Sunday, October 19, 3.30pm: I am standing on the sideline of a soccer field, heart pounding as our U14 girls team lines up for the penalty shootout to decide the final of the San Ramon Boo Cup. The girls are dressed as Batgirl, and our opponents (our local rivals, who we have never beaten) are the Teenage Mutant Ninja Turtles (it’s a Halloween-adjacent tournament, so there are costumes).
We came from behind to tie the game at 1-1 after regulation time, and now everything has come down to penalty kicks.
Our goalkeeper (my daughter) stands alert in front of the net, trying to anticipate which way the striker will shoot. The rest of the team holds hands in the center-circle, watching nervously. And then… she saves one. The ball goes to her right, she dives and grasps the ball tight in her gloves. I pump my fists and yell in excitement.
A few minutes later, after all of our players have calmly scored their kicks, the referee blows the final whistle. The team erupts – jumping, hugging, running around wildly in disbelief and joy. This is our first ever tournament win and it is a magical feeling.
As I replayed that scene in my mind over the following days, I found myself thinking about how tough it is to be a goalkeeper. If you’re a striker, you only need to score a goal once and everyone celebrates you – as a goalkeeper, if you make one mistake, you’re the villain.
As we apply this to telecoms, and look at your VoIP or IP network, who stands in front of the net? Who is our last line of defense?
The VoIP Goalkeeper
In an IP network, there are many players contributing to a smooth experience – switches, routers, DNS, SBCs, firewalls. But when it comes to defending your network from bad actors, who is the equivalent of the goalkeeper?
Actually there’s not a single goalkeeper – instead you’ll find that your session border controller (SBC), firewall, WAFs and fraud detection systems are the ones facing the penalty kicks. They’re the only things standing between a well-functioning network and a flood of toll fraud, security breaches, and denial-of-service attacks.
If an attacker sends a barrage of INVITEs to your network, the SBC is your goalkeeper. If fraudsters find a vulnerable IP PBX and start pumping expensive international calls through it, your fraud monitoring system is the one who needs to dive left and swat it away.
And just like in soccer, these defenders don’t succeed through reflexes alone – they need coaching, training, and a strong defense around them.
The Layers Behind the Save
In our penalty shootout, our goalkeeper made the critical save – but it was the team’s structure, the drills, the preparation, and the trust built over months that gave her the confidence and clarity to make that save. In a telecom network, you need that same layered defense.
That might include:
- An SBC configured to block known bad traffic patterns
- Geo-blocking for calls to high-risk destinations
- Access Control Lists (ACLs) on the firewall
- Thresholds and alerts from your billing system or an external fraud detection system
- SIP authentication and call limits per subscriber
No single tactic is enough. It’s the Swiss cheese model – each layer has holes, but when combined, they offer real protection.
Don’t Leave the Goal Unattended
What’s terrifying in telecom is how often these gatekeepers are misconfigured — or completely absent. We’ve seen SIP lines with no password, or the same simple password used repeatedly; we’ve seen lines configured to permit many simultaneous calls, allowing a hacker to cause exponentially more damage.
It’s the equivalent of sending your goalkeeper into a penalty shootout blindfolded.
Some of these errors seem obvious in hindsight, but many of the protections you can put in place are more subtle – and it really helps to have implemented all the best practices to reduce the risk of getting hacked, and to limit the impact if a hacker gets in despite your best efforts.
If it’s been a while since you reviewed your security posture, if your SBC config hasn’t changed in years, or if you’re not sure whether fraud alerts are even working, it might be time for a security check-up.
How We Can Help
At Award Consulting, we offer security assessments focused on VoIP toll-fraud and also more general audits of your IP network. We’ll examine your current defenses, identify vulnerabilities, and help implement a layered approach to protect your network. Whether it’s fraud prevention, IP security, or best practices for SBC deployment – we can help you guard your goal.
You may not win a trophy for network security – but you’ll be glad you’re not the team fishing the ball out of the net.
