What are effective ways to secure SIP connections?

Session Initiation Protocol, or SIP, is a bedrock standard governing how devices communicate over the internet. To secure SIP, as is the case with most security issues, a defense-in-depth strategy is essential. If one security layer fails, there is another layer to provide protection. Let's take a look at several techniques you can use to make your SIP connections more secure.

1. TLS 1.3. Transport Layer Security version 1.3, the most recent version of the standard, beefs up the algorithms used to encrypt internet traffic. Check your SIP infrastructure to determine which version your network is using. To provide backward compatibility, many products will, by default, use TLS 1.2. Wherever possible, upgrade to TLS 1.3 -- should be a no-cost upgrade -- to enhance session-level security.

2. Firewall. Don't forget about this first line of defense. Contact your security administrator to review firewall port configurations to make sure you have the protection you need. If you have a next-generation firewall, determine if you can enable denial of service (DoS) protection of SIP ports. A massed attack on legitimate SIP ports can effectively bring down a SIP gateway that's overwhelmed by the call volume.

3. Integrated SIP firewall. Some SIP gateways, usually higher-end systems, have SIP security built in. These gateways won't replace a firewall, of course, but they may have supplementary features that can buttress your existing firewall. Again, look for DoS features as this type of protection is less likely to be available via traditional firewalls.

4. Theft of service analysis. It is important to secure SIP by shielding your SIP environment from theft of service. If unauthorized people tap into your system to place their own voice over IP calls, that extra burden can result in poor voice quality and performance, affecting legitimate users. Conduct a security analysis on a regular basis -- at least quarterly. Review call and usage logs from your SIP gateway. Calls from parts of the world where your company has no business connections could be related to a security breach. Finally, don't use default admin credentials on your gateways. These could be used by unauthorized individuals to compromise SIP gateway security.