Security Overview
Purpose
Implement robust security measures to protect your Cloud PBX from unauthorized access, fraud, and attacks.
Security Layers
- IP whitelisting/blacklisting
- Geographic restrictions
- Port security
- Firewall integration
- Strong password policies
- Two-factor authentication (2FA)
- Extension password rules
- Session management
- Role-based permissions
- IP restrictions for admin portal
- Allowed country access
- Outbound route restrictions
- Rate limiting
- Call frequency restrictions
- International dial restrictions
- Allowed country codes
Key Security Features
Allowed IPs
Whitelist trusted IP addresses to prevent blocking by security systems.
Use Case: Add office public IP, VPN IP ranges, known SIP trunk IPs.
Result: Whitelisted IPs never blocked, even if suspicious activity detected.
Blocked IPs
View and manage automatically blocked IP addresses.
How It Works: Failed login attempts, SIP registration failures, or suspicious patterns trigger automatic IP blocks.
Management: Unblock trusted IPs that were mistakenly blocked.
Outbound Call Frequency Restriction
Limit outbound call rate to prevent toll fraud.
Default Rule: Maximum 5 outbound calls in 1 second per extension.
Custom Rules: Create rules for specific users, groups, or time periods.
Country-Based Restrictions
- Allowed Country IPs: Restrict system access to specific countries
- Allowed Country Codes: Restrict international calling destinations
Two-Factor Authentication
Require second authentication factor for admin login.
Methods:
- Time-based OTP (TOTP)
- SMS verification
- Email verification
- Authenticator apps (Google, Microsoft, Authy)
Scope: Super administrator account, optional for other admins.
Extension Password Rules
Enforce strong password policies for extensions.
Rules:
- Minimum length (8-20 characters)
- Complexity (uppercase, lowercase, numbers, symbols)
- Password expiry (30-365 days)
- Password history (prevent reuse)
Result: Stronger authentication, reduced risk of brute-force attacks.
Advanced Security Options
Passwordless Login
Allow service provider remote support without sharing credentials.
How It Works: Generate time-limited login link for support personnel.
Use Case: Vendor support, troubleshooting, remote assistance.
Admin Login IP Restriction
Limit admin portal access to specific IP addresses.
Configuration: Add allowed IP ranges for administrative access.
Use Case: Restrict admin login to office network and VPN only.
SSH Access
Allow temporary SSH access for advanced troubleshooting.
Security:
- Access is disabled by default
- Enable only when needed
- Automatic timeout after session
- Full audit logging
Use Case: Deep system diagnostics, log analysis, advanced debugging.
Common Security Threats
Threat: Attackers gain access and make expensive international calls.
Prevention:
- Strong passwords
- Call frequency limits
- Country code restrictions
- IP whitelisting
Detection: Unusual call patterns, spikes in international calls, high costs.
Threat: Attackers scan for vulnerable SIP extensions.
Prevention:
- IP restrictions
- Fail2ban (auto-block after failed attempts)
- Hide SIP service from internet
- Use non-standard ports
Detection: High rate of failed registration attempts.
Threat: Flood system with requests to overwhelm resources.
Prevention:
- Rate limiting
- IP blacklisting
- DDoS mitigation at network level
- Cloud provider DDoS protection
Detection: High CPU usage, slow response times, connectivity issues.
Threat: Use stolen credentials from data breaches to access system.
Prevention:
- Enforce strong, unique passwords
- Enable 2FA
- Monitor for unusual login patterns
- IP restrictions
Detection: Logins from unexpected locations, failed login spikes.
Security Best Practices
- Use strong, unique passwords
- Enable password complexity requirements
- Rotate passwords regularly
- Never share credentials
- Follow principle of least privilege
- Review permissions quarterly
- Remove access for departed employees immediately
- Enable 2FA for all administrators
- Review security logs weekly
- Set up alerts for suspicious activity
- Monitor failed login attempts
- Check blocked IP list regularly
- Use VPN for remote access
- Implement IP whitelisting where possible
- Keep firewall rules updated
- Restrict country access if applicable
Security Audit Checklist
- Review blocked IPs
- Check failed login attempts
- Verify user permissions
- Review call patterns for anomalies
- Check security log for alerts
- Audit user accounts (remove inactive)
- Review admin access list
- Update IP whitelists
- Test security policies
- Password policy review
- Comprehensive security audit
- Penetration testing
- Review all security settings
- Update incident response plan
- Security awareness training