Story image

Who’s listening?

01 Jul 2010

Unified communications (UC) has become a vital application for most organisations who want to streamline their    communications in a cost-effective manner. From a security standpoint we are all too aware of the constant news about  web and email security incidents, but we hear little about unifi ed communications. While unifi ed   communications security incidents aren’t dominating headlines, the potential for vital corporate data to slip out via this    technology solution is very real.UC is probably the third-most vulnerable application from a security standpoint, after web and email – and for many of the same reasons, most of which have to do with broader network security policies. The real threat surrounding UC is  that of sensitive information leaking out of the company, accidentally or otherwise, through common UC applications  such as instant messaging and conferencing where we tend to share information via a combination of video and voice, which traverse the network.UC security threats fall into three buckets. First, UC applications offer a good channel for individuals to share  information, either covertly or by accident. For example, there have been many recorded instances of companies that  have unwittingly shared, via VoIP eavesdropping attacks, video fi les or presentations that were not ready for public consumption.In other cases, individuals have circumvented the security policies applied to email because the same policies had not  been applied to the UC applications; for example employees sending out credit card details via an instant messaging application because their email solution has a rule that blocks outgoing confi dential information.Secondly, albeit less common, wrongdoers can co-opt an employee’s internal caller identity and use it to phish for  information or to make unauthorised outbound calls. This is known as a call-hijacking scheme, and it’s something that  small businesses using hosted services should be especially diligent about watching. Not only does call-hijacking cost money; it can also be responsible for damaging a company’s reputation if someone is using the caller identifi cation  associated with its IP phone solution to make unsolicited calls.Lastly, the hardware associated with UC is inherently insecure. IP phones are insecure networkattached hosts that are  easily discovered, have no HIPS or antivirus, usually rely on a browser interface that does use HTTPS, and they use  unprotected TFTP servers for downloading configurations. So what can a technology solution provider do to maintain a customer’s UC security?Focusing on core network security solutions and processes is the key to maintaining UC security and reducing the  chances that breaches will occur. Protecting corporate UC and collaboration sessions via a virtual private network is  one best  practice, as running sessions over VPN is inherently more secure. We are also seeing encryption and authentication becoming more mainstream in vendor solutions, although the challenge here is to ensure that there is  minimal latency to the UC sessions.As is the case when we talk about network security, enforcing a strong strategy for role-based authentication and  access control is a key security consideration that needs to be adopted by organisations who have invested in a UC  strategy. It’s important to apply the same policies for audit and archiving of corporate information to UC conversations as you would to any other network application.In the end, although specific technologies like SIP proxies and firewalls are useful in securing unified communications,  it is more important to take the deployment of unified communications as yet another trigger to a well-rounded, multi-level and multi-layer defence strategy for security across the enterprise infrastructure

Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Huawei to deploy Open Rack in all its public cloud data centres
Tech giant Huawei has unveiled plans to adopt Open Rack proposed by the Open Compute Project in its new public cloud data centres across the globe.
Beyond renewables: Emerging technologies for “greening” the data centre
Park Place Technologies’ CEO shares his views on innovations aside from renewable energy that can slim a data centre’s footprint.
Interxion’s David Ruberg wins Europe’s best data centre industry CEO
The European CEO Awards took place this week to celebrate the key figures at the helm of corporations that are driving innovation.
Opinion: 5G’s imminent impact on data centre infrastructure
Digital Realty’s Joseph Badaoui shares his thoughts on how 5G will transform data centre infrastructure now and beyond.
EMEA external storage market hits record high, Dell EMC on top
IDC's recent analysis on the external storage market in EMEA has shown healthy results - with some countries performing better than others - largely fuelled by all-flash arrays.
SolarWinds extends database anomaly detection
As organisations continue their transition from purely on-premises operations into both private and public cloud infrastructures, adapting their IT monitoring and management capabilities can pose a significant challenge.
Was Citrix unaware of its own data breach until the FBI got involved?
According to a blog post from Citrix’s CSIO Stan Black, the FBI contacted Citrix on March 6 and advised that international cybercriminals had allegedly gained access to Citrix’s internal network.