Security analysis of VoIP networks through penetration testing

Abstract

The Voice over Internet Protocol (VoIP) is gradually becoming the de facto standard in communications technology and it is now viewed as a cheap alternative to Public Switched Telephone Networks (PSTN) due to its low cost and flexibility. However the flexibility and ability of VoIP to provide a converged data and voice network comes with security vulnerabilities and threats some of which are as a result of the existing IP architecture. However, the use of penetration tests can provide a framework for analysing and identifying vulnerabilities and flaws in a VoIP network which in turn can assist in enhancing security. This research presents how a comprehensive VoIP network security level can be attained by carrying out penetration tests through Ethical Hacking. In this research the VoIP Security Alliance (VoIPSA) taxonomy was used to classify VoIP threats which lead to the design of a penetration test which was carried out against a VoIP network in other to identify vulnerabilities and exploits relating to the VoIPSA threat classification. This resulted in the development of a VoIP penetration testing methodology suitable for VoIP Networks. The developed penetration testing methodology successfully identified vulnerabilities in the VoIP deployment which assisted in providing security recommendations.