VAU FAQ
Expand AllCollapse All- What is VAU?
- The VibeSec Assessment Utility (VAU) is a powerful, user-friendly, portable software package that supports automated or semi-automated assessment of security of enterprise VoIP and Unified Communications networks.
- Can a VAU based assessment help to prevent toll fraud?
- Yes. The VAU will identify and point out vulnerabilities in the network and in configuration of the VoIP equipment that can be exploited in order to perform toll fraud and internal toll abuse, and will provide remediation recommendations.
- Will the VAU assess security practices, in addition to network and equipment analysis?
- Yes. The VAU includes an interactive questionnaire for the network administrator and will assess the security practices based on the answers.
- Will the VAU identify cross-network (voice/data) vulnerabilities?
- Yes. The VAU will attempt to determine possibilities of malicious access to the voice network from the data network, and vice versa.
- Will the VAU detect eavesdropping on the VoIP network?
- No, but it will detect and assess the vulnerability of the network to eavesdropping. VibeSec offers another, permanent UC security enforcement solution that will detect and prevent VoIP eavesdropping even on the LAN.
- Can I perform active penetration testing using the VAU?
- Yes. The VAU currently supports Eavesdropping, Extension Hijacking, Extension Redirect and Denial of Service penetration tests against enterprise UC systems. The VAU's arsenal of penetration testing attacks will be expanded in the future.
- Will the VAU test security of a SIP trunk?
- It will, partially. The VAU will assess vulnerability of the enterprise to application-level and toll fraud attacks that can be perpetrated through the SIP trunk. The VAU will not test vulnerability of the SIP trunk to protocol-level attacks. It is recommended to always deploy a session border controller on SIP trunks in order to prevent protocol-level attacks.
- What kind of reports can I get from the VAU?
- The VAU produces a comprehensive actionable report that includes UC security practices analysis and recommendations, vulnerability report and penetration testing report. It also produces a detailed inventory of the Unified Communications network.
- What kind of hardware and OS do I need for the VAU?
- Any standard laptop that runs Windows 7 and is equipped with microphone and speakers will do.
- Can I install the VAU on a computer that runs Vista or XP operating system?
- No. You need to convert the computer to Windows 7 before installing the VAU.
- How do I connect the VAU to the target network for assessment?
- Unplug a VoIP phone from the wall network socket and plug in the VAU laptop.
- How long will an assessment take?
- Between one hour and several hours, depending on the size of the network.
- Will the VAU work with networks based on Cisco IP Telephony equipment?
- Yes. This includes support for Cisco IP-phones and Cisco IP-PBX (CUCM).
- Will the VAU work with SIP phones and Asterisk IP-PBX?
- Yes.
- Will the VAU work in an environment that has a mixture of Cisco phones and SIP phones?
- Yes.
- Is non-SIP equipment from other vendors - Avaya/Nortel, Siemens, Alcatel etc. - supported?
- Support for other vendors will be added in the future.
- Do I need special training in order to perform Unified Communications security assessment with the VAU?
- You need to understand the basic concepts of Unified Communications (UC) and IP Telephony. You do not need extensive training in UC security since the VAU is wizard-based and automates the assessment process.
- Do I have to install the VAU in order to try it? Does VibeSec provide remote demo/training?
- VibeSec provides remote training over the Internet. Training sessions need to be scheduled - please see details here
- How does the VAU assessment licensing work?
- The VAU is licensed per assessment per IP-phone/Unified Communications extension. The initial license covers 5,000 extensions. The license can be topped up over the Internet.