German security agency warns of VoIP security risks

Germany's Federal Office for Security in Information Technology (BSI) is warning businesses of potential security risks with VoIP (voice over Internet Protocol) technology in a study presented at the Systems IT exhibition and conference in Munich.

The VoIPSEC report, released on Monday at the opening of Systems, appeared one day before Skype Technologies, one of the world's largest providers of VoIP service, acknowledged critical flaws in its software and urged users to upgrade to the latest version.

In its report, BSI warns that although no spectacular attacks in the business world have been reported yet, it's only a matter of time before problems will emerge.

The report lists 19 varieties of attacks on VoIP systems. These, in turn, can lead to a number of security threats, such as identity theft, data manipulation, transmission errors and incorrect billing.

Also, VoIP opens the door to the various forms of malicious software wildly spreading in data networks, such as viruses, worms and Trojan horses, according to the report.

Authors of the VoIPSEC study urge companies to analyze where they plan to implement VoIP, how crucial secure communication is to that particular business process and what level of security can be ensured. And although one of the biggest sales pitches of companies supplying VoIP systems is convergence of voice and data networks, the authors are recommending a separation of IP voice and IP data networks."

The study is available in German at: http://www.bsi.de/literat/studien/VoIP/index.htm.

In a panel discussion at Systems, Manfred Fink, president of Fink Security, urged businesses to be careful of the current hype surrounding VoIP. "Manufacturers are telling businesses how they can save money by converging their voice and data networks," he said. "But IT managers should be aware that the money they may save in combining their IP voice and data networks could be offset by the money they will need to spend to make these networks secure."

Detlev Henze, a security expert in the IT security unit of the safety control agency TÜV Rheinland Group, urged users to move "very carefully" on deploying VoIP technology, especially on a global basis. "It's best to start in small, closed user groups, and to work closely with security experts who are aware of the many potential risks involved in VoIP," he said. "This is a moving target."

The Systems event runs through Friday.