ttacker may take control of a ser- vice's e-mail account and send, on behalf of this service, an e-mail asking the user to change his password through a designated link. This link may prompt to a malicious web site that captures the passwords. This specific scenario may also occur in a SIP environment where the legiti- mate user is prompted to submit his credentials to a fake web site that imper- sonates the official web site of the service provider. This is an issue of major importance since nowadays many SIP providers offer accounting and billing services through web interfaces. 18.4 SIP Security Requirements The identification of the security requirements for each of the offered ser- vices should be one of the main concerns of the service providers. During the design and implementation phases it is necessary to employ security measures that satisfy the requirements set and thus ending up with secure and robust systems. In general, security requirements can be classified into three cate- gories: (a) confidentiality, (b) integrity, and (c) availability [21]. However, in the case of SIP-based VoIP services, this categorization must be extended to also include authenticity (this is clearly demonstrated in Table 18.1 by looking at the "security properties" violated in case of a successful attack). In order to avoid misinterpretation and/or confusion, it is necessary to explicitly define the aforementioned security requirements in the framework of a SIP domain. 18.4.1 SIP Security Requirement 1: Confidentiality Confidentiality can be defined as a data hiding mechanism which ensures that only authorized entities [21] can access (read) the data. In this context, confidentiality services in SIP should guarantee that only authorized entities (proxies, registrar, redirect, end-user) have access to signaling data. C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security 18.4.2 SIP Security Requirement 2: Integrity Integrity services provide assurance that only authorized entities can modify