In Ocean’s Eleven, the heist wasn’t just about breaking into a vault. The vault was protected by security guards, infrared sensors, seismic detectors, an enormous steel door, and the most unpredictable element of all — Terry Benedict. There wasn’t a single vulnerability to exploit. The only way to succeed was to navigate all the layers of security, with each team member playing a precise role in the plan.
As we think about securing a Metaswitch deployment — or any VoIP infrastructure — the challenge is much the same. You’re not just protecting against a single type of threat. You’re defending against toll fraud, DDoS attacks, misconfigurations, software vulnerabilities, unauthorized access, and more. And like the casino in Ocean’s Eleven, your success depends on having layers of defense that work together to stop bad actors before they reach your jackpot.
Enter: The Swiss Cheese Model
One useful mental model here is the Swiss Cheese Model of security.
Each layer of protection you put in place — a firewall, strong passwords, a private network, two-factor authentication — is like a slice of Swiss cheese. It has some holes. Maybe a particular exploit can get through your firewall. Maybe someone finds a weak password. But as long as you stack those slices — with the holes in different places — it becomes extremely unlikely that anything will pass through all the holes.
This is the approach we recommend when securing a Metaswitch deployment: build overlapping layers of protection, so that if one fails, another picks up the slack.
Layer 1: Lock Down the Perimeter
Start by controlling who can even reach your systems.
- Use private IP networks wherever possible.
Your softswitch, call control, and internal signaling components should not be exposed to the public internet. Use NAT and private VLANs to keep core infrastructure internal. - Deploy firewalls at every boundary.
These should be tightly configured to only allow necessary traffic, such as SIP signaling from known IPs or management access from inside your network. Where possible, enforce IP whitelisting. - Use a WAF (Web Application Firewall) for any web-based management tools that need to be accessible externally — for example, if you’re running CommPortal. This can help block automated exploits, SQL injection attempts, and other common attacks. Read more about WAFs here.
- Add DDoS protection at your network edge.
Especially for carriers, availability is everything — and DDoS attacks remain a persistent threat. Work with your upstream provider or use a DDoS mitigation service to filter malicious traffic before it ever hits your network.
Layer 2: Harden Your Devices and Services
Even if a bad actor gets through the perimeter, you can still prevent access to your systems.
- Change all default passwords — not just on your Metaswitch servers, but also on any SIP phones, routers, or customer-premises equipment you manage.
- Use strong, unique credentials for every system and device.
Enable multi-factor authentication wherever possible. - Disable unnecessary services and ports on your systems.
If a protocol or service isn’t needed, shut it down. Every open port is a potential attack vector.
Layer 3: Apply SIP-Specific Protections
Metaswitch systems handle SIP signaling and RTP media, so you’ll want protections tailored to the world of VoIP.
- Use a Session Border Controller (SBC) to enforce SIP compliance, block malformed packets, and limit registration attempts. A well-configured SBC can act as a gatekeeper, blocking a wide range of attacks before they reach your core softswitch.
- Monitor for toll fraud using the layered approach described in our recent Toll Fraud article. In that article, we discussed three key categories:
- Prevent the hack (e.g. enforce authentication and strong passwords)
- Limit the impact (e.g. restrict international calls and call forwarding)
- Spot the hack (e.g. monitor for anomalies and use fraud detection tools)
- Segment your SIP traffic where possible, using VLANs or access control lists. This helps isolate customer traffic from management functions and limits what an attacker can reach if they compromise a single endpoint.
Layer 4: Monitor and React
Even the best defenses will miss something. That’s why detection and response is critical.
- Set up alerting for unusual call patterns, especially during nights and weekends. Watch for spikes in BHCA (Busy Hour Call Attempts) or strange call destinations.
- Enable logging and log review on your Metaswitch and firewall systems. If something does go wrong, you’ll need a record of what happened to investigate and shut it down.
- Establish a process for security updates and incident response.
Know how and when you apply security patches, how you escalate issues internally, and who’s on call when something looks wrong.
Need Help? That’s What We’re Here For.
In Ocean’s Eleven, the team had an explosives guy, an acrobat, a pickpocket, a master of disguises — and of course, George Clooney. You may not need all of that to secure your Metaswitch network, but a smart team, good planning, and layered defenses are a must.
At Award Consulting, we’ve helped carriers secure their networks, investigate incidents, and tighten up their Metaswitch deployments for years. If you’d like a second set of eyes on your infrastructure, or help designing a layered security model, just get in touch.
Security isn’t about perfection — it’s about reducing risk through thoughtful design and layered protection. You may not stop every attempt, but with the right safeguards in place, you’ll make it very hard for anyone to cause serious harm.
