Polycom Videoconferencing Endpoint Security and Configuration

This paper focuses on the security of videoconferencing endpoints made by Polycom Corporation--currently the leader in the videoconferencing market. The International Telecommunication Union (ITU) system of videoconferencing standards, videoconferencing components, and motivations for attacking videoconferencing endpoints are reviewed. A number of vulnerabilities and related security measures are discussed, including: theft of endpoints, eavesdropping on videoconferencing calls, administrative security, ISDN and perimeter security, SNMP access threats, FTP access threats, and denial of service attacks. The paper describes how vulnerability scanners can misreport videoconferencing endpoints as Trojan horse programs and concludes with a checklist for Polycom endpoint security.