Quoted - VoIP security

Attention: geekdom alert!

IT Business Edge has published the transcript of an interview I gave them recently. It's also distributed within their Optimizing Infrastructure online newsletter. It's entitled 3 Questions: Walking Upright, Not Yet Running. I've pasted it here:

With Carmi Levy, senior research analyst with Info-Tech Research Group Inc., London, Ontario, Canada.

Question: In recent research on Voice over IP, you cite the relatively unsettled regulatory situation as well as security concerns and other issues for holding off on VoIP deployment. What's your best guess as to when the technology will be ready for worry-free, enterprise-wide deployment, and what's the biggest variable in that equation?

Levy: I don't think any technology is ever completely worry-free. For example, e-mail has been around in various forms for well over a generation, and we continue to deploy it along with a phalanx of protective filters against spam, viruses and a host of other threats. For any relatively new technology, the worry never really goes away, but it does tend to level off somewhat once the technology has had a few years to mature. Maturity occurs when standards become relatively universal, key vendors become more entrenched in their respective market niches, and the overall language of the technology becomes known by IT decision makers.

For VoIP, we're still in the somewhat more chaotic early stages of its evolution. Standards remain somewhat fluid, startups do battle with more established vendors who are in turn struggling to make the transition to VoIP, and IT decision-makers are still getting up to speed. The next two to three years will witness that kind of shaking-out, meaning 2008 is the year when we can comfortably call it a mature technology. The biggest variable is clearly security. Until it is relatively stable and well-communicated, IT won't make the jump.

Question: You also caution potential customers that upgrade costs can spiral out of control, since the increased traffic load on the IP network can mean unforeseen additional expenditures. How common is this among customers and what sorts of additional equipment or software do they end up having to buy?

Levy: The majority of early-adopter VoIP implementations run into greater-than-expected infrastructure costs. The majority of such companies with whom I have spoken have run into varying degrees of uncertainty during deployment, and this can be attributed to the uncertainty of the new landscape.

We're still learning the language of VoIP and figuring out what questions need to be asked. Until IT becomes as well-versed here as it already is with other aspects of infrastructure — as it has become with server design and desktop operating system deployment, for example — these little surprises will continue to pop up. The kinds of additional expenses that tend to pop up include VoIP-compliant firewalls, higher-capacity switches and routers, as well as direct increases in available bandwidth. As IT becomes more familiar with the scope of VoIP's impact on network infrastructure, these questions will be asked — and answered — far earlier in the project planning process.

Question: The "skills gap" you mention occurs as enterprises come to grips with whether VoIP gets handled by the telecom staff as a data service or by the IT staff as a voice application. Does this blending of voice and data at the personnel level really have to be so disruptive or expensive?

Levy: It never needs to be disruptive, but reality has an annoying habit of falling short of the original promise.

Both disciplines are typically staffed by highly experienced, long-serving experts in their respective fields. The term "turf war" wouldn't be out of place in describing how each side responds to a potential degradation in its area of accountability. Like most people, they focus on the territorial protection of what they already have. In doing so, they ignore the going-forward potential of the converged architecture.

Fear can be a positive or negative motivator. Effective managers focus on the wins that will benefit everyone, and ensure their messaging focuses heavily on these advantages right from the start. Effective managers also anticipate the kinds of questions and issues that employees from both teams will raise, and they prepare properly structured responses in advance. Proceeding through a VoIP implementation without a communication plan that outlines, in explicit detail, how the respective data and voice specialists will be deployed to support the new infrastructure is, in my view, a disaster waiting to happen.