The Forgotten Attack Surface: Why UC Is a Major Cybersecurity Concern

Let’s talk about Unified Communications and Cybersecurity.

We often think of threat surfaces as laptops, email inboxes, web servers, vulnerable endpoints, and people. And that’s very true—they’re major entry points for attackers.

But there’s one category that continues to fly under the radar in many organizations: your communications infrastructure.

---

“We Connect to the Satellites Over Telnet”

A few years back, I was talking with a government employee who was interested in some of the UC security work I’d been doing. He served as an Information Systems Security Manager in the defense space.

We were deep in a conversation about SIP security, encryption, and SBCs when he casually mentioned:

“We still connect to our satellites over Telnet.”

I asked him to clarify, assuming he meant something else. Nope—he meant literal unencrypted Telnet. Yes, there were layers of physical and network security in between, but it was a stark reminder of how critical systems can still rely on insecure, legacy protocols simply because they haven’t been modernized.

---

Healthcare Systems Are No Exception

When COVID-19 hit, I was responsible for rapidly deploying Cisco Expressway infrastructure in a healthcare system that had never supported remote telephony before so that employees could safely work from home.

I moved fast, and made sure we put strict security controls in place. What surprised me most was what happened immediately after going live:

Hundreds, then thousands, of automated toll-fraud attempts per day.

We blocked every single one of them. Not a single attack got through.

But the attempts kept coming relentlessly, day after day. Real-world attackers continuously scan the internet looking for exposed SIP interfaces vulnerable to toll fraud and credential stuffing—on infrastructure many organizations still dismiss as “just phones.”

---

Common UC Security Weaknesses

If you work in Unified Communications long enough, you see the same vulnerabilities repeatedly:

• Legacy ATA devices using unencrypted protocols
• Telnet, FTP, or unencrypted HTTP still enabled on voice endpoints
• No TLS for SIP signaling (sending SIP messages in cleartext)
• No SRTP for voice/media streams (allowing RTP packet capture and audio reconstruction)
• Session Border Controllers (SBCs) without strict trusted-network ACLs or explicit inbound/outbound PSTN rules
• Default admin credentials still active on legacy voice appliances
• Direct SIP trunks with no rate limiting or destination restrictions
• No automated toll-fraud monitoring or anomaly alerting

Too often, these systems were configured once years ago and left untouched because they “just work.” Working does not mean secure.

---

Why UC Gets Left Behind

1. Legacy Systems Are Scary to Touch: Nobody wants to be the person who disrupts a working phone system by updating firmware or disabling a deprecated protocol.
2. UC Lives in an Organizational Grey Area: Is it networking? Security? Infrastructure? Many organizations lack a clear owner for UC security, allowing it to slip through the cracks.
3. Perceived Protocol Complexity: Voice protocols like SIP, SDP, and RTP are specialized. Most InfoSec teams focus heavily on HTTP, SMTP, and endpoint EDR—not SIP INVITE headers or media negotiation.

---

Practical UC Security Hardening Checklist

Whether you run Cisco, Zoom Phone, Microsoft Teams, or a hybrid environment, use this checklist to tighten your voice and video security posture:

1. Encrypt Everything

• Enforce SIPS (SIP over TLS) for signaling
• Enforce SRTP (Secure RTP) for audio and video media streams
• Require modern TLS versions (TLS 1.2 / 1.3) and strong cipher suites

2. Harden Your SBCs and Firewalls

• Lock down IP access strictly to known, trusted carrier and cloud peers
• Disable unused services, listeners, and ports
• Keep SBC and gateway firmware up to date
• Enable geo-blocking for regions your organization does not serve
• Configure dial plan call-rate limits and maximum concurrent session thresholds
• Add explicit permit/deny SIP header and URI rules on your SBC to drop malformed or unauthorized traffic at the edge

3. Lock Down Management Interfaces

• Disable Telnet, HTTP, and SNMPv1/v2c
• Enforce HTTPS and SSH with strong authentication and MFA where supported
• Implement Role-Based Access Control (RBAC)
• Audit administrative access regularly and remove unused default accounts

4. Detect and Block Toll Fraud

• Restrict international and premium-rate dialing to explicitly authorized user classes
• Set automated thresholds and alerts for unusual call volume or off-hours spikes

5. Integrate UC into Your Security Stack

• Forward SBC, call manager, and UCaaS audit logs into your SIEM or XDR
• Actively monitor for registration failures, unauthorized call attempts, and endpoints registering from unexpected geographies
• Include SIP and UC edge interfaces in periodic penetration testing and incident response playbooks

Bottom Line: From paging systems and remote softphones to SBC trunks and analog gateways sitting in wiring closets—if it connects to your network, it is part of your attack surface. Secure it like it matters.