VOIP security industry: Guilty as charged

Oddly enough, when I used VOIP to discuss this Network World column with a colleague in the United States, the call dropped five times. I gave up and switched back to my cell phone.

Do I like VOIP? It has great potential, but for now the answer is no.

The 10 nasty questions to ask your VOIP supplier:

1. Do all phones and the central infrastructure use 100% secure protocols?

2. Will you warrant this system to operate on the raw Internet with no further add-on devices?

3. Can you manage all VOIP devices automatically, simply, with a scalable, easy-to-manage solution that will support all VOIP end-client including soft phones and end-devices that are connected on the Internet?

4. Explain how phones are, by default, securely provisioned. Including devices that you do not have physical possession of during the provisioning process.

5. Explain how you can conclusively prove that a phone using your system was provisioned by you.

6. Explain how you can conclusively prove that when I make a call, (say from my hotel room) I can be 100% assured that my phone is connecting to the corporate exchange (without using extra security devices such as IPSec).

7. Explain how users are strongly authenticated when connecting their devices. Ideally both device and user should authenticate.

8. Will your system allow federation of identities so we do not need to maintain (yet another) autonomous authentication system?

9. Is there segregation of duties? For example: can the administrator access voice mail and set passwords without the user being aware.

10. Are voice mail systems encrypted, and are all backups encrypted (voice mail, user-names, configuration, passwords)?

Simmonds is a member of the management board of the Jericho Forum, an organization pushing for innovation in e-commerce security, and is also chief information security officer for a large, global chemicals corporation.