Re: VoIP Assessment

[Mark Teicher <mht3 () earthlink net>]

What specific items have you been tasked to validate?
Could be as simple as :
        Are the components VoIP capable?
                If so, then what protocols have been implemented (Y/N)
                   If x protocol, if implemented correctly (i.e when 
enabled, does it process the traffic correctly (Y/N)
                         If x protocol, if implemented correctly 
(i.e. when x protocol is disabled, does it block VoIP traffic 
inbound/outbound? (Y/N)

and so and so on

Lots of those "security" type experts will overstate the obvious and 
start rattling off big words like MITM attacks, Resource exhaustion, 
H.323 attacks, SIP Overflow attacks, etc, etc, but IMHO, simplify 
what the tasks are, and break those tasks into simple steps that any 
former senior security consultant can do by utilizing a checklist 
approach, otherwise one gets into the battle with the "puffed out 
chest security wannabes "

/m
At 01:40 PM 7/19/2005, intel96 wrote:
> I have been asked to look at the security of a VoIP 
> architecture.  Has anyone conducted a security assessment against 
> VoIP or the components that make up the architecture?
>
> Thanks,
>
> Intel96