nist :
federal agencies and other organizations that are considering switching their telephone systems to voice over internet protocol (voip) should proceed with caution and carefully consider the security risks, says a recent report* by the national institute of standards and technology (nist).

voip is an important emerging technology that makes it possible to place telephone calls using a broadband internet connection rather than traditional, circuit-based telephone lines. while it shows promise for lower cost and greater flexibility, voip has a very different architecture than circuit-switched telephony, and these differences result in significant security issues. “administrators may mistakenly assume that since digitized voice travels in packets, they can simply plug voip components into their already-secured networks and remain secure. however, the process is not that simple,� says the nist report. implementing common security measures into voip, such as firewalls and encryption, can cause poor voice quality and blocked calls if not done carefully and with the proper equipment. designing, deploying and securely operating a voip network is a complex effort that requires careful preparation, says the report.



http://www.nist.gov/public_affairs/tech ... tm#caution
http://csrc.nist.gov/publications/nistp ... -final.pdf

and some press take on the report:

http://www.computerworld.com/networking ... ;nid=99258