security Archives - Wildix Blog

17 January 201918 January 2019 by Dimitri Osler

Reviewing Security Concerns of UC solutions

VoIP communications are completely safe if implemented correctly. As with any other technologies, there are best practices which must be followed to achieve the best possible results.

You must address security concerns while developing or selecting your UC solution. While many vendors delegate security to separate entities, such as VPNs, this approach is not necessary nor recommended as a substitution to the security policies.

The system must protect itself from attacks that attempt to guess user and password combinations. This can be achieved by blocking repeated failed attempts. The IP address that is generating the attack must be added to a ban list for an ever-increasing period of time.

Continue reading “Reviewing Security Concerns of UC solutions”

(2 votes, average: 5.00 out of 5)

10 January 201911 January 2019 by Dimitri Osler

How Two-Factor Authentication and Single Sign-On improve Security?

Let’s explore how two-factor authentication and single sign-on mechanisms are being used for improving security.

Two-Factor Authentication introduces an additional security layer to protect accounts whose password has been compromised (for example, in case the password has been stolen). After the usual login and password check, the system will always ask for a security code.

The security code is generated either in real-time (by the authentication system) and sent over SMS, email, or via applications such as Google Authenticator or Microsoft Authenticator.

Continue reading “How Two-Factor Authentication and Single Sign-On improve Security?”

(3 votes, average: 5.00 out of 5)

3 January 201911 January 2019 by Dimitri Osler

Secure Media Transmission

Besides signaling when projecting and deploying Unified Communications system, we might also be interested in encrypting the media transferred between devices.

There are three popular RTP encryption modes:

SRTP MIKEY / SDES (requires TLS encryption of signaling)
SRTP DTLS
ZRTP

SRTP

The Secure Real-Time Transport Protocol (or SRTP) defines a profile of RTP (Real-Time Transport Protocol) intended to provide encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications. It was first published by the IETF in March 2004 as RFC 3711.

Continue reading “Secure Media Transmission”

(5 votes, average: 5.00 out of 5)

27 December 20182 January 2019 by Dimitri Osler

Protecting devices connected to the UC system

Devices connected to the UC system, such as SIP user terminals (VoIP phones and FXS Media Gateways) and SIP trunk media gateways, must also be secured using the best available policies.

Many currently available UC systems still do not implement proper policies or do not apply them by default. What security risks can this cause?

If TFTP is used, simply knowing the MAC address of the device allows acquisition of the provisioning file, which contains the SIP credentials to connect to any device.

Continue reading “Protecting devices connected to the UC system”

(2 votes, average: 5.00 out of 5)

13 December 201814 December 2018 by Dimitri Osler

What is SCRAM Authentication Type?

In the previous blog article (Basic and Digest Authentication Types) we have started reviewing authentication types . This time we will focus on SCRAM which is a family of HTTP authentication mechanisms.

XMPP supports plaintext, digest password exchanges and also SCRAM (Salted Challenge Response Authentication Mechanism). SCRAM introduces advantages over Digest, since it allows the server to store password hashes in an irreversible format.

This feature protects against offline attacks on the password and user database. The client can also save a hash-only version of the password, making it more difficult for attackers (who may have access to the PC where the password is stored) to understand the password in plaintext format.

Furthermore, SCRAM protects from man-in-the-middle attacks when certificates are used. This is done by allowing the server to prove to the client that, not only is the certificate signed by a CA (Certification Authority), but that it also knows the password.

Continue reading “What is SCRAM Authentication Type?”

(1 votes, average: 5.00 out of 5)