Security Policy and Posture

This page provides an overview of VoIPmonitor's security posture, development practices, and internal security controls. This information is intended for security departments conducting assessments, audits, or compliance reviews.

== Vulnerability Testing

• No automated vulnerability scanning is performed as part of the standard development or release process
• No manual penetration testing or third-party security audits are regularly conducted
• Bug reports and security issues are addressed as they are identified by users or researchers

== Development Methodology

• The application was developed following general security best practices
• No specific formalized secure development methodology (SDLC) has been documented or systematically applied
• Security improvements are implemented incrementally based on industry standards and customer requirements

== Database Encryption

• User data in the database (CDRs, call metadata, configuration settings) is stored in plain text and is NOT encrypted
• Only user passwords are encrypted (see Password Storage below)
• For encryption of data in transit between components, see SSL/TLS_connection_to_the_Mysql/MariaDB

== Password Storage

• User credentials (passwords) are stored using sha256 hashing
• An option for LDAP authentication is available, which offloads credential storage to an external LDAP server
• For more details on authentication methods, see Shibboleth_and_other_auth_modules

== Data Privacy Features

VoIPmonitor includes several features to assist with privacy compliance:

• IP Address Anonymization - Database-level anonymization of IP addresses
• 2FA - Two-Factor Authentication for enhanced user account security
• Various compliance integrations (SIPREC, CALEA support, PCI-DSS features)

== Supported Authentication Methods

VoIPmonitor supports multiple authentication approaches:

• Local user accounts with username/password
• Two-Factor Authentication (2FA) - see 2FA
• LDAP authentication (username/password verification) - see LDAP Authentication
• Google Sign-In (OAuth 2.0) - see Shibboleth_and_other_auth_modules
• Microsoft Sign-In (Azure AD/Entra ID) - scheduled for upcoming stable release
• Custom login scripts for integration with external authentication systems - see WEB_API#Custom_Login

== Authentication Methods NOT Supported

The following methods are NOT currently supported:

• Shibboleth SSO - not supported
• SAML-based SSO (including JumpCloud, Okta, OneLogin) - not supported
• LDAP SSO (click-through login without credentials) - only LDAP username/password is supported
• Generic OIDC providers other than Google

For complete details, see SSO Authentication Support

== Session Management

• User sessions are managed using PHP sessions
• Session inactivity timeout is configurable
• For specific timeout configuration, review your PHP configuration (php.ini) and web server settings

= Architecture and Network Security

The VoIPmonitor system architecture includes multiple security layers:

• TLS/SRTP Decryption - Support for decrypting encrypted VoIP traffic for monitoring and analysis
• Secure communication between sensors and central server (encrypted TCP connections with server_password)
• HTTPS and Basic Authentication for securing the web GUI
• SIPREC recording with WORM storage for regulatory compliance (SEC 17a-4, CFTC 1.31)
• CALEA integration support for law enforcement data export requests

= Recommendations for Security Assessments

When conducting a security assessment of VoIPmonitor, consider the following:

• Focus the review on deployment-specific configurations (web server SSL, database connection encryption, firewall rules)
• Validate that required authentication methods (LDAP, SSO) are available for your environment
• Review the privacy features to ensure they meet your compliance requirements
• Implement additional security layers at the infrastructure level (intrusion detection, network segmentation, etc.) as no automated vulnerability scanning is performed by the vendor

AI Summary for RAG

Summary: This page documents VoIPmonitor's security posture and development practices. No automated vulnerability scanning or formal penetration testing is conducted. Development followed general security best practices without a specific formalized SDLC. User data in the database is NOT encrypted (only passwords are encrypted using sha256). Authentication options include local accounts, 2FA, LDAP (username/password only, not SSO), Google Sign-In, Microsoft Sign-In (upcoming stable release), and custom login scripts. Shibboleth, SAML-based SSO, and LDAP SSO are NOT supported. Sessions use PHP with configurable inactivity timeout. Security features include TLS/SRTP decryption, encrypted sensor communication, HTTPS support, SIPREC WORM storage for compliance, and CALEA integration. For security assessments, focus on deployment-specific security configurations and implement additional infrastructure-level security measures.

Keywords: security posture, vulnerability assessment, penetration testing, encryption, database encryption, password hashing, sha256, authentication, session management, PHP sessions, LDAP, SSO, Shibboleth, SAML, 2FA, compliance, development methodology, security audit

Key Questions:

• Does VoIPmonitor conduct automated vulnerability scanning?
• Is penetration testing performed on VoIPmonitor?
• Is user data encrypted in the database?
• How are passwords stored in VoIPmonitor?
• What authentication methods does VoIPmonitor support?
• Does VoIPmonitor support Shibboleth or LDAP SSO?
• How are user sessions managed in VoIPmonitor?
• What is the session inactivity timeout?
• Is VoIPmonitor data compliant with security standards?
• What security methodology was used to develop VoIPmonitor?