As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help define a direction.
Since I'm a geek first, and a security person second I started immediately down the road of "What is currently possible" when it comes to securing VoIP. I've implemented VoIP at other organizations in the past few years, and I'm familiar with vanilla MGCP and SIP as call control mechanisms. But from what I'm aware (and what the NIST so handily reminded me with their publication on VOIP security) is that in terms of a secure implementation there are very few options.
MGCP is not built for security, it performs call handling and does that job well. If you were to put an MGCP interface open to a large audience it could be used to perform anything from toll fraud to silent monitor setups, depending on what features your system supports.
SIPs on the other hand allows for authentication and encrypted call handling with TLS (aka SIPS.) I've heard Cisco implements MGCP and SRTP to give you an encrypted conversation, but since MGCP itself isn't secure it seems to break the trust model and requires an IPSec secured channel to facilitate this over the wider network securely.
I guess ultimately my question is: Is there really an option beyond SIPS and SRTP that provides end to end secure authentication, maintains integrity, and confidentiality or should I just write the policy to such that ultimately it will specifically require these technologies?
The environment requirements include anything from a mixed desktop environment in a relatively secure environment to a work at home scenario for the end users. Ideally one specification should be used to define the "minimum" required for all.