Subject: [NEXTEL-1] NIST Offers Guidelines for Securing VOIP

From: [email-masked]
Date: Mon, 10 May 2004 01:21:55 -0400

NIST Offers Guidelines for Securing VOIP
Source: Newsbytes
Publication date: 2004-05-07

Voice over IP technology offers potential cost savings and increased
functionality, but it also may introduce new security headaches for
systems administrators, the National Institute of Standards and
Technology has warned.
“VOIP adds a number of complications to existing network technology, and
these problems are magnified by security considerations,” the agency
said in a draft version of security guidelines released today for public
comment.
Special Publication 800-58, Security Considerations for Voice Over IP
Systems, is available online. Comments on the draft will be accepted
until June 18.

Firewalls can delay or block call setups, and encryption can introduce
unacceptable latency. Putting voice on data networks opens new potential
avenues for attacks to the data network, and Network Address Translation
complicates the process.
“VOIP is still an emerging technology,” NIST said, and agencies
considering it should carefully assess their understanding of the
technology and the associated risks, and the maturity of both their IT
and physical security. Because anyone with physical access to the LAN
could potentially monitor voice traffic, access control to network
elements is critical.

NIST recommends:

Separating voice and data traffic on logically different networks
Denying access to the voice gateway from the data network Using
firewalls designed for VOIP traffic Using IPsec or Secure Shell as well
as strong authentication for remote management and auditing Encrypting
voice traffic at the router or gateway if performance is a problem.
Newer IP phones are able to handle Advanced Encryption Standard
algorithms. Federal Information Processing Standard 140-2 certification
is required for federal use.

Agencies also should consider how Enhanced 911 service, which provides
the location of the caller to emergency dispatchers, will be provided.
“Although most VOIP vendors have workable solutions for E-911 service,
government regulators and vendors are still working out standards,” NIST
said.
Reported By Washington Technology,

http://www.washingtontechnology.com

http://cnniw.yellowbrix.com/pages/cnniw/Story.nsp?story_id=50836176&ID=cnniw&scategory=Telecommunications%3AWireless&

--
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

-- 
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address 
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

Yahoo! Groups Links

<*> To visit your group on the web, go to:
     http://groups.yahoo.com/group/NEXTEL-1/

<*> To unsubscribe from this group, send an email to:
     [email-masked]

<*> Your use of Yahoo! Groups is subject to:
     http://docs.yahoo.com/info/terms/