Sipera secures advanced UC networks

Sipera Systems, a security firm focusing on unified communications (UC), has announced a new edition of the Sipera IPCS range of security appliances adding functions for more advanced corporate IP telephony networks.

IP telephony security is becoming an increasingly important issues for organisations, who are beginning to see their telephone networks subject to the same risks as their IP networks.

The new products are particularly aimed at organisations using SIP trunking, where the organisation using an IP-PBX internal telephone network connects to its telephony service provider using an internet link rather than a traditional telephony link.

The new line of IPCS products better secures SIP trunks and better integrates with SIP trunk provider services, Sipera said.

The new products add security for telecommuter and mobile telephony systems from Avaya, and the products' Viper security engine has been updated to download security signatures automatically, Sipera said.

The company argued that extending unified comunications systems to the trunk or to mobile locations redoubles the need for a sophisticated security system.

Among the appliances' new features are Session Border Control (SBC), integration with large SIP trunk providers and Quality of Service reporting, the company said.

For mobility and teleworker deployments the products add certificate provisioning, a HTTP/TFTP proxy for web services and configuration, a TLS/SRTP proxy for encryption, and granular policy enforcement.

Sipera also makes a security analysis toolset called Viper Services, introduced last year, which includes vulnerability analysis, risk assessment and penetration testing.

Security experts have said that much of the notoriety around voice-over-IP (VoIP) vulnerabilities comes because the technology is relatively new and its code wasn't necessarily written with security in mind — a problem that plagues many new technologies.

At a Black Hat security conference last year, for instance, Peter Thermos, chief technology officer of security consulting firm Palindrome Technologies revealed vulnerabilities to media gateway control protocol (MGCP) that enable rerouting calls or cutting them off.

Thermos also showed a vulnerability to ZRTP, a pending-standard, encrypted VoIP protocol that didn't encrypt the sounds of tones made by pressing phone buttons. That potentially left credit card numbers being entered over VoIP lines open to being picked off, he said.

Tim Greene of Network World contributed to this report.