Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

NetworkWorld’s website has just put up an eight-page interview with Jeff Schiller, MIT’s network manager and security architect. The interview is unusually candid, even for Jeff, and he talks about MIT’s plans for deploying voice over Internet protocol (VoIP), the university’s optical network and 10 gigabit-per-second connection to Internet 2, and how MIT has managed to avoid being front-page news with one of those data breaches.

Probably the most telling part of the interview is when Jeff explains his approach to VoIP security. MIT is being forced to adopt VoIP because its hugely expensive 5ESS is going to be discontinued pretty soon. Rather than buying yet another ISDN switch, MIT is slowly rolling out Polycom VoIP phones, high-end Cisco VoIP switches for interconnect, and Open source Asterisk internally for things like voice mail.

The problem here, unfortunately, is that the VoIP vendors have done a lousy job with security. The phones are all configured by accessing their built-in Web servers; every phone has the same password; and none of them support encryption.

I know that Jeff generally doesn’t like firewalls because they encourage lax internal security and because they can be circumvented.

But this time he really doesn’t have a choice because the vendors have failed to implement anything reasonable. So rather than trying to rationally manage this nightmare or convince the vendors to get their act together, Jeff is basically calling “uncle” and putting the whole mess on its own virtual LAN (a VLAN), so that the bad guys won’t be able to reach it.

My favorite quote from the article:

“VoIP security in general has been a real disaster. Like everyone who does technology, the VoIP vendors don’t want to think of security when they’re designing, and they aren’t convinced the bad guys are really out there just because they’re not attacking yet (and of course they won’t attack until you have 100 million handsets out there to make it worth their while). The other problem with VoIP is that there have been a lot of Bellheads involved and they have a security model that’s completely whacked–the “trust the network” model. In the Internet space you don’t trust anybody, particularly the network. You better do end-to-end security if you care.”

But don’t take my word for it: read the whole thing.

0 comments about this story. Start the discussion »

Tagged: MIT, VOIP

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me
×

A Place of Inspiration

Understand the technologies that are changing business and driving the new global economy.

September 23-25, 2014
Register »