VoIP is a great business utility. However, like any other application, it can also fall prey to cybersecurity threats if proactive measures are not taken. Here is what you need to know.
The internet can be a dangerous place. It’s packed with a vibrant array of sites and traffic as people all over the world connect and communicate. But just like in any busy marketplace, dangers can lurk around any corner.
Every internet-based application faces certain threats, and your Voice over Internet Protocol (VoIP) security is no different. There’s little doubt that using an internet connection for your telephone communications makes a huge amount of sense in terms of the flexibility, scalability, and reduced overheads it can offer your business. So it’s not surprising that so many businesses are making the move to VoIP, with the global market expected to reach an incredible $183.7 billion by 2027.
At the same time, the possibility of accessing a VoIP system from anywhere in the world with a simple internet connection can leave you vulnerable to a range of security attacks.
So is VoIP secure? The short answer is yes, as long as you take proactive measures to protect your network, team, and customer data. Follow VoIP security best practices and you’ll be able to take advantage of the wider benefits of the system, safe in the knowledge that your communications are secured.
A short note on VoIP security
VoIP security is a way of protecting your commercial communications from hacking or infiltration. Cybercrime is commonplace globally, and scam calls, phishing attacks, malware, distributed denial of service (DDoS) attacks, caller ID spoofing, eavesdropping, and social engineering attacks are regularly targeted at internet-based telephony systems.
In the worst cases, hackers can listen in on your business’s calls, steal sensitive information about your customers, and even hijack the system to carry out further scams and make expensive international calls.
Thankfully, your VoIP security risks can be dramatically reduced by taking proactive measures, hand-in-hand with your service provider. Accenture found that the average cost per cyber attack for most businesses was $380,000 per incident, but that by taking measures followed by leading companies, this average cost could be reduced by 72% to $107,000.
Happily, they also found that direct attacks are down 11% and security breaches 27% compared with the previous year’s findings. Phrased differently, if you put the right VoIP security controls in place and prepare your business now, you’ll have the best chance of staying safe in the future. All while enjoying the benefits of VoIP calling.
So what exactly are the risks that threaten VoIP, and how can you mitigate those risks?
We’ll be looking at:
- The biggest VoIP security threats
- How to ensure your provider offers adequate VoIP security
- What you can do to protect your network locally
Let’s begin.
The most common VoIP security threats
Based over the internet, VoIP systems face very different dangers to traditional copper-wire landline phone setups, as the system can be accessed from anywhere in the world. Small businesses are a particularly common target for cyberattacks as their security measures are less likely to be kept up-to-date, with one in five falling victim.
Here are the five most common VoIP security threats you’re likely to encounter.
1. Toll-free frauds
Toll-free frauds are all about attackers spending your money rather than their own. Using your network, they’ll make expensive international calls that rack up fast on your phone bill, often while carrying out a larger scam.
To get hold of the necessary verification codes, they might target administrators at your company with phishing attacks that trick your employees into giving out sensitive information or IP addresses.
Again, these can be hard to detect without keeping on top of your call and billing history, or by setting clear spending caps that protect you from being charged for fraudulent account activity.
2. Caller ID spoofing
Caller ID is one of the great innovations of telephony, allowing people to quickly screen calls in order to decide to accept or reject the call.
Today, hackers can spoof caller IDs to appear as if they’re calling from a trusted source, such as your business’s bank, or a service provider. This makes it easy for them to trick employees into giving out sensitive information that can in turn grant access to your VoIP phone system.
3. Eavesdropping
If your network is unencrypted, it can be possible for hackers to listen in to calls and voicemails, and in that way collect any sensitive information that might be exchanged over your phone system. In the worst cases, this might include credit card numbers or other personal data.
Attackers are then free to spend customers’ money, sell their information, or even attempt to blackmail customers by threatening to release any private information disclosed, depending on the nature of the call they intercepted.
Using an encrypted VoIP network and secured local internet connections – such as those with Transport Layer Security (TLS) and Secure Real-time Transport Protocol (SRTP) – are the best protection against this type of attack.
4. Unauthorized calls
The most straightforward type of attack involves hackers taking control of your phone system and making calls under the guise of your business. They might run an automated calling program that telephones your entire contact book and attempts to scam them out of personal financial information. They might ask your customers to ‘confirm’ their credit card details, or they might use your phone system within a wider scam.
Unauthorized use of your network can be hard to detect, so it’s best to regularly check your call history and logs to spot anything suspicious. The best providers let you set up automated alerts when your usage goes over a certain limit, which can also help you spot any unauthorized use.
5. Social engineering
Surprisingly, only around 3% of malware used in attempted cyber-attacks is targeted at a technical flaw. Instead, the vast majority use social engineering and aim to trick an individual into giving potentially critical information to a scammer.
Put simply, these attacks seek to exploit the trust of employees and to trick them into handing over sensitive information that allows hackers to access your system. Scammers build a relationship with your staff member, whether that’s over email or on the phone, sometimes using tricks like caller ID spoofing to appear even more convincingly as the real deal. Then, they’ll extract the information they need and slip quietly into your system, before making expensive phone calls, impersonating you, or accessing customer’s private information.
Such attacks are increasingly convincing and can be incredibly sophisticated, with a group of attackers working together to create a false narrative and slowly move towards the information they’re targeting. For most businesses, there simply isn’t enough education on the risks and forms of social engineering attacks, which partly explains their growing frequency.
Social engineering scams can also be upsetting encounters, with scammers using threats, harassment, and urgency to pressure staff into giving them what they want, preying on their inbuilt desire to be helpful. It’s also not uncommon for employees to blame themselves in the event of a breach, so getting ahead by providing education and training is key.
How can you ensure your VoIP provider offers adequate VoIP security?
Secure VoIP calls can be achieved in part by choosing the right provider. You need to work with a company that takes the security of your network seriously, and that follows best practices across its own operations.
Here are some of the main things to look for when choosing your VoIP provider:
Look for encryption
This is one of the best ways of blocking any attempted interception of your communications. If the messages can’t be decrypted, then attackers won’t be able to capture any sensitive information, so make sure your provider uses industry-grade encryption at several points in their network. They should be using Transport Layer Security (TLS) to hide the data being transferred and to authenticate connected callers, helping your staff spot any potential caller ID spoofing. That way, you can avoid potentially expensive damage being done to your business.
Choose a provider with security accreditations
Your VoIP provider should be Health Insurance Portability and Accountability Act (HIPAA) compliant if you operate in the health sector, and be up to date with all the associated security protocols. If they’re operating in the European Union or European Economic Area, they’re also now legally required to comply with the General Data Protection Regulation (GDPR) to ensure they’re taking the necessary steps to protect data carried on their system.
Use a Virtual Private Network (VPN)
A VPN is particularly useful for employees working remotely, as it creates a private network over which data is sent. Placing your VoIP system on a VPN makes calls virtually untraceable, and keeps your business communications private and secure.
Check their security policy
The best providers will have a clear security policy where they spell out their approach to protecting your data, and their processes in the event of any breach. In it, they should explain how you report a vulnerability, what their action plan is during a security event, explain the system hardening they have undertaken to prevent attacks, and detail the relevant accreditations they have that show they’re up-to-date.
[image suggestion – screenshot of Freshdesk Contact Center’s Security Policy]
How can you enforce VoIP security at your end?
It’s a two-way street, and reducing VoIP security risks means following best practices within your business operations as well as choosing a provider who takes responsibility.
Here are the things to keep on top of your mind to enforce VoIP security:
Test your network
Cybersecurity isn’t just about building a firewall to hide behind. The most effective protection involves active defense, with regular checks of how your network is performing. Your system administrators should be running regular evaluations of your network access so that ex-employee accounts are removed and all passwords refreshed. It’s also important to run penetration testing to find any weaknesses in your network that can be secured – before hackers do.
Ensure password hygiene
For the best level of security, your employees need to use unique and strong passwords for their VoIP logins, of sufficient complexity and length. It’s all too common that individuals repeat passwords across systems, but that only means that when one is breached, they all are. So it’s important that your staff regularly update their passwords, and that they follow best practices as used by data research centers worldwide.
For more insight into common mistakes, check out this analysis of 18,419,945 passwords.
Use two-factor authentication
Two-factor authentication is a more recent innovation that provides an extra level of security beyond a password. It requires users to re-authenticate their login from a secondary access point after a period of time, or when accessing the system from a new location. When used universally across your network, it makes it considerably harder for hackers to gain access.
Monitor call analytics
Some attacks can only be easily tracked when looking back at your call logs and history. Setting up regular monitoring of these analytics can be your first opportunity to spot unusual activity or spikes in billing that might be attributed to the unauthorized use of your system. You can also work with your provider to ensure there are billing and usage limits in place that can automatically alert you to any excessive use.
Implement mobile device management policy
Attackers learn to target the weakest link in a security chain, and so it’s important to stay on top of the devices that your employees are using to access your VoIP system and to protect them all from attack. A clear management policy might include rules on using Wi-Fi for encrypted voice calls, keeping mobile software up-to-date, using fingerprint ID to secure devices, or making sure lost or stolen devices are reported immediately. Having those measures in place ensures that every part of your operation is equally well protected.
Have a crisis plan in place
With proper preparation, a breach event needn’t be a total disaster. Draw up a clear plan so that if an attack does happen, you and your employees have a straightforward series of steps to follow. That means your response will be quick, unified, and effective.
With proactive measures, you can rest easy
There’s no avoiding the risks inherent with using the internet to transmit data between servers based all over the world, and there’ll always be a chance that those communications can be vulnerable to attack. But it’s clear that by taking the right steps you can protect your VoIP network security, and make sure your internal and client-facing communications remain private.
By choosing the right provider, taking proactive steps to educate your staff, and putting in place straightforward protocols, you can put the risk of cyber-attack and VoIP security issues firmly out of sight.
Illustrations by Nikhil Kanda
________________________________________________________________________________
About Freshdesk Contact Center
Freshdesk Contact Center (formerly Freshcaller) is a modern-day cloud phone system that enables businesses to conduct telephony operations with maximum security. It can help your customer support and sales teams carry out phone conversations effortlessly and without the fear of VoIP security threats. With its cloud-based architecture, Freshdesk Contact Center brings together the best of legacy features like IVR, call waiting, VoIP solutions and advanced call routing capabilities like Smart Escalations, Customizable Performance Reporting to help you set up state-of-the-art call center operations. The VoIP phone system offers phone numbers in 90+ countries, requires zero phone hardware, and is extremely easy to use.
Visit our website for more information.
