The GoldAgent PBX Security Framework

What of the phone system is reachable from the internet.

Risk if weak: Management consoles, SIP and provisioning services left open to the public internet are scanned continuously and are the starting point of most remote compromises.

What we assess: We map the outside-in view of your estate: the SIP, signalling and management services reachable from outside your network, and confirm what should not be there.

Limitations: Reflects services reachable from the agreed external vantage points at the time of testing. Services behind additional access controls, or brought online afterwards, are out of view unless separately scoped.

Who can register endpoints, place calls and administer the platform.

Risk if weak: Default or weak credentials, shared accounts and missing multi-factor authentication let an attacker register a rogue endpoint or take over administration.

What we assess: We check credential strength, default-account handling, SIP registration authentication and whether administrative access requires strong, individual authentication.

Limitations: Assesses authentication controls observable and testable under authorisation, within agreed limits. It does not perform unrestricted credential cracking and cannot judge staff password hygiene not represented in the system.

The SIP messages that set up, control and tear down calls.

Risk if weak: SIP sent in the clear exposes call metadata and credentials and can be tampered with in transit. Obsolete TLS configurations are a common finding in older deployments.

What we assess: We verify that signalling is carried over TLS where required, using current protocol versions and validated certificates rather than deprecated settings.

Limitations: Verifies signalling protection for the paths in scope. Carrier-side or third-party segments outside your control are noted where visible but not independently tested.

The audio of the call itself.

Risk if weak: Plain RTP can be captured and replayed by anyone on the media path. A frequent gap is signalling protected with TLS while the media still falls back to unencrypted RTP.

What we assess: We confirm whether media is encrypted with SRTP for the calls that matter, and that key exchange is tied to secure signalling rather than left open.

Limitations: Confirms media protection for representative call paths. A point-in-time assessment cannot guarantee that every possible call route was exercised.

What the system is permitted to dial, and at whose cost.

Risk if weak: A permissive dial plan combined with a compromised extension is the classic toll-fraud path: expensive calls the business is usually liable for, placed without anyone noticing.

What we assess: We review outbound-calling permissions, premium and international routing, and the least-privilege controls that limit fraudulent call spend.

Limitations: Reviews configured calling permissions and routing and demonstrates fraud paths safely. It does not place live fraudulent calls, and any exposure figure is an illustrative scenario, not a forecast or observed loss.

The management and provisioning surfaces that control everything else.

Risk if weak: Exposed or weakly protected web consoles and provisioning services are the highest-value target: control of administration is control of the whole estate.

What we assess: We assess the management interfaces and provisioning services for exposure, authentication, and common web-application weaknesses.

Limitations: Covers the management surfaces disclosed in scope. Bespoke integrations or admin tooling not surfaced during scoping are not assessed.

How voice is isolated from the rest of the network.

Risk if weak: Flat networks let a foothold anywhere reach the voice estate, and weak segmentation exposes signalling and media that should never be broadly reachable.

What we assess: We look at how voice is separated from data, how remote access to voice services is controlled, and where segmentation is assumed but not enforced.

Limitations: Evaluates segmentation evidence available from the tested vantage points. It is not a full internal network audit unless separately scoped.

Handsets, softphones and the provisioning that configures them.

Risk if weak: Default passwords, ageing firmware and provisioning over unencrypted channels turn endpoints into an easy way in, and a provisioning file can leak the credentials it carries.

What we assess: We review endpoint hardening, firmware currency, and whether provisioning is protected as the credential store it effectively is.

Limitations: Assesses a representative sample of endpoint and provisioning configuration. It does not physically inspect every handset in the estate.

Your ability to notice abuse before it becomes a bill or a breach.

Risk if weak: Without call-detail review and alerting, toll fraud and misuse run until the invoice arrives. Most telephony compromise is visible in the records, if anyone is looking.

What we assess: We assess whether call-detail records, logging and alerting are in place and capable of surfacing fraudulent or anomalous calling.

Limitations: Assesses whether logging and alerting capability exists and is capable. It does not operate as, or replace, a staffed monitoring function.

Keeping the phones working when something goes wrong.

Risk if weak: An exposed, unpatched PBX is a single point of failure for every inbound and outbound call, and voice services can be knocked offline by volumetric attacks.

What we assess: We consider single points of failure, exposure to disruption, and the resilience of the paths your calls depend on.

Limitations: Considers exposure to disruption and single points of failure from a security standpoint. It is not a full availability or disaster-recovery audit.

The versions and settings the platform actually runs.

Risk if weak: Configuration drifts and firmware ages while nobody watches the telephony layer, leaving known-vulnerable versions and permissive defaults in place for years.

What we assess: We assess platform versioning against known telephony weaknesses and review the configuration against a hardened baseline rather than the vendor default.

Limitations: Assesses versioning and configuration observable during testing. Vendor-undisclosed internals and closed-source components are out of scope.

That the controls above stay true as the estate changes.

Risk if weak: A point-in-time assessment is true on the day it is run. Without recurring review, evidence decays as extensions accumulate, suppliers change and configuration drifts.

What we assess: We work under written authorisation and an agreed scope, deliver evidence rather than assumptions, and through Assure we re-run the authorised checks on a schedule so your evidence stays current.

Limitations: Covers the assurance process GoldAgent operates for the telephony estate. It does not assess wider organisational governance beyond that estate.