VoIP and Compliance Regulations Make Strange and Difficult Bedfellows

Network World — As attacks against VoIP persist businesses not only have to defend themselves, they have to do it under the gun of regulators who want proof that security was addressed in accordance with their ever-changing rules.

VoIP denial of service, toll fraud and eavesdropping attacks are serious problems, yet many businesses lack some of the most basic VoIP protections such as encryption, experts say. There is a sense of urgency to deal with these issues because at the same time, businesses are forced to comply with regulations such as the Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act (HIPPA) and Payment Card Industry (PCI) standards that present a moving target as they are revised and updated.

The most part

For the most part, regulations try to protect personally identifiable information that can lead to identity theft, fraudulent use of credit cards, pilfered bank accounts and toll fraud against corporate phone systems.

VoIP is rarely addressed directly in these regulations, but the rules nevertheless apply in some cases. For example, PCI standards say, "Use strong cryptography and security such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks."

That calls for encrypting VoIP calls that cross the open Internet in which credit card numbers are being recited, says Michelle Klinger, a PCI qualified security assessor from Dallas. "I would be inclined to validate that the calls are being encrypted," she says, although VoIP on internal networks would not need that protection. Businesses need to look out for language in regulations that sound like it refers to VoIP.

For instance, HIPAA says businesses must take steps to secure electronic protected health information, which might not seem to affect VoIP calls, but relates directly to recorded calls and digitally stored voice mail, part of any VoIP system. Similarly, if interactive voice response is used to navigate to protected information, its use should be monitored and documented.

The other hand

On the other hand, the Federal Deposit Insurance Corporation (FDIC) has published specific VoIP guidelines to protect customer data traveling in IP voice networks in accordance with Graham-Leach-Bliley regulations.