WordPress category: blog
VoIP connects calls through your business network or a cloud phone service. That brings flexible calling and centralized administration. It also means phone security depends on account controls, network configuration, device updates, and monitoring.
A phone system can be abused even when computers appear unaffected. The result may be unauthorized international calls, exposed conversations, diverted calls, or interruptions to service.
X-Tek provides managed VoIP and network security monitoring for businesses using cloud or on-premise phone systems. The right controls depend on the platform, provider, and network design.
The main risks
Toll fraud
Toll fraud occurs when an attacker uses a compromised extension, SIP account, voicemail account, or phone system to place unauthorized calls. Calls may target international or premium-rate destinations.
Costs can accumulate quickly, including after business hours or over a weekend. The New Jersey Cybersecurity and Communications Integration Cell describes how attackers may use compromised SIP credentials to route calls for fraud.
SIP attacks
Attackers may scan internet-facing systems, guess SIP credentials, or attempt to register unauthorized devices. A compromised registration can allow calls to be placed or received as if they came from a legitimate extension.
Other attacks can target availability. A flood of signaling requests, for example, may disrupt call setup or make service unreliable.
Eavesdropping
Call audio and signaling may be exposed if they are not encrypted or if a device, account, or network is compromised. Encryption can reduce the risk of packet capture revealing call content. It does not protect a compromised phone or stop misuse of valid credentials.
The Cybersecurity and Infrastructure Security Agency’s VoIP overview discusses security considerations, including encryption and network controls.
Account and voicemail compromise
Weak or unchanged passwords and voicemail PINs can expose messages, account settings, and call forwarding. A modified forwarding rule may route calls to an unauthorized number without changing the user’s normal call experience.
Secure the accounts and devices
Start with credentials. Change default passwords and PINs on phones, PBX systems, SIP accounts, voicemail, gateways, and administrative portals. Use unique credentials for each account. Avoid short or reused voicemail PINs.
Enable multifactor authentication on administrative and provider accounts wherever available. Limit administrator access to staff who need it. Remove former employees and unused extensions promptly.
Keep supported phones, PBX software, gateways, firewalls, and cloud-management tools updated. Replace devices that no longer receive security updates. Apply changes through a documented process and verify that updates do not disrupt call routing.
The FCC’s voicemail security guidance advises changing default voicemail passwords and protecting access to business voicemail.
Restrict network access
Do not expose phone-system administration pages or management ports directly to the public internet. Use a VPN or another controlled access method for remote administration.
Where the provider supports it, restrict SIP traffic to documented provider addresses. Avoid broad firewall rules that allow access from any internet address. Confirm required ports and address ranges with the VoIP provider before changing firewall settings.
Separate voice devices from business computers and guest Wi-Fi using a voice VLAN or other network segmentation. Restrict traffic between those network zones to what the system requires. This can limit lateral movement if a device or account is compromised.
NIST’s Security Considerations for Voice Over IP Systems covers voice network separation, access control, and related design considerations. Apply its guidance alongside current product documentation and provider requirements.
Reduce the risk of eavesdropping
Ask the provider which encryption options are supported for your phone system and endpoints. SIP over TLS can protect signaling between supported components. SRTP can protect call audio between supported endpoints.
Confirm that encryption is enabled on the call paths that matter. Capabilities may differ between desk phones, softphones, provider systems, and external call routes.
Encryption is one layer. It does not prevent someone from listening through a compromised endpoint, taking over an account, or accessing call recordings stored elsewhere. Secure devices, accounts, networks, and recordings as well.
Limit where calls can go
Set outbound calling rules based on business needs. Disable international, premium-rate, and other high-cost destinations if employees do not need them. Restrict after-hours calling where practical.
Review call forwarding, transfer, and voicemail settings. Limit who can change them. Require approval for exceptions, such as temporary international calling access.
Ask the provider about spending limits, destination blocking, fraud alerts, and emergency call controls. The UK National Cyber Security Centre’s PBX guidance recommends restricting PBX access and monitoring call patterns.
Monitor for unusual activity
Security monitoring should include the phone environment, not only computers and servers. Review available call detail records, registration logs, firewall events, and administrator activity.
Set alerts for:
- Repeated failed SIP registrations
- New or unfamiliar device registrations
- Sudden increases in outbound calls
- Calls to unusual international or premium-rate destinations
- High-cost calls outside normal business hours
- New forwarding rules or account changes
- Unexpected voicemail access or password resets
Keep logs protected from unauthorized access. Establish who reviews alerts and who can contact the VoIP provider. Alerts that are not assigned to an owner may not lead to timely action.
X-Tek’s managed VoIP and network security work can include system configuration, network controls, and monitoring of suspicious activity. Monitoring supports detection and response. It does not replace account security, provider controls, or a documented incident process.
Prepare a response plan
Document the actions to take if fraud or account compromise is suspected. Include the VoIP provider’s support contact, internal decision-makers, and authorized administrators.
A response checklist should cover:
Restrict calling
Block international and premium-rate destinations. Suspend affected extensions or trunks if needed.Contact the provider
Request investigation, call blocking, and review of potentially fraudulent charges.Preserve records
Save call detail records, registration logs, firewall events, and relevant account-change history.Reset credentials
Change affected SIP, voicemail, administrator, and related account passwords and PINs.Review system changes
Check for unauthorized registrations, extensions, forwarding rules, and provisioning changes.Restore securely
Patch or isolate affected systems. Re-enable accounts only after access and configuration have been reviewed.
Keep a current backup of on-premise PBX configuration. Document recovery steps and an alternate way for staff to communicate if the phone service is unavailable.
Review the system regularly
VoIP security changes as staff, devices, locations, and call requirements change. Include the phone system in routine access reviews and network assessments.
Check that:
- Unused extensions and accounts are disabled
- Default credentials have been replaced
- Administrative access is limited and protected
- Firmware and software remain supported and updated
- Firewall rules match current provider requirements
- Call restrictions and alerts reflect business needs
- Logs are available and reviewed
- Staff know how to report unexpected calls or account changes
For additional context, review X-Tek’s VoIP phone system guide and network security monitoring overview.
A secure phone system requires coordinated controls across accounts, devices, networks, provider settings, and monitoring. X-Tek supports managed VoIP and network security for cloud and on-premise systems.
Contact X-Tek about your business phone and network security
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075