The complete guide to SIP security

SIP in plain terms

The Session Initiation Protocol is the signalling layer of IP telephony. It handles the messages that register a device, invite a party to a call, and end that call, while the audio itself is carried separately by the media protocol. In effect SIP is the control channel, and the voice is the payload it arranges.

Because SIP runs over IP, a phone system speaking SIP is subject to the same realities as any networked service. It can be reached, probed and, if weakly configured, abused. Understanding SIP as a network protocol rather than a black box is the first step to securing it.

Why SIP is where fraud starts

SIP is where an attacker first meets your phone system. Registration is how a device proves it is allowed to make and receive calls, and a trunk is how your system reaches a carrier. Both are points where weak authentication or excessive exposure can be turned into fraudulent calling.

The scale of the wider problem is significant. The Communications Fraud Control Association estimated global telecom fraud losses of around US$38.95bn in 2023, an increase on the prior year. A meaningful portion of that traffic is set up over SIP, which is why the protocol deserves specific attention rather than being folded into a generic network review.

The reassuring part is that most SIP fraud relies on a small set of avoidable weaknesses. Closing those weaknesses removes the easy paths that opportunistic fraud depends on.

Registration and trunk exposure

The most important question for any SIP deployment is who can reach the registration and trunk endpoints. If those endpoints accept connections from anywhere, they can be probed by anyone, and only the strength of authentication stands between exposure and abuse.

• Whether SIP endpoints accept traffic from any source or only from known carriers and sites
• Whether a session border controller or firewall sits in front of the signalling layer
• Whether trunks are restricted to the specific carrier addresses they use
• Whether unused SIP features and demo contexts remain enabled after deployment
• Whether the same exposure exists on backup or secondary systems that are easy to forget

Restricting who can reach these endpoints is often the single highest-value SIP control. It shrinks the population of systems that can even attempt to authenticate against yours.

Authentication and lockout

Where an endpoint must be reachable, authentication strength decides the outcome. SIP registration secrets that are weak, predictable or reused give an attacker a straightforward path, and the absence of lockout lets repeated attempts run unchecked.

• Use unique, high-entropy registration secrets rather than passwords tied to the extension number
• Enable lockout and rate limiting so repeated failures are slowed and flagged
• Avoid reusing a single secret across many extensions
• Remove test and default accounts left over from installation
• Alert on unusual patterns of registration failure

Transport security: TLS and SRTP

SIP and its media can travel unencrypted by default. That exposes call setup and the audio itself to interception by anyone positioned on the network path, and it can leak the credentials and metadata that signalling carries.

• TLS to encrypt and authenticate SIP signalling
• SRTP to protect the audio media stream from eavesdropping
• Current cipher suites and valid, trusted certificates
• Consistent enforcement across every extension and trunk rather than a partial rollout

Transport security is not solely about confidentiality. Authenticated signalling makes it harder to inject or manipulate call-control messages, so TLS and SRTP contribute to integrity as well as privacy. Where card payments are handled by phone, PCI SSC guidance treats the confidentiality of the call as a compliance matter.

Routing and least privilege

SIP authentication controls who connects; routing controls what they can then do. A permissive routing configuration lets a single compromised registration reach expensive destinations, which is how a minor foothold becomes a significant bill.

• Permit international and premium-rate destinations only for the roles that need them
• Apply per-endpoint calling permissions rather than a single broad policy
• Constrain or block calling outside business hours where the pattern allows
• Remove routes, trunks and contexts that are no longer used
• Deny by default and permit by exception across the routing configuration

Least privilege in routing is the control that most reliably limits the financial impact of a SIP compromise. It assumes an account may one day be misused and contains what that misuse can achieve.

Monitoring and review

Even a well-configured SIP estate benefits from attentive review, because configurations drift and new trunks and endpoints are added over time. The aim is to notice the unusual quickly enough to act before a small problem grows.

• Review call detail records for unexpected destinations, volumes and timing
• Watch for surges in international or premium-rate traffic, especially out of hours
• Log registration failures and administrative changes to the SIP configuration
• Protect those logs so they cannot be silently altered
• Agree in advance who responds to an alert and how

How an authorised SIP audit works

An authorised SIP audit examines your signalling estate under a signed scope, so that all testing stays lawful and within agreed bounds. It looks at exposure, authentication, transport security and routing, and reports what it finds with enough context for you to act.

• A defined scope naming the SIP endpoints and trunks in bounds and the testing window
• Assessment of registration and trunk exposure, authentication strength and lockout
• Verification that TLS and SRTP are correctly and consistently enforced
• Review of routing for least privilege and unused paths
• Findings ranked by severity, with remediation and a retest to confirm each fix