Extension-Specific Security
Purpose
Apply security controls at the extension level for granular protection.
Extension Security Overview
Extension-Level Security
Extension-level security complements system-wide security by:
- Restricting individual extension registration
- Controlling outbound calling permissions
- Enforcing SIP security per extension
- Managing extension-specific access
SIP Security
Registration Authentication
Purpose
Secure extension registration with strong credentials.
Navigate to SIP Settings
Go to Extensions > Select extension > Advanced > SIP Settings.
Configure Authentication
- Auto-generate: System creates strong random password
- Manual: Enter custom password (must meet policy requirements)
- Minimum Length: 12+ characters recommended
- Complexity: Mixed case, numbers, symbols
- Defaults to extension number
- Can customize for security (obscure actual extension number)
- Example: Extension 1001 uses username
"user_a7b3c9d2"
Result
Extension requires secure credentials for registration.
SIP Authentication Methods
Digest Authentication (default):
- Challenge-response mechanism
- Password never sent in clear text
- Industry standard
TLS Transport:
- Encrypted SIP signaling
- Prevents eavesdropping
- Required for remote workers
SRTP (Secure RTP):
- Encrypted media streams
- Protects voice/video content
- Enable for sensitive calls
Enable Encryption
Navigate to Extensions > Select extension > Advanced.
Configure Transport and Media
- Transport: Select TLS
- Media Encryption: Enable SRTP (Mandatory)
Save
Click Save to enforce encryption.
Result
All signaling and media encrypted end-to-end.
Call Restrictions
Outbound Route Permissions
Purpose
Control which outbound routes (and therefore which types of calls) an extension can make.
Navigate to Permissions
Go to Extensions > Select extension > Permissions.
Configure Route Permissions
Available Routes:
- Local: Local calls only
- Long Distance: Domestic long distance
- International: International calling
- Premium: Premium-rate numbers (900, etc.)
- Emergency: Emergency services (911, 112)
Assignment:
- Check routes to allow
- Uncheck routes to block
- Emergency always enabled by default
Save
Click Save to apply restrictions.
Result
Extension restricted to permitted call types.
Use Cases
- Reception: Local + long distance, no international
- Sales: All routes including international
- Contractors: Local only
- Executives: All routes unrestricted
Denied Patterns
Purpose
Block specific phone numbers or patterns.
Add Patterns
Navigate to Extensions > Select extension > Call Restrictions, then click Add Pattern.
Enter Patterns
Examples:
900XXXXXXX: Block all premium-rate 900 numbers1-976-XXX-XXXX: Block adult services011: Block all international (overrides route permission)- Specific Number: Block ex-employee's number
Wildcards:
- X: Any single digit
- N: Any digit 2-9
- Z: Any digit 1-9
- .: Wildcard (any length)
Save
Click Save to enforce blocks.
Result
Calls matching patterns blocked before routing.
IP Restrictions
Registration IP Whitelist
Purpose
Limit which IP addresses can register this extension.
Enable IP Restriction
Navigate to Extensions > Select extension > Advanced > IP Restrictions and enable Restrict Registration by IP.
Add Allowed IPs
Click Add IP and enter allowed IPs or ranges:
- Single IP:
192.168.1.100 - Range:
192.168.1.0/24 - Multiple: Add multiple entries
Save
Click Save to enforce restriction.
Result
Extension only registers from whitelisted IPs. All other attempts rejected.
Use Cases
- Desk Phones: Restrict to office network subnet
- Remote Workers: Allow home IP + VPN IP
- Executives: Restrict to specific devices
- Shared Lines: Lock to conference room or specific phone
Dynamic IPs
For users with changing IPs (home broadband), use VPN or don't enable IP restrictions.
Login Security
User Portal Access
Purpose
Secure access to user web portal.
Configure Portal Security
Navigate to Extensions > Select extension > Security.
Set Access Controls
- Different from SIP password
- Same complexity requirements
- Separate expiry schedule
- Username + Password: Standard
- Email Link: Passwordless magic link
- SSO: Single sign-on via corporate identity
- IP Whitelist: Limit portal access by IP
- Time Restrictions: Only allow login during business hours
- Disable Portal: Revoke web access entirely
Save
Click Save to apply settings.
Result
User portal access controlled per extension.
Call Recording Security
Mandatory Recording
Purpose
Ensure all calls are recorded for compliance or quality.
Enable Recording
Navigate to Extensions > Select extension > Features > Call Recording and select Always Record.
Configure Options
- User Cannot Disable: Remove user control
- Announce Recording: Play notification
- Secure Storage: Encrypt recordings
- Access Control: Restrict who can listen
Save
Click Save to enforce recording.
Result
All calls automatically recorded. User cannot disable.
Use Case
Compliance (financial trading, healthcare), quality assurance, dispute resolution.
Recording Access
Purpose
Control who can access call recordings.
User hears own recordings only
User + manager access
All department members
Supervisors and QA team
No user access
Extension Monitoring
Call Monitor Permissions
Purpose
Allow supervisors to monitor, whisper, or barge into calls.
Enable Monitoring
Navigate to Extensions > Select extension > Features > Call Monitor and enable Allow Monitoring.
Configure Permissions
Who Can Monitor:
- Specific users (select supervisors)
- Extension group (e.g., "Managers")
- All administrators
Monitor Modes:
- Listen: Silent monitoring only
- Whisper: Speak to agent without customer hearing
- Barge: Join call as 3-way conference
Save
Click Save to grant permissions.
Result
Authorized users can monitor this extension's calls.
Use Case
Training new agents, quality assurance, assist with difficult calls.
Privacy Settings
Extension Visibility
Purpose
Hide extension from company directory.
Configure Visibility
Navigate to Extensions > Select extension > Privacy and enable Hide from Directory.
Select Visibility Level
Visibility Options:
- Hidden: Not in directory at all
- Number Only: Number visible, name hidden
- Name Only: Name visible, number hidden
- Full: Name and number visible (default)
Use Case
Hide executive extensions, VIP users, IT admin extensions from general visibility.
Caller ID Privacy
Purpose
Hide extension's caller ID on outbound calls.
Result
Outbound calls display as "Anonymous" or "Private Number".
Use Case
Collections departments, confidential calls, executive privacy.
Security Profiles
Purpose
Apply consistent security settings to multiple extensions.
Creating Security Profile
Create Profile
Navigate to Security > Extension Security Profiles and click Create Profile.
Configure Settings
Name profile (e.g., "High Security - Executives") and configure all security settings:
- SIP transport (TLS)
- Media encryption (SRTP mandatory)
- IP restrictions
- Call restrictions
- Recording requirements
- Monitor permissions
- Password policies
Save
Click Save to create profile.
Applying Profile
Result
All selected extensions inherit security profile settings.
Use Cases
- Executive Profile: Maximum security and privacy
- Call Center Profile: Mandatory recording, monitoring allowed
- Contractor Profile: Restricted calling, IP whitelist
- Standard Employee: Balanced security
Security Audit
Per-Extension Audit
Purpose
Review security configuration for individual extension.
Run Audit
Navigate to Extensions > Select extension > Security Audit.
Review Checklist
System evaluates:
- Password meets complexity requirements
- TLS transport enabled
- SRTP required
- IP restrictions configured (if applicable)
- Appropriate outbound route permissions
- Call restrictions in place (if needed)
- User portal access controlled
- Denied patterns configured (if needed)
- Recording policy compliant
- Monitor permissions appropriate
- Privacy settings correct
- Last password change < 90 days
Address Issues
View audit score (0-100%) and address flagged issues.
Configuration Summary
Basic Extension Security
Extensions > Select extension > Security → Authentication: Auto-generate strong password → Transport: Enable TLS → Media: Require SRTP → Save
Call Restrictions
Extensions > Select extension > Permissions → Select allowed outbound routes → Call Restrictions tab → Add denied patterns → Save
IP Restrictions
Extensions > Select extension > Advanced > IP Restrictions tab → Enable restriction → Add allowed IPs → Save
Apply Security Profile
Extensions > Select extensions → Bulk Actions > Apply Security Profile → Select profile → Apply
Result
Extension secured with appropriate controls.
Best Practices
Risk-Based Security:
- High-risk users (executives, finance): Maximum security
- Medium-risk (general staff): Standard security
- Low-risk (lobby phone): Basic security
Least Privilege:
- Grant minimum necessary permissions
- Restrict by default, allow on request
- Regular permission reviews
Defense in Depth:
- Layer multiple controls
- Don't rely on single security measure
- Combine authentication, encryption, restrictions
Monitoring:
- Enable recording for sensitive extensions
- Monitor high-value targets
- Audit security logs regularly