<br><font size=2 face="sans-serif">Nhut,</font>
<br>
<br><font size=2 face="sans-serif">Good comments. I don't actually consider
that much of a scope creep because we've said that each best practice should
note which security test tools could be used to test the individual best
practices. So each BP entry should say which tool(s) could be used
to test if your system is vulnerable. Or another view is... implementing
the BP protects you against attacks/probes from which tools.</font>
<br>
<br><font size=2 face="sans-serif">Separately from the BP document, Shawn
Merdinger and Dustin Trammel have developed a security tools list that
we're planning to promote in conjunction to this BP document. As
this project moves along, we'll bring that tools list into this discussion
as well.</font>
<br>
<br><font size=2 face="sans-serif">So yes, we should include it, but the
current thinking is as a separate list of tools. Hmmm... however,
it could be argued that we're not talking about best practices in how to
do that testing... perhaps there is a need for something that is specific
about issues for vulnerability testing *for VoIP*.</font>
<br>
<br><font size=2 face="sans-serif">Thoughts?</font>
<br><font size=2 face="sans-serif">Dan</font>
<br>
<br><font size=2 face="sans-serif">P.S. Nhut, I *did* have a nice weekend...
too cold and windy to go cross-country skiing, but at least we do have
snow cover! (Important in these parts (Vermont, USA) at this time
of year.)</font>
<br>
<br><font size=2 face="sans-serif">-- <br>
Dan York, CISSP<br>
Dir of IP Technology, Office of the CTO<br>
Mitel Corp. http://www.mitel.com<br>
dan_york@mitel.com +1-613-592-2122<br>
PGP key (F7E3C3B4) available for <br>
secure communication<br>
<br>
</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>"Nhut Nguyen" <nnguyen@sta.samsung.com></b></font>
<p><font size=1 face="sans-serif">01/22/2007 10:28 AM</font>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To:
<dan_york@Mitel.com>, <bestpractices@voipsa.org></font>
<br><font size=1 face="sans-serif"> cc:
</font>
<br><font size=1 face="sans-serif"> Subject:
RE: [VOIPSA Best Practices] Best Practices
document structure set - next question: are these the appropriate areas?</font></table>
<br>
<br>
<br><font size=2 color=#000080 face="Arial">Dan et. al.,</font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">Hope that everyone had a good
weekend! </font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">With the risks of “scope creeping”
</font><font size=2 color=#000080 face="Wingdings">J</font><font size=2 color=#000080 face="Arial">,
I would like to bring to the team attention something that occurred to
me over the weekend: vulnerability testing! If appears to me that best
practices and to VoIP security vulnerabilities testing may be something
that VoIP practitioners, especially people who run VoIP networks and services,
will need and welcome.</font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">For this we can either:</font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 face="sans-serif">1. </font><font size=2 color=#000080 face="Arial">Embed
a vulnerabilities testing sub-section in each of the sections outlined
by Dan, or</font>
<br><font size=2 face="sans-serif">2. </font><font size=2 color=#000080 face="Arial">Have
a separate section on VoIP vulnerabilities testing best practices (and
tools) at the end of the document </font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">I think both approaches have
merits and demerits, and am curious about what others think!</font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">My apology if this issue has
been discussed in the past, but thought that it may merit some mentioning
in the BP document.</font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">Cheers,</font>
<br><font size=2 color=#000080 face="Arial"> </font>
<br><font size=2 color=#000080 face="Arial">Nhut</font>
<div align=center>
<br>
<hr></div>
<br><font size=2 face="Tahoma"><b>From:</b> bestpractices-bounces@voipsa.org
[mailto:bestpractices-bounces@voipsa.org] <b>On Behalf Of </b>dan_york@Mitel.com<b><br>
Sent:</b> Friday, January 19, 2007 4:58 AM<b><br>
To:</b> bestpractices@voipsa.org<b><br>
Subject:</b> [VOIPSA Best Practices] Best Practices document structure
set - next question: are these the appropriate areas?</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=2 face="sans-serif"><br>
Best Practices team,</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="sans-serif"><br>
Thank you to those of you who sent in comments either on the list or directly
to me. A special thanks to Eugene Nechamkin who took the time to
write up a counter-proposal. Outside of his contribution, basically all
the feedback was for proposal #2, structuring the document around functional
areas, and so I'm going to say we're going with that.</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="sans-serif"><br>
Now, the next question - is this list below from the wiki the appropriate
list of areas for VoIP-related best practices?</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="sans-serif"><br>
1. </font><font size=3 face="Times New Roman">Securing
Voice and Media stream </font><font size=2 face="sans-serif"><br>
2. </font><font size=3 face="Times New Roman">Securing
Call Control </font><font size=2 face="sans-serif"><br>
3. </font><font size=3 face="Times New Roman">Securing
Management Interfaces and APIs </font><font size=2 face="sans-serif"><br>
4. </font><font size=3 face="Times New Roman">Securing
PSTN Interfaces and Traditional Telephony Issues (i.e. don't forget toll
fraud) </font><font size=2 face="sans-serif"><br>
5. </font><font size=3 face="Times New Roman">Securing
Servers and Operating Systems </font><font size=2 face="sans-serif"><br>
6. </font><font size=3 face="Times New Roman">Securing
IP Endpoints (ex. sets, softphones, etc.) </font><font size=2 face="sans-serif"><br>
7. </font><font size=3 face="Times New Roman">Securing
the TCP/IP network (ex. VLANs, 802.1X, wireless, etc.) </font><font size=2 face="sans-serif"><br>
8. </font><font size=3 face="Times New Roman">Physical
Security, including backups, power, etc. <br>
</font><font size=2 face="sans-serif"><br>
Are we missing any major areas? Should these be modified or tweaked?</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="sans-serif"><br>
It seems to me to be a complete list, but then again, I wrote it, so of
course it would. Any feedback is welcome.</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="sans-serif"><br>
Regards,<br>
Dan</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="sans-serif"><br>
-- <br>
Dan York, CISSP<br>
Dir of IP Technology, Office of the CTO<br>
Mitel Corp. http://www.mitel.com<br>
dan_york@mitel.com +1-613-592-2122<br>
PGP key (F7E3C3B4) available for <br>
secure communication</font>
<br>