Many VoIP experts now believe that SIP is gaining momentum as the industry searches for common standards. In its basic form, however, SIP traffic is "clear text," which means that voice traffic is vulnerable to "packet sniffers" looking for caller IDs or passwords. According to Chris Rouland, CTO at security firm Internet Security Systems, it’s as easy to intercept unencrypted VoIP calls as it is to use an iPod. By downloading software off the Internet, hackers can intercept calls "with a simple click," he says. In order to protect caller IDs, phone addresses and account information, VoIP users need to encrypt SIP traffic.

Even so, VoIP observers say, encryption isn’t yet standard practice. "There’s a lot of unencrypted VoIP traffic out there," says Good Harbor’s Cressey. That’s largely because encryption can be cumbersome and expensive. At Kirkland & Ellis, Novak says he spent three months working out encryption-related problems that affected VoIP call quality. In addition to extensive testing and tuning, he is now using a suite of monitoring tools that sample the VoIP network every 30 seconds and alert him if quality has dropped off.

Calculate Your Risk

For O’Connor and Lynch at WPI, migrating to VoIP involves careful calculation of how much risk they are willing to take. For example, while they are comfortable with the idea of administrators, instructors and students using VoIP for basic phone service, they have decided not to include campus security phones on the network. "We are leaving all security phones and kiosks on the copper systems, which have a higher level of reliability," says O’Connor.

O’Connor and other early VoIP adopters say with the current state of VoIP technology, organizations need to decide early which security risks are not worth taking. These may include phones for security and emergency services. "Essential telephone services, unless carefully planned, deployed and maintained, will be at greater risk if based on VoIP," according to the NIST report.

At WPI, O’Connor and Lynch are experimenting with "soft phones" (ordinary PCs with headsets and special software configured to make VoIP calls) for students and faculty who are studying abroad and need to communicate with the school from areas such as Namibia and Thailand. Soft phones offer a way to keep in touch from remote places at lower costs. In a recent test of the soft phones, in which the students and faculty at a facility in Australia made calls over their laptops, O’Connor says he was pleasantly surprised by the quality of service.