An IP phone is a small computer with a microphone, permanently connected to your network, that everybody forgets about. That description should make any IT manager sit up. The good news: keeping a fleet of phones secure is mostly a matter of habits, and on a managed platform the habits can be automated.
Firmware is the whole game
Nearly every real-world phone vulnerability is patched firmware someone never applied. Handsets bought from a box-shifter and configured by hand tend to run the firmware they shipped with, forever. RingPlus-provisioned phones receive vetted firmware automatically — we stage manufacturer releases, test them against our platform, and roll them out overnight, fleet-wide.
Separate the phones from the laptops
- Put phones on a dedicated voice VLAN — it isolates them from whatever is happening on the data network, and QoS gets simpler as a bonus.
- Turn off the phone's PC passthrough port where it is not used; where it is used, keep the VLAN split so the desktop rides its own network.
- Disable the handset's local web interface, or at minimum change the default admin password — provisioned phones do not need it.
Encrypt the call, not just the config
Signalling over TLS and media over SRTP mean nobody on the network path can read who you called or listen to the audio. Both are on by default for RingPlus handsets. If you inherited phones from an old system, this is the first setting worth auditing — legacy installs frequently run everything in the clear.
- Audit: does every handset register over TLS?
- Audit: is SRTP enforced, or merely offered?
- Audit: who can reach the phones' admin interfaces, and from where?
- Audit: when did each model last receive firmware?
Secure phones are boring phones. If your handsets ever get interesting, something has gone wrong.
Kitting out your desks?
Talk to the team that provisions these phones every week.
