Cybercriminals are becoming more sophisticated by the day, finding new and innovative ways to breach enterprises and make off with sensitive data that can be used for fraud or sold on underground marketplaces. There are several areas that hackers target in these efforts, and one of the often-overlooked when it comes to corporate security is the unified communications system.

A treasure trove of data

Consider all the connections, collaborations and essential daily tasks that your employees carry out via the VoIP system, email, messaging, file sharing and other systems included in your UC solution. The UC platform is leveraged by staff members countless times a day to share sensitive data and collaboration on projects involving business intellectual property.

For these reasons, UC can represent low-hanging fruit to hackers who are looking to breach systems that provide access to as much sensitive information and assets as possible.

As Sonus CTO and SVP Kevin Riley told CSO, more enterprises are adopting increasingly advanced communication solutions as part of their UC, creating new, connected applications and systems that are in need of protection. What's more, communication solutions aren't one-way streets.

"UC is now a wide-open window in and out of the enterprise supporting voice, video and file transfer," Riley said. "So, it's not just a matter of protecting what gets onto the network, but what leaves the network as well. When organizations take control of their security posture and protection UC as vigorously as any other application on their network, they'll be on the path to a more secure network."

Your enterprise UC needs added protection to guard against malicious attacks and data theft.

How do hackers attack UC?

There are a few attack strategies that have become popular with cybercriminals in connection with UC technology, and it's imperative that internal teams are aware of these and work to guard against them specifically. These include:

• Eavesdropping: As TechTarget contributor John Burke noted, unauthorized users listening in on sensitive corporate communications is a constant worry. A malicious actor could eavesdrop on a call or conference, or intercept a message or email, resulting in the theft of sensitive data or other information that can be used to spur subsequent attacks.
• Denial of service: Cybercriminals can also inundate the UC system with a flood of requests and traffic that can easily topple the communications system, rendering it inaccessible and useless for employees.
• Toll fraud: This has become a costly issues for IP and telecommunications providers, as an increasing number of toll fraud-based attacks take place. In essence, these instances involve tricking the call manager into supporting one type of communication, but carrying out another that consumes more resources.
• Call ID spoofing: Even in the age of advanced communication, call ID spoofing has been on the rise. Here, attackers leverage the legitimate information associated with the company's calling network to spur scam calls. In this way, recipients are tricked into answering as they believe the call is coming from a licit business.

Safeguarding your UC: Top tips for protection

After awareness of top threats, there are a few more steps organizations can take to better protect their sensitive and essential business communications taking place on UC.

First, as Riley pointed out, it's important for communications and security stakeholders to understand that having a firewall is beneficial, but it's not enough. Today's communications systems are increasingly advanced, and need more robust protection than a firewall can offer.

"Now, don't get me wrong, firewalls are great at certain things like deep packet inspection and threat intelligence," Riley said. "Unfortunately, firewalls don't have the awareness or statefulness to protect complex SIP services such as voice and video calls from the application layer exploits."

Managers should ensure that every authorized user has unique access credentials that include robust passwords. Default admin passwords should always be changed to something stronger, and as a best practice, passwords should be changed on a regular basis. This will help ensure that access controls don't provide an open door for attackers.

It's imperative to have encryption in place to safeguard sensitive communications. In this way, even if hackers are able to access the network, the data and assets being used and shared via the UC system will have an extra layer of protection in place.

Experts also recommend utilizing host- and network-based intrusion detection and monitoring to help pinpoint any suspicious activity before it leads to a breach or attack.   

Before putting any new security protocols or measures in place, though, it's helpful to examine what's already in place to safeguard UC and other critical systems.

"Instead of starting over, security leaders should work to better monetize what is already in their network," Riley recommended. "By taking stock of solutions that already exist across the network, they can set a plan to better utilize those solutions to ultimately drive more value from what they already have through contextual collaboration."

To find out more about the protections that should be in place within your UC environment, connect with the experts at Teo Technologies today.