Security Training
Security Certification
Internet Storm Center
Cyber Security Graduate School
Security Awareness Training
Penetration Testing
Industrial Control Systems
Cyber Defense Foundations
IT Audit
Computer Forensics
Software SecuritySEC540: VoIP and Unified Communications Security
- 36 CPE/CMU
- Laptop Required
This is not your grandfathers VoIP course!
The previous generation SEC540 VoIP Security course at SANS has been a great course that focused on an Asterisk PBX environment with soft-client phones. The course taught students valuable lessons in performing fundamental penetration tests on a VoIP environment using open-source tools and also taught students how to then remediate the issues that they discovered in the labs.
The updated SEC540 VoIP course has now been expanded to include numerous new and updated labs to reflect current threats; VoIP network scanning & enumeration, password attacks & registration hijacking, two-stage dialing, caller ID Spoofing, Metasploit 5 R3 VoIP hacking tools usage, extensive toll fraud coverage including the theft of VoIP minutes, sniffing & unauthorized call recording, call audio injection, covert tunnels over RTP, Vishing & SPAM (SPIT) and TDoS - just to name a few.
Perhaps more importantly, SEC540 is no longer limited only to an Asterisk PBX & soft-client environment. The class labs now utilizes multiple popular open-source and commercial VoIP / UC platforms; It begins with coverage of Retail VoIP -Vonage, Magic Jack etc. to reinforce the students understanding of VoIP protocol basics, as well as to get students used to working hands on with the tools used in the class. We move on to VoIP for the Small Business with both Asterisk and FreeSwitch implementations using Cisco phones and soft-clients, then on to the Cisco UC320 appliance with Cisco phones over both wired and wireless networks as well as covering Hosted VoIP / UC. Then to bridge the small to medium business and enterprise class VoIP & UC environments we move on to the Barracuda CudaTel appliance using Polycom phones. From here we advance to Enterprise VoIP & UC focusing primarily on Cisco with Unified Communications Manager, Cisco Unity, Cisco Unified Presence and Cisco Unified Contact Center Express and also our lab implementation of a Microsoft Lynx environment. As always at SANS we cover the remediation of each weakness that is demonstrated in the respective hands-on lab!
If you're considering an implementation of a VoIP & UC environment for the first time or adopting hosted VoIP you will learn how to do it securely. If you have already implemented a VoIP & UC solution you will learn how to mitigate the inherent risks of VoIP & UC by properly securing what you already have. If you are considering expanding your VoIP & UC environment to include BYOD devices you will learn to minimize the associated risks. Regardless of your organizations size or where you are in your VoIP & UC implementation roadmap the SANS SEC540 VoIP & UC Security course has something you can literally take away and put to use immediately!
| Course Contents |
|---|
| SEC540.1: VoIP Systems, Infrastructure, and Design |
OverviewThe VoIP field is very complex, with multiple technologies, standard and proprietary protocols, and components. This day starts with a brief introductory overview about VoIP concepts and devices and hands-on guidance to build the VoIP infrastructure used in the rest of the course.
In order to gain hands-on experience, students will learn how to configure and secure Asterisk, an open source VoIP PBX. Configuring and designing a real VoIP server will help reinforce the security issues and countermeasures that have to be deployed.
CPE/CMU Credits: 6 Topics
|
| SEC540.2: VoIP Protocols and Analysis |
OverviewOn day two the course directly jumps into the VoIP protocols world, introducing the main VoIP standards bodies and the most important VoIP signaling, media, and support protocols.
One of the most critical skills for network engineers and security professionals is mastering the identification and analysis of network protocols. The course provides hands-on techniques to identify and analyze VoIP signaling and media protocols using Wireshark, focusing on SIP/SDP and RTP/RTCP. In order to understand all further VoIP attacks in detail, it is mandatory to be able to perform an in-depth analysis of the protocols behavior, message types, call flow diagrams, and packet contents. The course dissects the SIP, SDP, RTP, and RTCP protocols to provide you with this in-depth knowledge. The main goal is to understand the details of the signaling and media protocols (SIP and RTP), the packets format, and how to analyze the stages of a SIP and RTP connection.
CPE/CMU Credits: 6 TopicsAuditor's role in relation to
Benefits of various auditing standards and certifications
Basic auditing and assessing strategies
The six-step audit process
|
| SEC540.3: VoIP Signaling Threats and Attacks, Part 1 |
OverviewMany organizations are deploying VoIP infrastructures, but few take the time to examine their deployment to ensure the infrastructure meets organizational requirements for security. This day examines the various threats that target VoIP environments, and multiple attack techniques and tools that leverage protocol and implementation weaknesses to compromise VoIP security. Taking an in-depth look at these techniques and tools, understanding how they work and the flaws they exploit, and practicing with them will help you make informed decisions to best accommodate the balance of usability, quality, performance and security that is appropriate for your organization. This day explores in depth tools and techniques focused on the VoIP signaling threats. CPE/CMU Credits: 6 TopicsVoIP signaling attacks: (SIP-based)
|
| SEC540.4: VoIP Signaling Threats and Attacks, Part 2 |
OverviewWhile understanding the attacks against signaling protocols is important, the real threat to a VOIP environment is compromise of the media protocols. The media protocol is where the "live" conversation is transmitted across the wire. Attacks against the media protocols can range from denial of service attacks to unauthorized recording of phone conversations. CPE/CMU Credits: 6 TopicsVoIP Media Attacks: (RTP-based)
|
| SEC540.5: VoIP Security |
OverviewAfter these attacks are dissected and understood, it is time to implement mitigation techniques, defenses, and countermeasures surrounding secure VoIP protocols and VoIP security devices. These elements provide multiple options to design and build a secure VoIP architecture. Only through an in-depth knowledge of the available VoIP secure protocols at the network, signaling, media, and key-exchange levels is it possible to protect the VoIP traffic and the sensitive contents exchanged through it. The protocols are complemented by VoIP security devices. CPE/CMU Credits: 6 TopicsVoIP security devices:
New VoIP security standards are still being designed and ratified. The course dissects and compares all of them and their specific details because this is what makes the difference to determine the best solution for your environment. The current state-of-the-art and best practices for all these secure VoIP protocols is analyzed. This VoIP defenses analysis is complemented with questions addressed to your VoIP vendor and service provider that guide you to select the best VoIP security solution based on your needs. Secure VoIP protocols:
|
| SEC540.6: VoIP Architecture |
OverviewThe last day covers the most relevant VoIP infrastructure and network attacks with the goal of emphasizing how important it is to build a secure VoIP infrastructure on top of a secure network architecture. Some of the network-based attacks with a higher impact on the VoIP infrastructure are analyzed as well as the best architecture practices to protect the VoIP infrastructure against these threats. CPE/CMU Credits: 6 Topics
The VoIP security lectures are supplemented by hands-on labs focused on identifying devices on a VoIP infrastructure and complementing the initial reconnaissance results with more advanced vulnerability scanning and VoIP usernames and phone extensions enumeration techniques. Additionally, the signaling labs are rounded out with SIP-based manipulation attacks using advanced MitM tools and techniques. VoIP media vulnerabilities are demonstrated and practiced using eavesdropping and advanced RTP manipulation attacks. Finally, the VoIP countermeasures modules contain technical security checklists aimed to evaluate the VoIP security capabilities and supported features and protocols offered by your VoIP vendor(s) or service provider(s). |
| Additional Information |
| Testimonial |
"The SANS SEC540 VoIP class is quite technical, but I would highly recommend it for any manager considering the implementation of VoIP in their network. Many are simply blinded by the huge potential savings from VoIP and fail to understand or recognize the inherent risks associated with it. SANS clearly outlines the risks literally hands-on that every manager must be aware of when implementing VoIP." Paul A. Henry |
| Laptop Required |
|
To get the most value out of the course, you are required to bring your own laptop so that you can complete all the labs and hands-on exercises. It is your responsibility to make sure that the system is properly configured with all drivers necessary to connect to an Ethernet network and follows the prerequisites below. It is critical that you have administrator access to the operating system and all security software installed. Changes need to be made to personal firewalls and other host based software in order for the labs to work. Mandatory Laptop Hardware Requirements
Operating System You are required to have Windows 7 or alternatively Windows XP installed and configured. An understanding of both Windows and Unix/Linux is required to understand the labs. VMware VMware Player or VMware Workstation is required for the class. You will use VMware running on either Windows 7 or Windows XP as the native laptop OS and guest operating systems Linux (virtual machine OS) operating systems simultaneously when performing exercises in class. If you're not using Windows as a base operating system on the laptop, you must bring a licensed virtual machine for Windows XP or Windows 7. You must have either the free VMware Player 1.0 or later or the commercial VMware Workstation 5.0 or later installed on your system prior to coming to class. You can download VMware Player for free at the VMware web site. Alternatively, if you want a more flexible and configurable tool, you can download a free 30-day trial copy of VMware Workstation from the VMware web site. VMware will send you a time-limited license number for VMware Workstation if you register for the trial at their Web site. No license number is required for VMware Player. Additional Software IMPORTANT! Some of the course exercises are based on Windows, while others focus on Linux. We will provide a Linux virtual machine (customized Trixbox version) with all the Linux-based tools pre-installed, that runs within VMware Player or VMware Workstation, to complete the Linux exercises. We will also give you a CD with tools and traffic capture files to experiment during the class and take home for later analysis. If you have any questions regarding these requirements, please contact laptop_prep@sans.org. If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org. |
| Who Should Attend |
|
| Prerequisites |
Students should have a working knowledge of TCP/IP networks and protocols, general security attacks and defenses, and VoIP concepts and experience in the design or deployment of network and security technologies. |
