Quobis Voice Security Framework: The Cybersecurity Framework for Voice over IP and Real-Time Communications
Why is a specific Voice security framework necessary ?
Voice and corporate communications infrastructures (SIP trunks, contact center platforms, SBCs, PBXs, UCaaS solutions, and WebRTC applications) form part of the critical attack surface of modern organizations. However, most cybersecurity programs are designed with data at rest and traditional IT networks in mind, treating voice as a peripheral service.
This lack of specialization creates serious vulnerabilities due to three factors inherent to the voice channel:
- Critical nature of real-time availability : Unlike other IT environments where availability is managed in minutes or hours, in voice, availability is measured in seconds. A brief outage or momentary degradation is an incident with immediate operational impact.
- Quality of Service (QoS) as a security dimension: Security cannot be separated from quality. Poorly designed defensive controls can introduce latency, jitter, or packet loss. In telephony, a degraded or inaudible call represents a compromised service, making QoS a direct indicator of security posture.
- Regulatory alignment requirement: Regulatory frameworks such as NIS2, DORA, the National Security Scheme (ENS) or the Cyber Resilience Act (CRA) impose strict requirements on the continuity of essential services and the early notification of serious incidents (e.g., reporting in less than 24 hours under NIS2).
- Fraud and identity as core risks : Voice combines identity, numbering, trust, and direct economic cost. Abuse of international routes, CLI manipulation ( caller ID spoofing ), vishing, and IRSF (internal rate fraud) are not peripheral incidents or mere billing issues: they are inherent and structural security scenarios of the voice channel.
General-purpose cybersecurity frameworks are necessary, but they don’t always capture the specific characteristics of real-time communications. In voice communications, even a brief outage can have an immediate impact on business operations, customer service, emergency response, regulated services, or business continuity. The Quobis Voice Security Framework was created precisely to bridge this gap, offering a structured methodology that connects cybersecurity, telecommunications engineering, and real-time user experience .
Cybersecurity
Exposure, identity, fraud, abuse, configuration, vulnerabilities, monitoring, and response.
Telecommunications
Signaling, media, routes, numbering, operators, SBCs, SIP trunks, WebRTC, interoperability and continuity.
Real-time experience
Availability measured in seconds, audio quality, latency, jitter, packet loss, and ability to maintain service under pressure.
This combination helps explain why securing a voice platform is not simply about applying generic IT controls. It requires balancing security, availability, quality, operation, and third-party dependencies without disrupting the call experience .
Risks that help to understand and organize
For those responsible for security, continuity, and communications, voice risks must be clearly understood, prioritized, and linked to their real impact on the business. The framework comprehensively addresses both active attacks and weaknesses in design and infrastructure.
The Quobis Voice Security Framework is not limited to responding to isolated attacks; it addresses voice security from a holistic perspective that encompasses architecture, configuration, supply chain governance, and real-time experience.
The specific attack vectors and vulnerabilities of IP telephony are not treated as isolated incidents, but as risk scenarios that activate specific dimensions and functions within the methodology :
|
Risk/Threat Scenario |
Why it matters in the voice channel |
Dimension and Function of the Activating Framework |
|---|---|---|
|
SIP scanning and enumeration |
It allows an attacker to identify users, extensions, domains, exposed services, and potential entry points into the network. |
Identify / Protect: Exposure mapping, topology hiding, SBC hardening , and perimeter monitoring. |
|
Unauthorized registration |
It facilitates the misuse of corporate extensions, malicious redirection, impersonation, fraudulent calls, and persistent access. |
Protect / Detect: Identity management, strict authentication (TLS), source control, and proactive detection of anomalous records. |
|
Toll Fraud and IRSF |
It generates high direct economic costs in a matter of hours, abuse of international routes and serious reputational damage. |
Govern / Protect / Respond: Consumption policy limits, secure routing , CDR analysis, and immediate containment. |
|
CLI Spoofing and Manipulation |
It destroys channel trust, facilitates vishing , and complicates the traceability of commercial and operational communications. |
Govern / Protect / Detect: Caller ID verification ( Branded Calling , STIR/SHAKEN), number reputation and carrier agreements. |
|
DoS/DDoS over signaling or voice |
It can interrupt active calls, severely degrade quality, or block critical support services in a matter of seconds. |
Protect / Respond / Recover: Infrastructure resilience (multi-carrier, multi-datacenter), capacity management, QoS protection, and coordinated response. |
|
Exposure and risks in WebRTC |
It introduces vulnerabilities in APIs, session handling, token management, media flow, browsers, and integration with business applications. |
Protect / Detect: Application-level security, session authorization, media privacy, strict encryption, and integration auditing. |
|
Quality of Service (QoS) Degradation |
Latency, jitter , packet loss, or MOS dropouts may indicate congestion, attack, misconfiguration, or interconnection failure. |
Protect / Detect: QoS as an explicit KPI for availability, continuous real-time monitoring and service anomaly alerts. |
|
Operational complexity and multi-vendor |
The interconnection of multiple operators, clouds , PBXs, contact centers and proxies creates gaps in the boundaries of trust. |
Govern / Identify: Supply chain risk management, contract auditing, verification probes and unified operating models. |
These scenarios show how seemingly technical threats can affect service availability, operating costs, regulatory compliance, and customer and user confidence.
Fundamentals and Architecture of the Quobis Voice Security Framework
The framework takes as its conceptual reference the NIST Cybersecurity Framework 2.0 (NIST CSF 2.0) standard and translates it into the technical language of telecommunications (SIP, WebRTC, SBCs, trunks, carriers and interoperability).
Value Contribution of the Methodology:
Availability Measured in Seconds
In voice communication, a few seconds can mean missed calls, blocked contact center queues, interrupted critical communications, or an inability to contact customers and users.
QoS as a Security Metric
Integrate latency , jitter, packet loss, and MOS value within the organization’s resilience posture.
Quality of service is not just a technical indicator. Latency, jitter, packet loss, or MOS degradation can reveal congestion, abuse, attacks, misconfiguration, or interoperability issues. That’s why the framework treats quality as part of the security posture.
Fraud and Identity as central challenges
Voice combines identity, numbering, trust, and direct economic cost. Route abuse, CLI manipulation, vishing, and IRSF are not peripheral incidents: they are security scenarios inherent to the voice channel.
How does it relate to NIST CSF 2.0?
The framework uses NIST CSF 2.0 as a conceptual reference, but interprets it from the perspective of voice. The functions of governing, identifying, protecting, detecting, responding, and recovering remain useful, provided they are translated into the language of SIP , WebRTC , SBCs , SIP trunks, operators, quality, and operational continuity.
Speech reading applied to voice and real-time communications
Government
Define responsibilities, risk criteria, numbering policies, operator dependency, continuity, and alignment with regulatory requirements.
Identify
Understanding voice assets, trunks, SBCs, SIP domains, routes, WebRTC applications, integrations, signaling flows, and media.
Protect
Reduce exposure through hardening, segmentation, encryption, authentication, anti-fraud policies, route control, and caller ID protection.
Detect
Observe SIP events, CDRs, authentications, traffic anomalies, QoS degradation, fraud patterns, and signs of abuse.
Answer
Coordinate response to fraud, DoS, credential compromise, route manipulation, supplier outages, or quality incidents.
Recover
Restore service, preserve evidence, review routes, recover configuration, validate quality, and turn the incident into an operational improvement.
For teams responsible for security, continuity, and communications, integrating voice into the corporate risk management framework helps prioritize decisions, coordinate incident response, and reduce the impact on the business. The key is to treat SIP signaling, media, carrier interconnection , fraud, caller ID, and quality of service as critical elements of the digital exposure surface.
Quobis Voice Security Framework
Define the strategic, legal, regulatory and operational control framework on which the voice service rests
- Risk Management Strategy: The Board of Directors must define how to manage risks. This involves adopting appropriate technical, operational, and organizational measures, adapting cybersecurity to the specific context of real-time communications, and integrating it into the company’s overall risk management strategy.
- Supply Chain Management: In multi-vendor ecosystems (operators, SBC manufacturers, UCaaS platforms), security must be ensured in acquisition, development, and maintenance. Contracts (end-of-life, updates, changes in terms) must be audited, and evidence/proof ( probes ) must be obtained to claim contractual warranties.
- Policies, Processes and Procedures: Since communications impact the entire organization, a deep understanding of business processes is required to adapt policies to different roles and responsibilities, ensuring their adoption by stakeholders.
- Oversight: Ensure that findings from audits, incidents, and simulation exercises translate into improvement actions. Risk management should be reviewed periodically to adapt to evolving threats, regulatory changes, and new technological dependencies, ensuring the traceability of decisions and regulatory/contractual compliance.
It establishes complete visibility of the attack surface and real-time risk assessment.
- Asset Management: Identification, documentation, evaluation, and assurance of critical communication assets (networks, applications, endpoints, SBCs, gateways, and vendors). It assesses technological dependencies (vendor lock-in, open source alternatives, cloud strategy) and links each asset to essential business processes.
- Risk Evaluation: Identifying threats and vulnerabilities arising from network complexity, interconnection among multiple stakeholders, and technological obsolescence. It manages risk in real time based on probability and impact on Availability and Quality of Service (QoS).
- Continuous Improvement: Demonstrate a continuous process of adaptation and improvement. Address compatibility challenges in hybrid environments (where part of the legacy infrastructure does not support modern controls) and manage high turnover and continuous hardware/software updates using target security profiles.
It applies technical safeguards to ensure the confidentiality, authenticity, and continuity of communications.
- Identity Management, Authentication, and Access Control : Mitigates the risks of weak authentication (phishing, unauthorized access to telephone resources). Applies the principle of least privilege and separation of duties, balancing robust security (advanced authentication, rigorous verification) with usability and interoperability across various identity providers.
- Awareness and Training : Training staff in best security practices adapted to telephony. Covers the wide variety of communication channels and modes (desk phones, mobile phones, UCaaS, Contact Center platforms, OTT apps).
- Data Security : Ensures the protection of data in transit, in use, and at rest. It applies signaling (TLS) and media (SRTP) encryption, managing latency, and ensures regulatory compliance through call log maintenance, auditable logs, and breach notification.
- Availability: Consider availability as the key factor when evaluating DoS attacks, hardware failures, or disasters. This requires backups, disaster recovery plans, and crisis management to meet the requirement of reporting significant incidents within 24 hours (early warning) and 72 hours (full report).
- Quality of Service (QoS) : QoS is an explicit component of effective availability. It monitors critical parameters affected by security controls: latency, jitter, packet loss, effective bandwidth, and speed. QoS must be auditable in accordance with legal obligations for publishing quality parameters.
- Platform Security : Protects the underlying set of physical/virtual resources, software and services (SBCs, Softswitches, routers, VoIP firewalls, SIP servers, containers and hypervisors) through regular audits and security testing.
- Technology Infrastructure Resilience (TIR) : Ensures that the network can withstand disruptions while maintaining critical performance. This includes replication of critical nodes, load balancing, multi-carrier/multi-datacenter architectures, and the definition of Recovery Time Objectives (RTOs) and Recovery Perception Objectives (RPOs).
It provides real-time visibility to identify anomalous events or service degradations:
- Continuous Monitoring: Supervision of heterogeneous infrastructures where physical, virtualized, cloud, IoT, and 5G networks coexist. Detects anomalous events and fraud in real time to react before legal reporting deadlines expire.
- Adverse Event Analysis: Extends the detection perimeter to the supply chain of operators and suppliers. It uses business context and asset criticality to correlate SIP/CDR anomalies and prioritize volumetric or fraud alerts.
Incident containment and mitigation mechanisms at the speed demanded by voice:
- Incident Management, Analysis, Mitigation, and Response: Detecting anomalies in seconds to resolve incidents in minutes, ensuring that service quality is never compromised. This includes automatic containment, isolation of compromised routes, blocking malicious traffic, capturing forensic SIP traces, and escalation coordination with technical teams, management, vendors, and regulatory authorities.
Ensures a return to normal operation and continuous system improvement after an incident:
- Execution of the Recovery, Improvement, and Communication Plan: High criticality of restoration time and confirmation of operational status. Restoring service involves coordinating complex dependencies (backbone networks, cloud providers, DNS, carriers, manufacturers). Document the incident, communicate the evidence to stakeholders, and update security controls based on lessons learned.
Quobis Voice Security Framework connects the entire Security & Trust Services catalog
The framework helps connect voice risks with concrete decisions regarding security, continuity, and trust. Its principles allow for the evaluation of each service from a common perspective: exposure, fraud, quality, detection, response, and operational impact.
For teams responsible for security, continuity, and communications, this perspective makes it easier to integrate voice into a broader cybersecurity strategy. The service pages then delve deeper into the scope, process, and use cases for each specific need.
Voice Security Readiness Check
Entry point to identify initial maturity, obvious gaps, and high-level priorities.
Voice Security Consulting
Strategic application of the framework to architecture, governance, operating model, roadmap and regulatory alignment.
Voice Security Assessment
Technical validation of exposure, configuration, architecture, controls and risks associated with voice services.
Independent Audit Trail Analysis
Ability to analyze traces, signaling, CDRs and evidence to investigate incidents, disputes or anomalies.
Voice security training
Tailored training programs with objectives for each professional role and evidence for your audits.
Quobis Voice Security Solutions Tools and Technology Ecosystem
The Quobis Voice Security Framework ‘s strategic framework is supported by an ecosystem of technological capabilities that allows its principles to be put into practice: monitoring the service, detecting anomalies, protecting the infrastructure, strengthening caller identity, and responding quickly to security or quality incidents.
The framework is complemented and operationally implemented through a comprehensive ecosystem of technological components, both proprietary and from leading third-party industry players:
Observability and monitoring
- Real-time observability: continuous visibility into the overall performance of the voice network, the health of the infrastructure, and the quality perceived by users and customers. Capabilities such as Quobis VoIP Monitor or Monitoring as a Service (MaaS) help detect degradations, anomalous patterns, and operational problems before they escalate.
- Proactive generation of SBC/SIP health alarms and metrics: monitoring of key indicators in SBCs —CPU, memory, licenses, high availability status— and of the SIP service by realm , domain, route or user agent , with alarm generation and integration with third-party tools.
Call intelligence and reputation
- Quobis Caller Score : a risk assessment and fraud detection tool that combines internal knowledge, behavioral patterns, and external sources to score each incoming call in real time using a Call Risk Score .
- Anti-fraud protection: actionable scoring to proactively block, route, label, or manage phishing attempts, robocalls , suspicious calls, and phone fraud patterns before they impact the service or users.
Trust and caller ID
- Identity verification: strengthening the legitimacy of the telephone channel through capabilities such as RCS Based Branded Calling , SDK In-App Verified Calling and STIR/SHAKEN cryptographic authentication when applicable to the regulatory and operational environment.
- Reputation protection: clear identification of corporate calls to reduce false positives in anti-spam filters, improve contact rate and protect the organization’s image.
Perimeter protection and multi-vendor integration
- Agnostic and adaptable approach: specialized integration that avoids unnecessary dependencies on a single vendor and adapts security controls to heterogeneous architectures.
- SBC and protocol hardening: application of strict policies in Session Border Controllers for DoS/TDoS detection and mitigation, topology hiding , NAT isolation, route control, and encryption of signaling and media using TLS/SRTP where feasible.
- Experience with leading platforms and open software: operational knowledge in Oracle, Ribbon, AudioCodes, Kamailio, OpenSIPS, Asterisk, FreeSWITCH, Janus and RTPengine environments, among other common components in modern voice architectures.
Where to begin?
If voice communication is part of the organization’s critical processes, the next step is to explicitly incorporate it into the cybersecurity risk map. This involves reviewing how communication services are governed, what assets and dependencies exist, what fraud or unavailability scenarios are relevant, and what signals can be integrated into detection and response processes.
The entry point will depend on the situation of each organization: understanding the level of maturity, contrasting the exposure of the voice infrastructure, designing a specific security strategy, investigating an incident, or training the NOC, SOC, engineering, and operations teams.
FAQs
No. It’s the framework that explains how Quobis understands voice and real-time communications security. Specific services, specialized content, and technical capabilities are developed based on this vision.
No. It applies to operators and service providers as well as companies with corporate telephony, contact centers, SIP trunks, UC platforms, WebRTC services or critical communications.
Not necessarily. Its purpose is to help understand the security posture and prioritize improvements. In many cases, the initial benefits are achieved through greater visibility, hardening , anti-fraud policies, and better-defined response procedures.
The framework is inspired by NIST CSF 2.0, but translates its functions to the requirements of voice: real-time availability, quality of service, fraud, signaling, media, operator dependence, and continuous operation.
