We ask because many modern companies (including all our clients) have long since switched to Voice Over Internet Protocol (VoIP) business telecom systems. This technology allows employees to connect through voice calls using only their internet connection.
It offers a wise choice considering that using VoIP grants several benefits to a business.
VoIP’s benefits include lower operating costs, greater convenience than traditional services, increased accessibility, higher scalability, and the ability to multitask. VoIP also offers advanced features for teams of any and all sizes, is completely flexible and portable in terms of geographical location, and offers superior voice quality during telephone and chat calls. Last but certainly not least, VoIP can often be integrated with a business’s CRM software, offering greater ease to employees interacting with multiple clients.
Unfortunately, VoIP systems come with their own downsides, with cyberattacks being their number one issue.
The good news is that companies can protect their VoIP system from hackers. If you already implemented a VoIP phone system within your business, you still have time to secure it.
Keep going to discover common threats to your network and how to block them.
Why does VoIP Need Protection?
VoIP systems always require a stable internet connection to function properly (or at all). Alas, their reliability on the internet makes them vulnerable to various security issues.
Some of the most frequent ones include:
SECURITY ISSUE #1. DENIAL OF SERVICE
Denial of Service (DoS) attacks shut down machines or networks, making it a common threat to VoIP systems. A DoS attack makes the VoIP system completely inaccessible.
When this happens, legitimate users of VoIP technology probably can’t access their devices, and all calls will suffer lower call quality, latency, and uptime.
SECURITY ISSUE #2. WAR DIALLING
War dialing attacks by hijacking the company’s private branch exchange (PBX), aka the programming for all internal extensions, transfers, and call groups, and then using the PBX to scan for other connected phone networks. This means hackers can dial numbers and connect to modems, printers and other extensions.
SECURITY ISSUE #3. TOLL FRAUD
Toll fraud attacks by making calls to outside lines using a company’s existing system. For example, hackers will dial costly international numbers, possibly with their partner in the middle, intending to rack up toll charges to your business.
SECURITY ISSUE #4. PHISHING
Phishing offers a depressingly common threat wherein attackers send fraudulent messages designed to trick victims into revealing sensitive information. Often, the unsuspecting victims would divulge information about passwords, internal IP networks, and similar data. Surprise, the call or message is coming from Inside The System. It’s the technological equivalent of the horror movie where the attacker is already in the house.
In fact, someone tried to hit me, the author of this article, with a phishing attack pretending to be my direct supervisor. A text message came through my personal cell phone, claiming to be my supervisor, saying she was busy in a meeting and I needed to go get Google gift cards for her. We’re a VoIP provider. I have a softphone on my cellphone that hooks up directly to my business extension. We have company wide messaging. My supervisor would not contact me through my personal cell phone, much less for Google gift cards.
I didn’t HAVE to play with the wannabe cybercriminal, but I did. They really make me angry. See below for how.
SECURITY ISSUE #5. MALWARE
Malware is a catchall category, malicious software that attackers install via email or phone connections. A file or code arrives over a network with the goal of infecting, stealing, or mapping the information contained within a system.
After infecting the system with malware, VoIP hackers use the connection to enter your network and steal critical business information
SECURITY ISSUE #6. CALL INTERCEPTION
Call interception attacks come through unsecured networks to intercept the Session Initiation Protocol (SIP) traffic. SIP is software that serves to initiate, maintain, and terminate real-time voice and video sessions.
A victim of a call interception attack can be redirected to another line hosted by the hacker, for example. They may not be aware they’ve been redirected, and are often tricked into handing out sensitive information
6 Tips To Boost VoIP Security
Given the variety of threats imposed by attackers on VoIP systems, optimize your VoIP security ASAP.
Use these 6 valuable tips to get you started.
TIP #1. SET UP A FIREWALL
Secure firewalls are necessary for all VoIP systems. For the love of continuing commerce, use firewalls. Your VoIP software and hardware firewalls scan information as it goes in and out of the system to ensure it’s secure.
Should spam or a threat come your way, the firewall will identify and gain control over it, shielding your system from the attack.
Also, a good firewall will allow the data packets you send to travel unhindered, which means they go faster and without being read by a third party.
TIP #2. Use Strong Passwords
Your VoIP system is just like any other online software or platform you use for handling sensitive information. Therefore, it needs to be protected with strong and regularly updated passwords just like you use on the rest of your sensitive information.
When creating strong passwords, aim for combinations of at least 12 characters that include numbers, upper- and lower-case letters, and special symbols. For ultimate protection, go for passwords consisting of a random character series, and use a strong password manager because you’re never going to remember them. We all know that piece of paper we wrote the random string on immediately gets sucked through to another universe and we will never see it again.
Set a password as soon as you configure your VoIP system. Do it like a religious obligation. Otherwise, you’ll probably forget about it later.
Also, remember that some VoIP phones come with pre-set passwords, often available publicly. That’s why you should change yours as soon as you get a chance. When we set up one of our client’s systems, we change them ourselves because we do this for a living. If you’re trying to set up your own, however, change the password.
Ideally, try to change your passwords every three months. At least twice a year? More than once every five years, maybe?
TIP #3. Restrict Calling
Toll fraud constitutes a pretty good chunk of total VoIP attacks. If your business runs locally, you’re only making and accepting local calls, there’s no need to have the international call option enabled. This allows you to be on the safe side and avoid paying expensive bills you weren’t even responsible for making. They can’t run up your bill at 2 am if they can’t call internationally!
You can let your VoIP service block 1-900 numbers to avoid toll fraud as well.
TIP #4. Encourage Team Members To Report Suspicious Behavior
Many of the VoIP attacks use the conduit of employee driven ignorant or irresponsible behavior. To avoid these kinds of attacks, team members need education on how to do their jobs without compromising system security. They should also know what fraudulent interactions look like.
To begin, every team member should know how to spot unusual network activity, handle passwords properly, and the channels to report suspicious behavior. They should also report ghost calls and missing voicemails whenever received. Staff also shouldn’t store voicemail for too long.
Cybersecurity training done once during onboarding isn’t enough. The new employee is trying to take a lot in all at once, cybersecurity can be difficult to take in, and the cyberworld moves fast. That’s why you should do periodical training to keep your VoIP safe at all times.
I promised above I’d tell what I did to the would be phisher. I asked my supervisor to confirm through our company messaging boards, just to make sure that really wasn’t her pranking me. She, of course, told me that it wasn’t her and thanked me for reporting the attempt. So, given that I hadn’t gotten a link yet, I played really, incredibly stupid until the wannabe criminal got mad and started insulting me. Then I blocked that number entirely and deleted all the text messages.
Had the criminal tried to send me a link, I’d have blocked and deleted immediately. I also keep extensive security programs on my smartphone, which unfortunately most people don’t.
The biggest tip to regular end users is keep an eye out for interactions and messages that make no sense. Nobody in a company should be asking over text or message for access to your device or phone out of the blue. Context matters, and a lot of security depends on knowing what’s “normal” and what isn’t. Anything suspicious should be checked out.
TIP #5. Deactivate Web Interface Use
In an ideal world, you should deactivate the web interface used for your VoIP system.
Why?
Using phone systems on desktop computer opens a major area of weakness to attackers. A single phone user falling prey to an attacker leaves the whole system exposed to an external party. All your data can be stolen in text format fairly easily.
So, unless it’s absolutely necessary to use the web interface, deactivate it. If the nature of the company demands web interface phones, secure them very carefully.
TIP #6. Use A VPN for Remote Workers
Virtual Private Networks (VPNs) encrypt traffic regardless of your employee’s location. Considering the rise in hybrid and remote work these days, steps to secure home offices are a must.
A company can and should set up such a network for all remote staff to prevent data leaks and breaches. Fortunately, using this service won’t degrade the call quality.
(Re)Gain Control Over VoIP Security
VoIP systems offer fantastic alternatives to traditional copper phone lines. After all, they offer many more features and flexibility at a fraction of the cost. However, their reliability on the internet also makes them susceptible to cyberattacks. Of course, the copper phone lines were vulnerable to someone with a set of headphones hooking up directly to the line outside the building, so take that for what it’s worth.
If you have just set up a VoIP system for your company or are thinking of migrating to a VoIP system, securing it needs to be your number one priority. Don’t risk falling prey to toll fraud, malware, phishing, and other attacks. Secure your business phones by following the tips from this article.
Want Someone To Just Handle It For You?
Here at NoContractVoIP, we create custom business phone systems that offer a full suite of hybrid and remote solutions for your telecom needs. Your success is our success.
To get the latest helpful content delivered to your inbox every month, subscribe to our newsletter here.
Looking for the finest stress-free custom business telephone systems? Contact us or call today at 866-550-0005!
—