Introduction:

Security is a concern for every company at every level. The wide adoption of VoIP based on the SIP protocol has introduced many new issues. Deployment of the SIP protocol introduces new components, applications, servers, endpoints, etc. The introduction of media gateways to handle traditional telephony converted to SIP protocol for VoIP on the data network introduces security management challenges on the network. If not using media gateways, organizations are adopting VoIP providers that carry traffic on an IP network connection. These carriers are using the SIP protocol. The widespread adoption of SIP opens potential threats exposing the vulnerabilities of the protocol. This course will help you understand the issues of SIP security. The protocol will be examined as well as each component in a SIP design for security vulnerabilities. We will conclude with a discussion of the policies and procedures that enhance SIP security.

Audience:

Network security planning teams, network administrators, IT and telecom engineers, and IT security management. This course is also beneficial for the homeland security community and crime prevention/investigation officers.

Prerequisites:

SIP Protocol, Components and Design (SIP, 1 day). Before taking this course, you should have completed at a minimum the SIP Protocol course to understand the basics of the protocol before learning the security issues and concerns.

Customize it

This 2-3-day course will be customized to your needs and specifications. Enowireless will assist you in identifying those needs and specifications. A word to the wise, there are many vendors of wireless training. They will typically have a broad and general course, one size fits all, already developed and just put your organization’s name on the title slide. This minimizes their effort and time investment. At Enowireless, every course is made to your exact and exacting specifications. We help you ensure what you are getting is what you really need even if at the beginning you weren’t too sure of what that was. We fit the class to your needs. We never fit you into our “standard”, one size fits all, class.

Course Objectives:

Learn how to evaluate your SIP security concerns on all levels Understand the key components for security planning purposes Discern security vulnerabilities of SIP at the protocol layer Design for secured network communications by understanding protocol level attack methods

Course Outline

SIP Security: An Introduction Overview of SIP security challenges How SIP security relates to overall data security strategy How SIP relates to traditional telecom security Discussing the SIP protocol using the OSI model SIP Architectural Vulnerabilities Physical Layer Security Endpoints Data Link Layer Security as related to SIP Firewalls and NAT's DoS Attacks Transport Layer Security Digest authentication and SIP Session Layer Security The protocol of SIP and security vulnerabilities ---SIP standard and attacks ---IETF and security standards Application-Level Security Vulnerabilities ---Vendor-specific issues related to SIP security Encryption topics for SIP Presentation Layer Security Rights and access levels Application Layer Security (Load balancers, Proxy Servers, Media Servers, etc.) Password issues with SIP and applications User authentication Remote system access issues **Network Security Issues and VoIP **Gateway Security Conclusion - Security Best Practices Security audit methods Vendor management Testing systems and devices: Available tools