Best Practice Detail

13-8-8535

Network Operators and Service Providers should disconnect the server if a Voice over IP (VoIP) server has been compromised; the machine can be rebooted and reinitialized. Redundant servers can take over the network load and additional servers can be brought on-line if necessary. In the case of VoIP device masquerading, if the attack is causing limited harm, logging can be turned on and used for tracking down the offending device. Law enforcement can then be involved as appropriate. If VoIP device masquerading is causing significant harm, the portion of the network where the attack is originating can be isolated. Logging can then be used for tracking the offending device.

Status: Rollover New

References/Comments: PacketCable Security specification. Cross reference with 7-7-8535 developed under NRIC.

Historical events:

• Network Operators
• Service Providers
• Cable
• Internet/Data
• Wireline
• Cyber Security
• Network Operations
• Intrusion Detection
• CSRIC VII: Rollover New In CSRIC VII