From: Mark Teicher (mht3@earthlink.net)
Date: Tue Jul 19 2005 - 18:39:39 EDT
What specific items have you been tasked to validate?
Could be as simple as :
Are the components VoIP capable?
If so, then what protocols have been implemented (Y/N)
If x protocol, if implemented correctly (i.e when
enabled, does it process the traffic correctly (Y/N)
If x protocol, if implemented correctly
(i.e. when x protocol is disabled, does it block VoIP traffic
inbound/outbound? (Y/N)
and so and so on
Lots of those "security" type experts will overstate the obvious and
start rattling off big words like MITM attacks, Resource exhaustion,
H.323 attacks, SIP Overflow attacks, etc, etc, but IMHO, simplify
what the tasks are, and break those tasks into simple steps that any
former senior security consultant can do by utilizing a checklist
approach, otherwise one gets into the battle with the "puffed out
chest security wannabes "
/m
At 01:40 PM 7/19/2005, intel96 wrote:
>I have been asked to look at the security of a VoIP
>architecture. Has anyone conducted a security assessment against
>VoIP or the components that make up the architecture?
>
>Thanks,
>
>Intel96
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:36 EDT