Security for Asterisk

Compare SECast to alternatives

SECAST

»

COMPARISON

Overview
Benefits
Features
Technology
Testimonials
Screenshots
Videos
Editions
FAQ
Comparison
Download
Pricing / Buy
Forums
License

comparison

 
SecAst
Fail2Ban
Firewall

SIP Connection Monitoring

Credentials valid
Breached credentials
Diffused probes
SIP packet structure

User Behaviour Monitoring

Fraud phone number database verification
Dialing cadence
Simultaneous calls
Heuristic patterns

Network Connection Monitoring

Hacker database IP address verification
SIP data transfer rate
Clustered connection attempts
Geographic location
Port connection rate

Attack Containment

Ban IP on PBX or firewall
Override dialplan permitted patterns
Disconnect individual calls
Lockdown new connections

Attack Response Orchestration

Control internal firewall
Control external firewall
Control external router
Change dialplan
Share attack data with peers
Yes/Excellent
Partial/Fair
No/Poor

Comparison Details

The following boxes provide further evaluation details, and by clicking the down arrow at the bottom of each box you can see how SECast compares.

SIP Connection Monitoring

SIP Connection Monitoring describes if and how the security system monitors SIP traffic flowing through the PBX, and detects actions or information which may increase the risk of fraud or hacking.  Packet inspection allows the security system to examine the commands being issued, and any credentials being sent.  These credentials can be compared to what is permitted by the Asterisk server, and commands can be evaluated to determine if they are safe and appropriate for the type of connection.  As well, the rate at which these commands are issued may be indicative of hacking.

SIP data is divided into packets, and each packet has a well defined structure.  Deep packet inspection allows the security system to determine if the SIP packet is malformed, and if so, in such a way that can exploit a weakness in the underlying SIP stack.

Regular firewalls are oblivious to the content of VoIP related traffic, and simply forward SIP/RTP/IAX/etc. from the internet to the Asterisk server.  A complete lack of understanding of the packet content results in traditional firewalls being little more than routers.  Fail2ban is actually not a security system, rather it depends completely on Asterisk to report a failed login attempt (and fail2ban then adds the source IP to a local iptables ban list).

SECast is the only product that builds a profile of every user or connected device, and ensures the SIP commands received are safe and appropriate.  Even normal SIP commands issued at unusual frequencies can be indicative of hacking.  SECast is the only product able to detect such patterns, detect valid SIP credentials being misused, etc.

User Behavior Monitoring

User Behavior Monitoring describes how the security system monitors the actions of the user (above the VoIP protocol level).  Hackers will seek out PBX exploits by dialing numbers which are neither local extensions nor valid menu options.  They may also dial phone numbers at a rate not possible by a human being.

Once attackers find a weakness in the PBX, they typically exploit it rapidly to maximize their financial return before the weakness is detected or closed.  A sudden increase in the number of calls from one extension or to a particular number, may indicate hacking.  As well, the sequence of activities a user performs may be atypical for normal PBX usage and may indicate hacking.

Traditional firewalls do not monitor behavior at the user level, and simply pass VoIP related packets back and forth.  Fail2Ban also has no visibility into the behavior of the user (only errors reported by Asterisk can be acted on by Fail2Ban).

SecAst is the only product that monitors the behavior of each user (and in fact each device) and creates a risk score based on the behavior of the user combined with other factors.  While one action on its own may not be enough to identify a hacking attempt, the combination of actions detected by SecAst allow it to detect and halt hacking before the attacker can do much harm (or generate massive fraud charges on your carrier account).

Network Connection Monitoring

Network Connection Monitoring refers to the tracking of VoIP traffic at the network level.  Since all VoIP traffic moves over UDP/IP, detection of unusual UDP/IP related packets may help identify suspicious behaviors.  The UDP and IP protocols also provide considerable information regarding the source of the connection/attack, and its nature.

Fail2Ban has no visibility at the network connection level; it can only respond to error messages from Asterisk.  Traditional firewalls, on the other hand, excel in this area as monitoring UDP and IP level traffic is what they were designed to do.  The only weakness of traditional firewalls is that they are not aware of patterns and sources of VoIP specific hacking.

SecAst combines both high level (user and SIP) with low level (UDP/IP) traffic information to provide unmatched sensitivity to hacking attempts at the network level.  SecAst also uses databases of known hacker IP addresses to block connection attempts before the attacker even has a chance to communicate with the PBX.

Attack Containment

Attack Containment refers to how well the security system can stop attacks in progress, and also prevent future attacks.  If an attacker has found a weakness in the PBX, can the damage be contained or does the attacker have unlimited potential for harm and fraud?