Securing the Communications Endpoints

Over the last two weeks, we’ve spoken about securing the network and perimeter, so this week, we talk about the risks to communications endpoints and guidelines for securing them. I have mentioned in the earlier article that endpoint insecurity is not a systemic risk and I stand by that statement. However, they do impact productivity for users and may cause significant overhead for administrators who would rather focus on systemic, long-term concerns. Also, compromised endpoints may lead to loss of data, especially in call center scenarios, where agents have access to customer information. This kind of information leakage, while minor, may also lead to embarrassment and reputational damage for the company.?

Endpoints have been evolving over the last few years – from pure hardware devices with limited functionality to pure software apps with far more capability to work autonomously from the PBX – look at Teams or softphones from Avaya and Cisco, for example. But the increase in capability and complexity has brought with it additional risk – the attack surface for endpoints has increased. Even headphones today are really smartphones – they allow apps to be installed, and they run full operating systems (often Android), so the security risks have multiplied.?

Risks to Endpoints?

Risks from software vulnerabilities?

If you are running an endpoint that uses Android, it’s obvious that every Android vulnerability would be a matter of concern for you. And if you are using a softphone, then every vulnerability on that OS is an issue. And if you are using the softphone through the web browser, then every web browser issue is a problem. In short, software vulnerabilities in the environment of the endpoint are a risk to the endpoint itself.??

An attacker can compromise the environment?to gain control of the endpoint and surreptitiously gather information by enabling audio or video capabilities, tampering with remote management capabilities, or at the least, denying service to the endpoint.?

Risks from third-party apps?

If you are running a hard phone with smart capabilities, you possibly have the capability to download and install third-party apps on your hard phone. Similar capabilities also exist in softphones – the ability to install apps, applets, plug-ins, and so on. While these apps can potentially bring in new capabilities, they also provide new pathways for attackers to gain control of the endpoints. As in the case of software vulnerabilities, information leakage, service disruption, and service denial at the endpoint are the biggest issues.?

READ THE REST ON ASSERTION BLOG - Protecting Communication Systems – Securing the Endpoints