How to Secure a VoIP Phone System: A Checklist for Small Businesses

VoIP & Cybersecurity · Checklist · 8-minute read

When a business moves off copper lines, the phone system stops being a box in a closet and becomes an internet-connected application with its own admin portal, its own user credentials, and its own way of costing you money when somebody else gets into it.

Most VoIP security conversations never happen, because phones feel like infrastructure rather than software. Then a business gets a five-figure bill for calls placed to premium international numbers over a holiday weekend, and the conversation happens all at once.

This is the baseline we apply when we deploy a phone system, and the list worth running against whatever you have now, whoever installed it.

Toll fraud: the attack that actually costs money

Most people imagine VoIP attacks as eavesdropping. In practice the common attack is far more boring and far more expensive: somebody gets a working extension or SIP credential and uses your account to place calls, usually to international premium-rate numbers that pay them a cut of the charges.

It happens on nights, weekends and holidays, because the window before anyone notices is longer. The charges are real, the carrier generally expects to be paid, and the amount depends entirely on how long it ran before someone caught it. Four controls matter here, and they are all configuration rather than purchase.

Who can log in, and how

Nearly every VoIP compromise starts with a credential rather than a clever exploit. The admin portal of a cloud phone system can add extensions, change where calls route, read voicemail and turn on forwarding to an outside number. Treat it the way you treat your Microsoft 365 tenant.

• Multi-factor authentication on the admin portal, without exception. This is the single highest-value item on the list.
• Two or three administrators, not ten. Everyone else gets a user-level login that manages their own extension and nothing more.
• Single sign-on where the platform supports it, so phone access follows the same identity, the same password policy and the same offboarding switch as everything else.
• Default passwords changed on the handsets themselves. Desk phones ship with published web-interface defaults, and a phone on a flat network with its default password is a foothold.
• Softphone devices covered by endpoint protection. A business call on a personal laptop with no patching and no antivirus is a business call on an unknown machine.

Offboarding deserves its own line. When someone leaves, their extension, voicemail box, softphone session and portal login all need to go at the same time as their email. When the phone system is managed separately from IT, this is the step that gets missed, and it is how a former employee’s extension stays live for a year.

The network under the calls

Voice quality and voice security come from the same configuration work. Put voice on its own VLAN, scope the firewall to your provider’s address ranges rather than opening SIP and RTP to the world, turn off remote management on the firewall and the handsets, and enable TLS for signaling and SRTP for audio where your provider supports them — many platforms offer both and ship with neither on. Keep handset firmware on the same patching schedule as the rest of your estate.

The quality side of that same work — jitter, packet loss, QoS, what saturates your upload, and why calls break up when someone sends a large print job — is covered in detail in why VoIP calls break up and how to find the cause.

Recordings, voicemail and who can hear them

Call recording gets switched on for training or quality and then nobody revisits it. Meanwhile the recordings accumulate, and depending on your business they may contain card numbers, medical details, legal matters or personal information a customer read aloud over the phone.

Four questions settle it. Who can play back a recording, and is that a short list? How long are recordings kept, and does anything delete them on schedule? Are they encrypted where they are stored? And does your industry require notice to the caller that the line is recorded? New York permits recording with one party’s consent, but several states your customers may be calling from require all parties to consent, and sector rules can be stricter than either.

Voicemail-to-email deserves a look too. It is convenient, and it also means the voicemail now lives in a mailbox with the same exposure as every other message in that mailbox. That’s fine, as long as the mailbox is protected accordingly. This is a question for counsel rather than for us, but it is one worth asking before the recordings pile up rather than after.

What happens when the internet goes down

Availability is part of security, and with VoIP your phones depend on a circuit that will eventually fail. The question is whether anything happens automatically when it does.

Configure failover routing in advance so an outage sends calls to mobile numbers, another location or an answering service without anyone logging in to arrange it. Decide whether the business justifies a secondary internet circuit or LTE failover at the firewall. Keep a copy of your call-flow configuration — auto attendant trees, ring groups, schedules, holiday rules — somewhere outside the platform, so a rebuild is a restore rather than an afternoon of remembering. And give phones and network gear battery backup, since a desk phone with no power is a desk phone whether or not the internet is up.

One item that’s easy to get wrong and serious when it is: E911 address registration. Emergency services route on the address registered to the device, not the number dialed from. If phones moved desks, moved floors or moved buildings and nobody updated the records, a 911 call can dispatch to the wrong place. In multi-suite and multi-floor buildings, the registered location should identify the suite or floor, not just the street address. Check it when you move a phone, and check it annually either way.

The short checklist

Run this against your current system. Anything you can’t answer is worth a call to whoever manages your phones.

Most of this is configuration rather than new spending, which is the good news. The catch is that it sits across the phone platform, the firewall, the switches and your identity provider, so it only gets done properly when one team owns all four. That’s the argument for running phones and IT together rather than as separate vendors who each assume the other handled it.

RDI deploys and supports VoIP phone systems for businesses across NYC and Long Island, and we configure this baseline as part of the install rather than selling it back later. If you already have a system and want to know where it stands, request a free assessment and we’ll review the phone platform, the network it runs on, and the security settings on both. Our Managed Cybersecurity service covers the identity, endpoint and email side that VoIP compromise usually starts with.

Frequently asked questions

Is VoIP less secure than a traditional phone line?

It is differently secure. A VoIP system can encrypt call traffic, enforce multi-factor authentication and log every administrative change, none of which a copper line offers. What it adds is internet exposure and an admin portal, so a configured VoIP system is more secure than a traditional line and an unconfigured one is less. The configuration is the whole difference.

What’s VoIP toll fraud, and who pays for it?

Toll fraud is when someone obtains a working extension or SIP credential and uses your account to place calls, typically to international premium-rate numbers that pay them a share of the charges. The calls are real calls, so the charges are real charges, and most carrier agreements leave the account holder responsible. Check your own contract. The practical defenses are international dialing restrictions, a spend cap, and alerting on unusual patterns.

Do I need a separate VLAN for my phones?

For most offices with managed switches, yes. A voice VLAN keeps handsets off the same segment as workstations, which limits what a compromised computer can reach, and it makes prioritizing voice traffic much simpler. Very small offices on unmanaged hardware can run acceptably without one, but the separation is worth having as soon as the equipment supports it.

Why do calls break up when someone prints or backs up?

Because voice traffic is competing with bulk traffic and nothing is giving it priority. That’s a quality-of-service configuration problem on the network, not a fault in the phone system. Prioritizing voice on the switches and firewall, and separating it onto its own VLAN, is the usual fix — our guide to VoIP call quality walks through how to confirm it.

What happens to our phones if the internet goes out?

Whatever you configured in advance. With failover routing set up, inbound calls redirect automatically to mobile numbers, another location or an answering service. Without it, callers reach a system that can’t answer. Options worth considering are a secondary internet circuit, LTE failover at the firewall, and battery backup for the phones and network gear.

Does 911 work correctly on a VoIP phone?

It works when the registered address is right. Emergency services route on the location registered to the device rather than the number dialed from, so a phone that moved desks, floors or buildings without a record update can send responders to the wrong place. In multi-suite or multi-floor buildings the registration should identify the suite or floor. Verify it whenever a phone moves, and review it annually.