Audit Analysis Models, Security Frameworks and Their Relevance for VoIP

TL;DR

This paper reviews existing models, frameworks, and standards for VoIP security, highlighting gaps such as the lack of coverage for social engineering attacks and comprehensive security requirements.

Contribution

It provides a comparative evaluation of current VoIP security frameworks and identifies the need for a more extensive, inclusive security model.

Findings

No security framework considers social engineering attacks.

Existing frameworks do not cover all security requirement categories.

A more comprehensive security model for VoIP is needed.

Abstract

Voice over IP (VoIP) is the transmission of voice and multimedia content over Internet Protocol (IP) networks, this paper reviews models, frameworks and auditing standards proposed to this date to manage VoIP security through a literature review, with descriptions of both the historical and philosophical evolution reflecting an adequate knowledge of related research. Three research questions are raised here: RQ1. What are the requirements to be met by a model of security audit in VoIP systems to achieve their goals? RQ2. Today, are there additional attacks that previous works have not considered? RQ3. Which security requirements in the VoIP systems are covered (and which are not covered) by security frameworks? After some discussion about VoIP Protocols, Attacks on VoIP, Information Technology (IT) audit, IT security audits, Frameworks and auditing standards, we present a unified view of VoIP Security Requirements; as well as considering the contributions and disadvantages of frameworks and auditing standards toward achieving those requirements through a comparative evaluation. It was determined that there is no security framework which considers social engineering attacks in spite of being an important aspect to consider in security management VoIP; also there is no specific framework that covers all categories of security requirements for VoIP system, therefore, a more extensive model is needed.