| Foreword | p. xiii |
| Acknowledgments | p. xvii |
| Introduction | p. 1 |
| VoIP: A Green Field for Attackers | p. 2 |
| Why VoIP Security Is Important | p. 3 |
| The Audience for This Book | p. 4 |
| Organization | p. 4 |
| Basic Security Concepts: Cryptography | p. 7 |
| Introduction | p. 7 |
| Cryptography Fundamentals | p. 7 |
| Secret Key (Symmetric) Cryptography | p. 10 |
| Asymmetric (Public Key) Cryptography | p. 12 |
| Integrity Protection | p. 13 |
| Authenticated and Secure Key Exchange | p. 17 |
| Digital Certificates and Public Key Infrastructures | p. 20 |
| Certificate Assertions | p. 22 |
| Certificate Authorities | p. 24 |
| References | p. 27 |
| VoIP Systems | p. 29 |
| Introduction | p. 29 |
| VoIP Architectures | p. 29 |
| Components | p. 31 |
| Protocols | p. 32 |
| Session Initiation Protocol | p. 32 |
| Session Description Protocol | p. 39 |
| H.323 | p. 42 |
| Media Gateway Control Protocols | p. 44 |
| Real Time Transport Protocol | p. 46 |
| Proprietary Protocols | p. 46 |
| Security Analysis of SIP | p. 48 |
| References | p. 49 |
| Internet Threats and Attacks | p. 51 |
| Introduction | p. 51 |
| Attack Types | p. 51 |
| Denial of Service (DoS) | p. 51 |
| Man-in-the-Middle | p. 56 |
| Replay and Cut-and-Paste Attacks | p. 57 |
| Theft of Service | p. 58 |
| Eavesdropping | p. 59 |
| Impersonation | p. 60 |
| Poisoning Attacks (DNS and ARP) | p. 60 |
| Credential and Identity Theft | p. 61 |
| Redirection/Hijacking | p. 62 |
| Session Disruption | p. 63 |
| Attack Methods | p. 64 |
| Port Scans | p. 64 |
| Malicious Code | p. 65 |
| Buffer Overflow | p. 67 |
| Password Theft/Guessing | p. 69 |
| Tunneling | p. 69 |
| Bid Down | p. 69 |
| Summary | p. 70 |
| References | p. 70 |
| Internet Security Architectures | p. 73 |
| Introduction | p. 73 |
| Origins of Internet Security Terminology | p. 73 |
| Castle Building in the Virtual World | p. 74 |
| Security Policy | p. 75 |
| Risk, Threat, and Vulnerability Assessment | p. 77 |
| Implementing Security | p. 79 |
| Authentication | p. 80 |
| Authorization (Access Control) | p. 82 |
| Auditing | p. 82 |
| Monitoring and Logging | p. 84 |
| Policy Enforcement: Perimeter Security | p. 85 |
| Firewalls | p. 86 |
| Session Border Controller | p. 90 |
| Firewalls and VoIP | p. 92 |
| Network Address Translation | p. 93 |
| Intrusion Detection and Prevention | p. 95 |
| Honeypots and Honeynets | p. 97 |
| Conclusions | p. 97 |
| References | p. 98 |
| Security Protocols | p. 101 |
| Introduction | p. 101 |
| IP Security (IPSec) | p. 103 |
| Internet Key Exchange | p. 105 |
| Transport Layer Security (TLS) | p. 107 |
| Datagram Transport Layer Security (DTLS) | p. 111 |
| Secure Shell (SecSH, SSH) | p. 112 |
| Pretty Good Privacy (PGP) | p. 115 |
| DNS Security (DNSSEC) | p. 116 |
| References | p. 119 |
| General Client and Server Security Principles | p. 121 |
| Introduction | p. 121 |
| Physical Security | p. 122 |
| System Security | p. 122 |
| Server Security | p. 122 |
| Client OS Security | p. 124 |
| LAN Security | p. 126 |
| Policy-Based Network Admission | p. 127 |
| Endpoint Control | p. 128 |
| LAN Segmentation Strategies | p. 129 |
| LAN Segmentation and Defense in Depth | p. 130 |
| Secure Administration | p. 131 |
| Real-Time Monitoring of VoIP Activity | p. 132 |
| Federation Security | p. 132 |
| Summary | p. 132 |
| References | p. 133 |
| Authentication | p. 135 |
| Introduction | p. 135 |
| Port-Based Network Access Control (IEEE 802.1x) | p. 137 |
| Remote Authentication Dial-In User Service | p. 140 |
| Conclusions | p. 143 |
| References | p. 143 |
| Signaling Security | p. 145 |
| Introduction | p. 145 |
| SIP Signaling Security | p. 146 |
| Basic Authentication | p. 146 |
| Digest Authentication | p. 147 |
| Pretty Good Privacy | p. 152 |
| S/MIME | p. 153 |
| Transport Layer Security | p. 155 |
| Secure SIP | p. 159 |
| H.323 Signaling Security with H.235 | p. 160 |
| References | p. 161 |
| Media Security | p. 163 |
| Introduction | p. 163 |
| Secure RTP | p. 164 |
| Media Encryption Keying | p. 168 |
| Preshared Keys | p. 168 |
| Public Key Encryption | p. 169 |
| Authenticated Key Management and Exchange | p. 170 |
| Security Descriptions in SDP | p. 172 |
| Multimedia Internet Keying (MIKEY) | p. 173 |
| Generation of MIKEY Message by Initiator | p. 177 |
| Responder Processing of a MIKEY Message | p. 183 |
| Failure and Fallback Scenarios | p. 186 |
| Alternative Key Management Protocol-ZRTP | p. 188 |
| Future Work | p. 190 |
| References | p. 190 |
| Identity | p. 193 |
| Introduction | p. 193 |
| Names, Addresses, Numbers, and Communication | p. 193 |
| E.164 Telephone Numbers | p. 194 |
| Internet Names | p. 195 |
| Namespace Management in SIP | p. 196 |
| URI Authentication | p. 196 |
| Trust Domains for Asserted Identity | p. 199 |
| Interdomain SIP Identity | p. 202 |
| SIP Authenticated Identity Body (AIB) | p. 203 |
| Enhanced SIP Identity | p. 204 |
| SIP Certificates Service | p. 209 |
| Other Asserted Identity Methods | p. 217 |
| Secure Assertion Markup Language | p. 217 |
| Open Settlements Protocol and VoIP | p. 219 |
| H.323 Identity | p. 219 |
| Third Party Identity and Referred-By | p. 219 |
| Privacy | p. 220 |
| References | p. 223 |
| PSTN Gateway Security | p. 225 |
| Introduction | p. 225 |
| PSTN Security Model | p. 225 |
| Gateway Security | p. 227 |
| Gateway Security Architecture | p. 228 |
| Gateway Types | p. 229 |
| Gateways and Caller ID | p. 230 |
| Caller ID and Privacy | p. 231 |
| Gateway Decomposition | p. 231 |
| SIP/ISUP Interworking | p. 232 |
| Telephone Number Mapping in the DNS | p. 233 |
| References | p. 236 |
| Spam and Spit | p. 237 |
| Introduction | p. 237 |
| Is VoIP Spam Inevitable? | p. 238 |
| Technical Approaches to Combat E-Mail Spam | p. 240 |
| Filtering Spam Using Identity Information | p. 240 |
| Grey Listing | p. 241 |
| Challenge/Response (Sender Verification) | p. 242 |
| Distributed Checksum Filtering (DCF) | p. 242 |
| Content Filtering | p. 243 |
| Summary of Antispam Approaches | p. 243 |
| VoIP and Spit | p. 243 |
| Summary | p. 245 |
| References | p. 246 |
| Conclusions | p. 247 |
| Summary | p. 247 |
| VoIP Is Still New | p. 248 |
| VoIP Endpoints Are New | p. 248 |
| VoIP Standards Are Not Complete | p. 249 |
| Base VoIP Security on Best Current Security Practices for Data | p. 249 |
| VoIP Is a QoS-Sensitive Data Application | p. 250 |
| Merging Public and Private VoIP Services Will Be Problematic | p. 250 |
| Concluding Remarks | p. 251 |
| Index | p. 255 |
| Table of Contents provided by Ingram. All Rights Reserved. |
