VoIP security: protecting your SIP platform, your bill and your callers' data

VoIP security covers everything that keeps an IP telephony platform from being abused: attackers guessing SIP passwords, fraudsters running up international call charges, eavesdropping on unencrypted calls, and leaks of recordings or transcripts. Any SIP service reachable from the internet is scanned constantly by automated tools, so these are not theoretical risks. Voxivra hardens Asterisk and SIP platforms with layered controls, and treats security as part of the architecture rather than a checklist added at the end.

Know the threats

• Scanning and brute force: tools probe SIP ports, enumerate extensions and try passwords at high rates.
• Toll fraud: once inside, attackers place calls to premium-rate or high-cost international destinations (often called IRSF, international revenue share fraud). Losses can accumulate quickly over a weekend.
• Dialplan abuse: a misconfigured context lets an inbound or unauthenticated call reach outbound trunks.
• Exposed management interfaces: AMI, ARI, web GUIs or FastAGI ports reachable from the internet.
• Eavesdropping and tampering: unencrypted SIP and RTP on untrusted networks.
• Caller ID spoofing and robocalls, which affect your callers’ trust in your numbers.
• Denial of service: SIP floods that saturate the platform.

Network and access control

The first layer is to make sure only expected parties can talk to your SIP services.

• Firewall allow-lists: SIP and RTP ports open only to your carriers’ signaling and media ranges, your SBC and known remote sites. Remote workers connect through a VPN or a dedicated SBC rather than directly.
• Carrier identification by IP: with PJSIP, trunks are matched by source address with an identify section, instead of relying on a registration password alone.
• Endpoint ACLs: permit/deny rules on endpoints, or named ACLs, so a stolen password cannot be used from anywhere.
• No anonymous access: no catch-all endpoint for unauthenticated calls, and every inbound path lands in a restricted context.
• Management plane isolation: AMI, ARI and FastAGI listen on private interfaces only, with TLS for ARI where it crosses networks, and strong unique credentials.

A short PJSIP example for a carrier matched by IP:

[carrier]
type=endpoint
context=from-carrier
disallow=all
allow=ulaw,alaw
aors=carrier

[carrier]
type=aor
contact=sip:203.0.113.10:5060

[carrier]
type=identify
endpoint=carrier
match=203.0.113.10

Active protection: fail2ban and rate limiting

Asterisk logs failed authentication attempts and other security events (its security log channel is designed for this). fail2ban reads these logs and blocks offending addresses at the firewall after a set number of failures. In front of Asterisk, a SIP proxy or SBC such as Kamailio can add per-source rate limiting (for example with its pike module) and drop malformed or suspicious traffic before it reaches the PBX. These tools reduce noise and brute-force risk; they do not replace allow-lists.

Toll fraud prevention in the dialplan

Even with good perimeter controls, we assume an account may be compromised one day and limit the damage:

• Separate contexts for internal users, inbound calls and applications, so inbound calls can never reach outbound routes.
• Destination allow-lists: block international and premium-rate prefixes by default, and open only the countries the business actually calls.
• Per-user and per-trunk limits on concurrent calls (for example with GROUP() and GROUP_COUNT()), call duration and calls per hour.
• Time-based rules: tighter limits outside business hours.
• Carrier-side safeguards: spending caps and destination blocks configured with your SIP provider as a second line of defense.
• Real-time alerts on unusual patterns, such as a spike in international calls or calls at 3 a.m.

Encryption: SIP over TLS and SRTP

• SIP over TLS (usually port 5061) protects signaling, including credentials and phone numbers, between phones, SBCs, Asterisk and carriers that support it. We configure modern TLS versions and valid certificates.
• SRTP encrypts the audio. In Asterisk, it is enabled per endpoint with media_encryption=sdes (keys exchanged in SIP, which must therefore run over TLS) or media_encryption=dtls, which WebRTC clients use.
• Know the limits: Asterisk decrypts media to process it (IVR, recording, AI), and calls to the public network are generally unencrypted past the carrier. Encryption protects the segments you control.

In Canada and the US, carriers also apply STIR/SHAKEN caller ID authentication. We make sure your outbound numbers are presented consistently with your carriers’ requirements so legitimate calls are not flagged.

Protecting voice data

Recordings, transcripts and AI logs often contain personal and sometimes financial or health information. We design for:

• Minimization: record or transcribe only what is needed, pause recording during sensitive steps, and collect card numbers by masked DTMF rather than voice. See our secure payment voicebot case study for an example of this approach in a PCI-DSS context.
• Encryption at rest and in transit, access control and audit logs.
• Retention and deletion policies aligned with your obligations.
• Vendor review for third-party STT, TTS and LLM services: where data is processed, whether it is retained or used for training.

Obligations under Law 25 in Quebec, PIPEDA, GDPR or sector rules depend on your context; we recommend confirming them with legal counsel. Our financial services page covers sector-specific considerations.

Patching and monitoring

Asterisk, PJSIP, Kamailio and operating systems receive security fixes regularly. We track security advisories, keep supported versions, test updates in staging and roll them out without downtime when the platform is designed for it, which is one reason security and VoIP high availability go together. Monitoring covers authentication failures, unusual call patterns, certificate expiry and configuration drift.

When Voxivra recommends a security review

We recommend a review before exposing a new platform to the internet, after any suspected incident or unexplained charges, when inheriting a system without documentation, and before adding AI or payment flows that handle sensitive data. A review typically covers firewall and network exposure, PJSIP and dialplan configuration, management interfaces, encryption, fraud controls and data handling, with prioritized fixes. Ask us for a security review of your Asterisk or SIP environment.