Emerging threats 2006: VoIP
During November and December 2005, Continuity Central conducted a survey into the business continuity implications of VoIP implementation. The results painted a mixed picture. The majority of organisations that responded to the survey are intending to implement VoIP technologies - only 9 percent of respondents said that their organisation has no plans to implement it in the future. Of the rest, 40 percent have not implemented VoIP but expect to in the next 24 months; 33 percent have partially implemented it and 18 percent have fully implemented it. When any new technology is implemented it is important that the potential threats presented by the technology are considered as well as the benefits and opportunities. In most of the organisations that responded to the survey, this seems to be a work in progress. Only 28 percent of the survey respondents have completed an assessment of the risks that VoIP may pose to their organisation. 48 percent are in the process of doing this, and 24 percent have not started, or do not intend to assess the risks. Is VoIP implementation an emerging threat to business continuity? The picture is unclear. The survey found that 24 percent of respondents see VoIP offering a reduction in risks and 41 percent see an increase in risks due to VoIP implementation. The full breakdown is as follows: * Risks will be greatly reduced: 8 percent Respondents were asked to comment on their view of the change in risk that VoIP would bring to their organisation. Many refrained from commenting but some useful responses were received, such as: * “VoIP presents both a mitigation and a risk in business continuity terms. A significant component of our business continuity strategy is to enable as many people as possible to work anywhere. Whenever an incident occurs most of our people switch to homeworking, the rest to an alternate office. VoIP means their phone and number travel with them. The risk is that if the incident also led to a major network outage our phones are massively impacted. This is mitigated in two ways, one obviously is to build resilience into our internal network. In addition all key personnel have a mobile phone and our contact lists include VoIP, mobile and home contact details.” * “Moving to VOIP increases our dependency on the IT network which may make disaster recovery more difficult, for example following a major virus attack.” * “There will me more outages in a VoIP system than in the "old" voice network.” * “VoIP brings IT risks to the telecoms arena. Consider a denial of service attack. If this happens for data only; Bad news. Consider for data and voice; Very, very bad news.” * “Although the risks to our business may be slightly higher, we feel the long-term benefits far outweigh the risk of doing nothing. VoIP is coming out of emergence and into mainstream and must be embraced. Otherwise, we could get run over by it. The new possibilities brought forth with VoIP will be well worth the added risk.” * “We were forced into a conversion of some type because of the lack of support for the legacy ACD system used by our Helpdesk (servicing external customers). Our risks have been reduced slightly, however, mainly because we did not have the funding to implement a VoIP system with adequate redundancy. We will attempt to add additional redundancy in the next fiscal year, thus reducing our risks even further.” * “We have a single call center with a switch that can not be co-located. VoIP will allow us to deploy staff to multiple locations if the primary site goes down.” * “We use VoIP over our network for internal communications; if our network was vulnerable, the result would be severe…” * “I think the key dependency is whether or not there are backup facilities for telephony. Without backup, risks are increased. With backup, the risks are mitigated.” * “In my opinion VoIP is a good way to reduce cost and at the same time make business processes more efficient. The risk, at least in Germany, will stay at the same or rise slightly (dependence on only one technology). Concurrently, a simplification of the infrastructure also offers a possibility to implement effective defenses.” In summary, VoIP is an emerging threat in that it makes voice communications vulnerable to a new range of outages linked to the IP infrastructure on which it relies. VoIP potentially creates a single point of failure where information processing AND telecoms will be lost should the data network fail for any reason. It is likely that companies moving towards VoIP for commercial reasons will need to retain at least a stripped down version of their traditional telecoms infrastructure for business continuity reasons. This and other additional resiliency requirements may change the cost-benefit equation, so it is important that business continuity managers highlight the extra expenditure that may be required on backup and redundancy systems at an early stage. If the necessary resiliency issues are considered and solutions implemented, then VoIP can bring business continuity benefits - allowing call routing via multiple IP paths from location-to-location, for example. RELATED ARTICLES VoIP - Vulnerability over Internet Protocol? VoIP – is it really suitable for mission critical telecoms? Security considerations for Voice over IP systems PREVIOUS ARTICLES IN THE EMERGING THREATS SERIES Emerging threats 2006: drought
•Date: 3rd Feb 2006 • Region: World • Type: Article •Topic: Telecoms continuity |
