Continue reading “Secure Video Conferencing: How to Meet Safely & Privately”
Secure Video Conferencing: How to Meet Safely & Privately
Secure Media Transmission
Besides signaling when projecting and deploying Unified Communications system, we might also be interested in encrypting the media transferred between devices.
There are three popular RTP encryption modes:
- SRTP MIKEY / SDES (requires TLS encryption of signaling)
- SRTP DTLS
- ZRTP
SRTP
The Secure Real-Time Transport Protocol (or SRTP) defines a profile of RTP (Real-Time Transport Protocol) intended to provide encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications. It was first published by the IETF in March 2004 as RFC 3711.
Basic and Digest Authentication Types
Authentication is the process in which the system identifies logged in users from unauthorized users. The effectiveness of this process is determined by the authentication protocols and mechanisms being used. In this article we will start reviewing authentication types that are used to verify the identities of users and decide whether they are really secure or not.
Basic HTTP
The first version of SIP used Basic HTTP authentication. This system is fairly easy to access using man-in-the-middle attacks. This type of authentication has been depreciating for some time now.
In HTTP authentication, an attacker can simply capture a packet containing the password and base64 encoded, which is then used to decode and perform attacks.
Not secure, indeed.
Introducing Unified Communications Security
Security is a serious topic and, unfortunately, it is either overlooked, exposing organizations to risks, or incorrectly addressed through cumbersome solutions. In the series of blog articles I will try to shed light on what you should pay attention to, in terms of security, when choosing a UC solution.
Notwithstanding all the advantages of a UC solution, there is one important prejudice against its adoption: security concerns.
There is a widespread belief that VoIP solutions based on SIP are not secure, and that their usage must be blocked, or at least limited to local networks (eventually extended by VPNs).
Nothing could be further from reality. Well-developed and deployed VoIP solutions that are based on SIP and XMPP are actually more secure than traditional communications.
How did the prejudice start and spread?
Continue reading “Introducing Unified Communications Security”