We hope you have already embraced all the benefits of SIP trunking and are using it to increase the efficiency of your business communications. We also hope that you stick to security protection measures described in this blog post. Today, we’d like to look deeper into one of the threats looming over the effectiveness of your telephony system, namely toll fraud.
It’s hardly a new invention and it has plagued legacy telephone systems for years. In the traditional scheme, a person gets unauthorized access to someone else’s phone line to make long-distance calls and avoid paying for them. With the transition to cloud-based technologies and low-cost communication, it has become less profitable and more complicated, but the problem still exists.
There are several vulnerable points that provide opportunities for unauthorized access. These are:
- Configuration errors and technology malfunctions
- Flaws at the level of technology application by users (authentication, passwords)
- No protection on devices, especially mobile ones
- Connectivity of the PSTN (accepting calls from virtually anyone)
Good news is – there are specific measures that can help you protect your telephone system from fraudulent activity and avoid paying someone else’s bills, including your own sticky-fingered employees. Some of them fall in the general protection category, while others deal with toll fraud specifically. Add them to your regular security practices and double-protect your system.
1. It has already been said – and we can’t stress it enough – that all users having access to your telephone system should change default passwords and use their own high-security ones, which should be changed on a regular basis.
2. Most of the fraudulent activity happens when no one is there to track it down. That’s why a smart move would be to restrict calling before and after business hours.
3. If there is any unused equipment – such as modems – physically disconnect them.
4. Monitor call patterns on a regular basis. Plenty of fraudulent activity might take place within a short period of time, and without regular audits, you risk missing it.
5. Restrict transferring and forwarding calls to external phone numbers. If possible, allow international calls only to pre-defined numbers and set a password for those who want to make them.
6. As soon as employees leave your company, delete their mailboxes and withdraw their access rights. This way you will not only prevent tampering with your system on the part of former workers, but also seal a potential security hole.
7. Do not accept any traffic that doesn’t come from your SIP provider – block other sources.
8. Use systems for intrusion detection and prevention firewalls.
9. Implement a system of tracking and signaling invalid access attempts.
10. Encrypt your SIP traffic with TLS (used for signaling encryption and authentication) or RTP (used for media encryption).
11.Update your system on a regular basis.
The VoIP experience can and will be rewarding – provided you implement it properly and remove all possible threats before they even emerge. Stay tuned for more useful information about SIP trunking, VoIP management, wholesale VoIP origination solutions and much more!