Five Things You Must Know About VoIP

Like any emerging technology, voice over IP presents a painful series of "yes, but ..." trade-offs--Yes, it can lower calling costs, but the gear's expensive and finicky to get running. VoIP differs from most emerging technology, however, in two ways: how quickly it's being adopted and how much is at stake to get it right.

Our latest InformationWeek Research survey finds 39% of companies have installed voice over IP, and another 33% will install it in the coming months. A mere 12% say they have no plans to use it. The reasons for VoIP adoption vary. Lower costs leads (cited by two-thirds of those planning to use it), but many respondents also have higher-value returns in mind: 41% cite building a one-stop communications platform, and 36% expect increased collaboration by combining voice with data-sharing, videoconferencing, or presence technology.

Whatever the many reasons, the march is on to VoIP. At some point very soon, you're either an adopter or a holdout. This will be how most business calls are made. Here's our five-point take on the state of this technology in business.

VoIP is inevitableMaybe it's not quite in the same league as death and taxes, but at some point, not having the converged-network capabilities VoIP allows becomes a competitive liability. Picture this: Since installing VoIP, your largest customer says it's become a big user of its videoconferencing and presence tools. It would like to plug in your staff to speed up response times. Too bad you don't do VoIP.

For many companies, the big move comes when their PBX-based telecommunications system reaches the end of its life cycle. "We needed to replace our aging--frankly antique--equipment," says Jim Bare, IT manager for western North Carolina's Pepsi Bottling franchise. VoIP "is the future," Bare says. What his company got were new features, lower long-distance costs, and simpler internal call routing.

The phone companies see the writing on the wall. AT&T and Verizon already offer big-business VoIP services. They're upgrading their network backbones with Multiprotocol Label Switching, a way to label different types of IP traffic for prioritization. And they're starting to implement the IP Multimedia Subsystem, a standards-based network architecture that will let them provide and charge for services that enable both wired and wireless devices (like cell phones, PDAs, and laptops) to use VoIP and the applications that go along with it, including videoconferencing, instant messaging, and presence awareness.

For the first time last year, telecom and networking companies shipped more IP telephony ports--4.3 million, up 40% from the previous year--than conventional circuit-based ports--4.2 million, down 15%--according to TEQConsult Group.

It probably doesn't make sense for companies to move en masse to VoIP if their PBX gear is still viable or they aren't relocating or adding offices. But there's an interim step: a hybrid switch that's essentially a conventional PBX with interface cards or gateways that enable IP. This approach lets companies leverage legacy equipment and infrastructure. Hybrid PBXs are popular as they let companies rip and replace gradually. They accounted for 55% of PBX sales last year, bringing in $900 million in revenue in the fourth quarter; the number of lines shipped last year was up 21% from the year before, according to the Dell'Oro Group. It costs more than you think Know that feeling of dread when you're far along on a business technology project and the dollar signs keep getting bigger? Hal Pate, VP of IS at Industrial Developments International, a real estate development firm, had one of those moments not long into his recent VoIP deployment. "I asked, 'Do we want to stay in this?'" Pate recalls. VoIP experts and consultants charged more than anticipated--often $100 and up an hour. Even after deployment, maintenance and management costs kept adding up, and implementing features such as unified messaging soaked up time and resources. Pate did what he could to contain costs--like getting his own staff trained on VoIP and using outsiders only when absolutely necessary--and forged on. "I came to the conclusion that we were here, we had stabilized it, and it certainly didn't make any sense to go backwards," he says.

The early costs of VoIP can add up painfully fast. Companies often have to rip out their old telecom infrastructure and may need to add IP network bandwidth, put in extra routers and switches, buy new phones, train staff, and tune service quality. That's a big reason many companies put off VoIP until their telecom systems are truly in need of an upgrade. "You just have to be at a point where you're making a larger capital investment anyway, whether replacing or moving your system," Pate says. Still, "it's a big investment--a big, ongoing investment."

A 100-phone VoIP deployment could cost $155,000 just to get it up and running, estimates Justin Hester, a senior telephony engineer at CDW, a provider of computer equipment and services. For 500 phones, the price, which includes an IP PBX, phones, training, and switching and cabling costs, jumps to $575,000. With larger deployments come economies of scale from cabling, port densities, and bulk purchases.

More than half of respondents to InformationWeek's survey say their companies plan to spend more on VoIP this year than they did in 2005. Upgrade costs are the most commonly cited impediment to further adoption among those who have started moving or plan to move to VoIP. Other challenges cited include interoperability issues, the physical challenge of upgrading the network, security concerns, lack of reliability, standards, and ROI metrics (see chart, Hey-Slow Down).

But Pate and others are convinced VoIP will pay back, eventually, in the form of reduced operational and maintenance costs, the ability to scale networks for less money, and features that can improve collaboration and productivity.VoIP saves Virgin Entertainment Group $700,000 a year just through fewer long-distance calls. Virgin used to have PBXs at each of its 17 U.S. retail stores. The distributed environment meant big long-distance bills, plus phone company charges any time a line was changed, moved, or added. Robert Fort, VP of IT at Virgin Entertainment North America, bet that centralized administration and lower call costs would justify investing in VoIP, and it has. One benefit is least-cost routing: If a manager in the San Francisco store calls a business in Boston, the call will first route through Virgin's Boston store and then out to the Boston business as a local call.

Those are the kinds of hard savings that pay for VoIP. But Fort says the collaboration benefits of VoIP's extended features--such as the time presence awareness saves in trying to hunt down colleagues--are increasing productivity, something harder to quantify. "Sometimes, you're just saving pennies," he says. "But if you look back after a while at that jar, you're going to say, 'Hey, I saved a hell of a lot.'"

Many companies are skipping the advanced features for the time being. City College of San Francisco uses mostly the same features on its 1,700 IP phones that are typical on conventional phones. Network manager Tim Ryan doesn't see the return on investment for advanced features and doesn't have the budget for them. Training alone, he says, would be much too expensive. Lack of ROI metrics is cited by 18% of survey respondents as a factor holding back VoIP deployment.Deployment can be tricky

VoIP isn't plug and play. While that PBX might have hummed along for years, don't expect the same of VoIP. And unless companies go for a standards-based system, they can't easily swap hardware.

VoIP won't simplify network management at first. It could eventually: A converged network means only one network to run instead of one for data and another for voice. But that will only happen once network management staff get skilled at managing the differences between voice and data traffic and learn how each can disturb the other.Maintaining call quality on a VoIP network is tougher than on a conventional voice network. Dropped data packets just mean a slight performance lag, but dropped packets for VoIP equal poor call quality and even dropped calls. So close monitoring is critical. Yet like data, VoIP may need to leverage a variety of servers, depending on how it's being used, and software needs regular upgrading. Network administrators should get ready for an expanded role. "With the old way, you just had an old PBX that sat in the corner and would run seemingly forever," says Michael Cappuzzo, IT manager at law firm Morgan & Finnegan. "With IP, it's a little more technical and a little more hands on, and you have to be prepared for that."

Network managers can misconfigure routers if they don't understand how to route call connections or prioritize traffic. Keeping calls online and running smoothly requires a level of quality of service to which network managers may be unaccustomed.

The biggest new skill, Industrial Developments International's Pate says, is learning how to configure an IP call manager. Pate used to hire a PBX specialist from the phone company to set up features and rules on how calls should be routed, but those now need to be configured in the call manager database. Network managers now do that job after some heavy training on the ins and outs of Cisco Call Manager, eliminating the need to call their service provider every time some feature needs to be tweaked. That gives the company more control but also adds complexity in terms of training and the job of the network manager, Pate says.

Another problem with VoIP is inflexibility with hardware. Standards are just starting to play a bigger role in VoIP under the Session Initiation Protocol, which Cisco just committed to this year. SIP was long considered immature and incomplete by major vendors, which developed their own protocols. Even though companies are embracing SIP, some still have their own flavors. And others, like Cisco, have sold mostly proprietary systems for several years. So, if they've embraced SIP, the hug will take awhile to complete. For Virgin's Fort, it brings back bad memories of the fledgling PC industry. "It's like, 'Are we writing for a Mac or are we writing for a PC?'" he says. "It's always the stuff you initially encounter when you first see a platform."

Half of survey respondents say their companies would be quicker to adopt VoIP if equipment were more interoperable, and 45% see interoperability with existing phone systems as an obstacle.Some aspects of VoIP technology do make network management easier once IT skills are updated. John Wade, CIO at St. Luke's Health System, felt like giving up at different stages of deploying VoIP. During the initial rollout 3-1/2 years ago, call quality was poor, a common complaint with many VoIP implementations. When the hospital started using wireless (Wi-Fi) IP phones, the placement and quantity of wireless access points became a complex equation that had to factor in the flow of data and voice traffic, areas of high congestion, and areas that required the highest level of reliability, like operating rooms and the intensive care unit. Today, the VoIP service is "rock solid," Wade says. "Once you get enough experience under your belt, you should be OK."

While VoIP requires, at least for a while, considerable training and more work for network managers, it doesn't necessarily require new hires. At real estate company Prudential Northwest Properties, CIO Sean McRae didn't add one staff person to manage 600 VoIP phones in more than 20 offices. The responsibility is spread out among network administrators and tech-support staff who got new training and human resources personnel who handle moving employees' VoIP lines. The centralized system lets HR do that without any technical skills--they pick up phones and plug them in somewhere else. The phone company used to charge about $50 for each move, but now it's free. VoIP security is dodgy

VoIP hasn't experienced many big security vulnerabilities. Enjoy it while it lasts. The miscreants understand market share, so when enough companies are on VoIP to make it worth their while to probe for weaknesses, they'll attack. Compared with the relatively safe neighborhood of the public switched phone network, the Internet is a "crime-ridden slum," says Gary Miliefsky, founder and CTO of NetClarity, a maker of network security appliances. "If you're going to move your phone systems to the Internet, you've got to be prepared for problems," he says.

We recently got a glimpse of this shady territory. Last month, Edwin Pena, the owner of two small Miami VoIP companies, was arrested for an alleged $1 million scam. Authorities charge that Pena hacked into third-party VoIP services and routed his customers' calls over their lines, allowing him to collect fees from customers without paying fees to network providers. The public case almost assuredly caught the interest of tech-savvy criminals looking for new ways to make money.

"This was the first major VoIP threat, and it led to a very large payout," says Dan Ingevaldson, director of technology strategy for vendor Internet Security Systems. "Because VoIP protocols are very open, there's a lot of potential for mischief."Other threats remain mostly theoretical. In IP phone environments, an attacker could use the open source Ethereal network protocol analyzer program to capture tcpdump network output files and then use the open source Vomit (voice over misconfigured Internet telephones) program to make a .wav file that includes VoIP phone conversations, NetClarity's Miliefsky contends. In other words, there's an established way for hackers to surreptitiously capture and listen to private VoIP calls.

Some general network security practices will go a long way toward improving VoIP security, Ingevaldson says. A company's network can be broken down into virtual LANs, including one for VoIP, so traffic can more easily be monitored and voice traffic given extra security.

Most companies aren't buying VoIP-specific security. Only 12% of the business VoIP users we surveyed have implemented technologies such as VoIP-enabled firewalls.

Moraine Valley Community College in Palos Hills, Ill., which has about 700 IP phones, uses Cisco behavioral analysis appliances to monitor for abnormalities in voice-data packets that run over the network, and it has set up an intrusion-detection system tuned to VoIP traffic, CIO Jack Leifel says. Beyond that, the college makes it a point to apply patches to all its software, including its VoIP systems, in a timely manner and has split VoIP traffic from conventional data traffic using a virtual LAN. "We only run this internally, so we don't have a lot of concerns about external threats," says Sue Gray, Moraine's information security manager.

Nine out of 10 survey respondents say security is a concern when implementing VoIP, with 35% citing it as the biggest obstacle to adoption. Still, 72% have adopted VoIP or plan to, and only a small percentage are taking extra security precautions. The bottom line: Companies are confident in their current level of security, or they're just hoping to avoid serious attacks.They could be running on borrowed time. Network administrators have for years been battling denial-of-service attacks, spam, and phishing, and VoIP introduces a whole new target for these and other threats. Imagine fraudsters hacking in and manipulating the caller-ID phone number that appears on your phone and then calling you, claiming to be from your bank and needing to confirm account details. Or one of your competitors could do something similar to your customers, claiming to be from your business. You can see how phishing scams that worked in e-mail could be applied to VoIP.

VoIP attackers also could flood networks with bogus voice mail messages. Spam sent over an Internet telephone--"spit" in VoIP parlance--can be sent en masse to every user and shut down the system, much the way a denial-of-service attack works on data networks. That's not all. Attackers could create fake voice mail messages and disguise the origin or insert false words into actual voice messages, potentially changing their meaning.

So far, IT managers are a step ahead of the threats. Franklin W. Olin College's voice and data network traffic resides behind layers of firewalls, packet shapers, and antivirus gateways, so CIO Joanne Kossuth isn't losing any sleep over emerging VoIP threats to her 500 IP phones. "If you update your firmware, implement the latest software patches, and hardness-test your networking devices, VoIP is just another service," she says.

Another key security measure is to limit what users can do to their IP telephony software. Software phones now have downloadable ring tones, similar to those used with cell phones. "You have to be careful about what you let your users download and make sure your virus definitions are up to date," Kossuth says.

One thing's for sure: VoIP is bringing new threats, and it's going to require new ways of thinking about security.Cheap calls are just the startSixty-six percent of survey respondents say one reason they're implementing VoIP is to cut call costs, making it the most cited reason. But the VoIP handset and network that used to provide simple access with rudimentary interactivity is now much more than a phone system: It's a computer in its own right. That power makes it possible to bring several forms of communication together into one interface. In the hands of the right user, that means better communication and collaboration.

This ability to provide a platform for one-stop communications is among the top reasons for implementing VoIP, cited by 41% of survey respondents using or planning to use VoIP. Some 57% of respondents are interested in pursuing unified voice, data sharing, e-mail, and/or conferencing in the next year, and 54% want unified messaging. At the same time, VoIP enables companies to introduce any number of novel applications.

When Virgin Entertainment North America implemented VoIP in August, one of the features that came with the system was unified messaging, the ability to integrate voice mail into the company's e-mail system. But when Fort sold Virgin Entertainment CEO Simon Wright on VoIP, his pitch was about cost savings; unified messaging never entered the discussion. Imagine Wright's surprise when one day he saw his voice mail popping up in his e-mail in-box. He shot off an inquiry as to whether it cost extra. It didn't. Two weeks in, he was hooked on the ability to check all of his messages from one place. So when Wright stopped Fort in the hallway one day, it was to tell him that installing the new VoIP system was probably the best thing he'd done since joining the company. Virgin now is looking at ways it can meld VoIP with other communications platforms to improve employee collaboration.

Fort's experience is common: Executives won't pay for this feature, but they end up loving it. It lets them scan voice messages even from the road and pick up only the ones they know they need to follow up on--rather than listening to dozens of messages on the chance that an important customer left one.

The Food and Drug Administration, busy consolidating most of its workforce onto one Maryland campus, has taken the unified communications leap. The agency jumped into the project with promises of increased collaboration among the 18,000 employees and 15 buildings on the site and is banking on IP videoconferencing.Some scientists and researchers already have access to Cisco's IP Communicator unified communications app at their desktops, letting those working on projects in buildings across campus, or even across the country, collaborate over integrated voice, video, and data. That means a scientist can show and explain lab procedures for analyzing drugs to a colleague or send procedure results via text or data, all simultaneously through the same interface."Going beyond the phone-just-as-a-phone is really key," deputy CIO Glenn Rodgers says.

Another tool is presence awareness--the ability to transmit one's availability and willingness to communicate.

Once installed, though, companies are bound to find more innovative uses for VoIP. At law firm Morgan & Finnegan, phone billing that used to require handwritten reports now is automatic and more accurate. As soon as a call is made, an attorney enters into the VoIP phone a "client matter" code, and billing begins.

MTM Luxury Lodging's high-end Hotel 1000 in Seattle offers three IP phones in every one of 80 guest rooms and 47 IP phones in luxury residences atop the hotel. "They're programmable, which is the beauty of it," executive VP Jim Simkins says. "They can display the day's lunch special. We can have them working as a virtual concierge." How programmable? When calling for his car, a Hotel 1000 guest pushes a button from his in-room VoIP phone that rings the valet desk and instantly tells it where the guest's car is located.

It's understandable that IT pros aren't trying to sell VoIP based on these features, which don't have the hard ROI of lower phone bills. Especially at the beginning of deployments, companies should balance installation costs and adjusting to a new system with feature upgrades. For features like unified communications, most vendors aren't yet offering complete systems that integrate easily and intuitively with the rest of the phone system. So basing a deployment on them is high risk.But it's ultimately what's going to make VoIP pay.

With Larry Greenemeier