e system default dial-peer 0 is used enabling all calls; to avoid this, specify explicit incoming dial-peers for valid call flows and deny all other calls. Use explicit destination-patterns on dial-peers (try to avoid using .T if you can) to block out disallowed off-net call destinations. Use translation rules to ensure only valid calling/called numbers are allowed. This allows you to add access codes dialing to gain entry to certain destinations (for example, international destinations). Your employees know these access codes, but off-net hackers do not. Use Tool Command Language (Tcl) or Voice Extensible Markup Language (VoiceXML) scripts to do database lookups or require PINs or authorization codes 124 SIP Trunking for additional validity checks to allow/deny call flows. This method protects against internal fraudulent calls. Change the SIP listening port to something other than the default of 5060. Close unused H.323 or SIP ports-if your Border Element is connected purely to a SIP trunk, there is no need for the H.323 ports to be open. The Class of Restriction (COR) feature restricts call attempts based on both the in- coming and outgoing dial-peers matched by the call. Signaling and Media Encryption Another area of security to consider is the privacy of communications, that is, how to keep hackers from recording calls or hijacking them and inserting or deleting segments. Several encryption features for voice call flows mitigate these types of attacks. Separate features for protection of the signaling traffic (TCP or UDP) and the media traffic (RTP) exist. Signaling encryption can be achieved by IPsec tunnels (both TCP and UDP SIP traf- fic) or TLS (SIP TCP). You can use TLS just for authentication or also for encryption of the signaling stream. You can achieve media encryption with Secure RTP (SRTP) (RFC-3711). As the media encryption keys are exchanged in the signaling stream, there is no point in encrypting media without also encrypting the signaling. Only encrypting signaling is a valid option. None of th