VoIP security: hardening a SIP platform against fraud and eavesdropping

1. Reduce exposure before anything else

A SIP port open to the entire internet will be scanned within hours of going live. The first control is not a stronger password; it is deciding who is allowed to talk to the platform at all.

Where remote users cannot be pinned to fixed addresses, put a session border controller or the platform's own tunnelling mechanism in front of the PBX so registration traffic is not exposed directly.

• Restrict SIP signalling ports to carrier IP ranges and known office networks.
• Terminate remote users through VPN, an SBC, or the vendor tunnel rather than open SIP.
• Disable SIP ALG on edge routers — it rewrites packets and hides real problems.
• Move web administration onto a management network, never the public interface.

2. Encrypt signalling and media

Unencrypted SIP exposes credentials and call metadata to anyone on the path; unencrypted RTP exposes the conversation itself. On a modern stack there is no good reason to leave either in the clear.

Use TLS for signalling with a valid certificate, and SRTP for media. Verify it end to end: it is common to find TLS configured on the PBX while half the handsets silently fall back to UDP.

• TLS 1.2 or later for SIP signalling, with certificates that actually validate.
• SRTP for media, enforced per endpoint class rather than left optional.
• Confirm negotiation on real devices — check the active channel, not the config file.

3. Make authentication expensive to attack

Extension numbers are guessable, so the secret is the only thing standing between a scanner and a registration. Device secrets should be long, random, unique per device, and never equal to the extension number.

Pair that with rate limiting. Automated registration attempts should be blocked at the network layer after a small number of failures, and administrators should be alerted when blocking spikes.

• Long random secrets, generated per device and stored in your provisioning system.
• Fail2ban or the platform's intrusion-detection equivalent, tuned so valid phones are not locked out.
• Remove default credentials on handsets, gateways and appliances during provisioning.
• Separate administrative accounts per engineer; no shared logins.

4. Contain the financial blast radius

Assume, for planning purposes, that one account will eventually be compromised. The question is what it can dial and for how long before someone notices. Toll fraud losses are driven almost entirely by how long the fraud runs unchecked.

Outbound permissions should be a deliberate class per user group, not a single permissive route shared by everyone in the dial plan.

• Outbound classes: internal only, national, international, premium — assigned per extension.
• Block high-risk international destinations by default and unblock on request.
• Set concurrent-call and spend limits with the carrier as a hard backstop.
• Restrict or disable call forwarding to external numbers where the business does not need it.

5. Monitor, and rehearse the response

Controls that nobody watches degrade quietly. Registration failures, unusual call destinations, out-of-hours volume and trunk saturation are the signals that catch fraud in progress.

Write down what happens when the alert fires: who disables the account, who calls the carrier, and how service is restored. An incident at 02:00 is not the moment to invent that process.

• Alert on out-of-hours call volume and first-seen international destinations.
• Review CDRs weekly for the top destinations and longest calls.
• Keep configuration backups offsite so a compromised system can be rebuilt quickly.
• Test the escalation path with the carrier before you need it.