"The most critical success factor for VoIP is rock-solid infrastructure," says Novak. In Novak’s case, that means improving backup power with an uninterruptible power supply system, backed up by a generator and a fully redundant network. He even suggests running power over Ethernet (PoE) to provide extra redundancy. "If you have a cable break, you can’t tolerate loss of voice," Novak says. "Data has never been driven to the same real-time requirements."

Now when an attorney in London calls the company’s San Francisco office, the call is routed out of a traditional PBX into the firm’s IP backbone and converted to an IP stream across a WAN. When it arrives at the destination, it’s converted into standard time division multiplexing (TDM) and sent to a legacy PBX. So while Kirkland & Ellis is eliminating long-distance charges by using the IP system, it is not yet hooking into the public network from the firm. In the current configuration, it hasn’t yet run VoIP out to the desktop in a significant way, so it is not yet taking big security risks. As the company plans to replace aging legacy telephone infrastructure during the coming years, it will move to a primarily VoIP network. "By that time we will be better prepared for the security challenges," Novak says.

Heller of Arizona’s Medicaid agency agrees that a gradual approach to VoIP helped him prepare for the security challenges of a VoIP implementation. The agency first started using VoIP for long-distance calls between offices four years ago. After an initial period of training and piloting while the agency still had its two legacy PBX systems to fall back on, it decided to replace the system with VoIP at five of its metro Phoenix offices and 11 call centers; its remote offices are still using the PBX systems. Heller says the Arizona agency is saving $425,000 a year after scrapping the traditional circuit-switched phone system for its main offices and call centers. But first he implemented strenuous safeguards, including the encryption of voice traffic, separating voice and data networks, and using a long list of intrusion protection and antivirus products. His team also monitors the voice servers at all times.

Investing in base infrastructure and encryption can add to the cost of moving to VoIP. But Novak says that the VoIP-related investments—which in his case included moving to a pure IP network core—added to the company’s overall network security. "Purely financial savings are not enough to drive you to VoIP at this point," he says, noting that long-distance rates have been falling. But companies that don’t move to VoIP will miss out on some important technological advantages. In his case, VoIP will increase mobility and collaboration by allowing his firm’s attorneys to reroute their voice traffic anywhere in the world while they are on the road.