal with the threats and safeguarding VoIP services in the enterprise, we’ll stick to three fundamental precepts: prevention, detection, and reaction.

3Com (www.3com.com) has announced the AirProtect Wireless Intrusion Prevention System (WIPS). The device detects and protects against unauthorized access to wireless networks. It prevents authorized users from connecting to unauthorized access points, and the system can also disable all wireless connections, allowing enforcement of “no wireless” policies. AirProtect WIPS also provides denial of services protection against wireless threats, scanning 62 wireless radio channels and preventing up to 20 simultaneous attacks per AirProtect Sensor. AirProtect location tracking assists in the removal of rogue access points and clients, including a probability graph that helps network managers find the most likely placements of offending devices.

The AirProtect Enterprise includes an AirProtect Server that provides central system management of up to 210 AirProtect Sensors, which monitor wireless networks and provide network protection in conjunction with the server. Pricing is based on configuration with a starting configuration of one server and 12 sensors at a list price of $17,000. AirProtect Sentry is designed for remote offices and SMBs that can cover their facility with one or two sensors at a list price of $995.

RADVISION (www.radvision.com) has announced the general availability of the SIP Developer Suite version 5.0 and SCOPIA PathFinder version 5.5 end-toend firewall and NAT traversal solution. The SIP developer suite is a development tool for building all types of IMS or non-IMS SIP applications, ranging from high-end infrastructure SIP systems to compact embedded devices, and includes signaling compression, security agreement, and IMS registration, as well as SIMPLE OMA standard-compliant presence and instant messaging capabilities, XML support, and the latest STUN standard NAT traversal capabilities. Coded in ANSI C and cross-platform compatible, the SIP Developer Suite is available for all common operating systems.

SCOPIA PathFinder 5.5 now includes H.460 support enabling H.460-compliant endpoints to connect without the need for any intermediate client in the connection stream. SCOPIA PathFinder is the only solution available on the market that handles both endpoints with embedded H.460 support and endpoints without H.460 capabilities, without the need for additional hardware or traversal software. Highlights include free software for endpoints that do not support H.460, support for AES encryption for all traffic, and URI dialing (e-mail or URL-style addressing).

M5T (www.m5t.com) has released ZRTP SAFE, a solution designed to perform SRTP key exchanges during call setup into the media path using the same network connection used for RTP packet exchange. The approach delivers secure VoIP without relying on a PKI, key certification, trust models, certificate authorities, or key management complexity, delivering key agreements and key management in a pure peer-to-peer manner over the RTP packet stream. ZRTP SAFE interoperates with any standard SIP phone, but only encrypts calls when communicating with another ZRTP-enabled device.