understanding and managing the technology risks of adoption

ADVISORY

Voice over IP – Decipher and decideUnderstanding and managing the technologyrisks of adoption

INFORMATION RISK MANAGEMENT

If you only have time to read one page:

Context

• Voice over Internet Protocol (VoIP) and Internet Protocol (IP)Telephony are less than a decade old, replacing traditionaltelephone networks and overturning a century-old convention.

• There is a distinct lack of long-term implementation experiencesfrom which to obtain precedents for VoIP and IP Telephony.

• Implementation of VoIP and IP Telephony must be driven by theorganisation's business strategy, not technology imperatives.

• Although the desire for cost savings and efficiencies is drivingmost VoIP and IP Telephony implementations, the savings are notalways as substantial as anticipated.

• Business expansion and 'future-proofing' are additional and morecompelling driving factors.

Risks

• With VoIP, voice traffic becomes data and is therefore exposed toconfidentiality, integrity and availability threats.

• VoIP and IP Telephony implementations carry the risk of any majorIT project - inadequate benefits realisation, misalignment withstrategic objectives and cost overruns.

• IT management, operational and technical controls are essential inmanaging VoIP and IP Telephony-related risks.

The information contained herein is of a general nature and is not intended to address thecircumstances of any particular individual or entity. Although we endeavour to provide accurate andtimely information, there can be no guarantee that such information is accurate as of the date it isreceived or that it will continue to be accurate in the future. No one should act on such informationwithout appropriate professional advice after a thorough examination of the particular situation.

The views and opinions expressed herein are those of the authors and do not necessarily representthe views and opinions of KPMG International.

Introduction 2

Defined and differentiated 4

Context 6

Consider the risks 9

Next steps 16

Glossary of terms 18

Contact us 19

Contents

VoIP and IP Telephony are revolutionising the way businesses communicate. These

technologies are providing capabilities for additional business services, enhanced

productivity and competitive advantage, while offering streamlined customer service.

In the Asia Pacific region alone, industry estimates suggest that within the next few

years, VoIP could represent more than 80 percent of business telephony.

There is no shortage of expert groups, emerging service providers and press coverage

devoted to promoting the benefits of VoIP and IP Telephony. For many organisations,

questions remain unresolved on such issues as: the business benefits; the technology;

the drivers for change; the costs; maturity of the market; and the right time to adopt.

A question many organisations are not contemplating is 'what is the impact on my

risk profile?'.

An increasing number of organisations are considering the potential of implementing

these technologies. In the future, we will see a maturing market for VoIP and IP

Telephony as the business applications develop, and both drivers and business

imperatives become clearer. There will be more reasons to adopt the technologies and

in many cases it will be a competitive necessity.

The information presented in this paper will provide you with guidance when

contemplating the implementation of VoIP and IP Telephony for your organisation.

Egidio Zarrella

Global and Asia Pacific Partner in Charge

Information Risk Management

KPMG in Australia

Introduction

Risks are inevitable in the early phases of adoption of any new or upcoming

technology, largely due to limited precedents or past experiences. As the technologies

mature and organisations become more dependent on them, certain risks including

security will increase as vulnerabilities and opportunities for misuse are identified.

The risks associated with adopting VoIP and IP Telephony require appropriate

consideration to present a sound business decision prior to implementation. That is,

these technologies must be aligned with the organisation's strategic business plan.

Applying measures to minimise the risks of implementation will facilitate the

realisation of potential benefits.

Regulatory and shareholder expectations are driving governance principles in the

Asia Pacific region. This is compelling organisations to comprehensively consider

their risks, particularly those related to IT.

The security and associated risks with the implementation of VoIP and IP Telephony

must figure strongly in a well-structured business case for adoption. In an

unforgiving market, the consequences of a major security incident can be substantial

in terms of business interruptions, loss of customer confidence or cost through fraud

or missed opportunities.

Peter McNally

Asia Pacific Leader

Security, Privacy and Continuity


KPMG in Australia

4 Voice over IP - Dec ipher and dec ide

When considering VoIP and IP Telephony, it is fittingto acknowledge their potential to overturn theexpectations of more than 100 years of traditionaltelephone communication.

Before adopting new technologies, a clear understanding of the differences between

existing and potential telephony options is essential. Here, we define and differentiate

between traditional and available technologies.

Defined and differentiated

Traditional

Circuit switched

Over a century old

Third generation technology1

Wide user base

Well understood

Requires specialised knowledge

to maintain

Proven quality of service

VoIP/IP Telephony

Packet switched

Less than a decade old

First generation technology

Expanding user base

No long-term experiences

Uses widely understood IT

management concepts

Potential quality of service issues

Traditional voice networksPublic Switched Telephone Networks (PSTN) and PABXs are the traditional circuit-

switched voice infrastructure dedicated to providing a high level of reliability and

quality of service. Building, maintaining and operating these networks incurs

significant infrastructure cost, in addition to specific carrier reliance for the provision

of PSTN services.

1 Manual exchanges, automatic exchanges and digital exchanges

Voice over IP - Dec ipher and dec ide 5

Available technologiesThe wide adoption of IP has fostered the acceptance and reduced the cost of alternative

communication methods, including video conferencing and instant messaging. It is also

revolutionising how voice services are delivered through the introduction of VoIP and IP

Telephony applications. It is important to differentiate the two:

• VoIP is the practice of encoding spoken words into digitised packets (data segments)

and transporting them over data network connections (packet switched)

• IP Telephony applications refers to the applications that utilise VoIP. These can

include the simple applications that facilitate the making of a telephone call, through

to integrated applications with customer relationship management systems (CRM).


The driversBusiness benefits can be achieved from the adoption of VoIP and IP Telephony if the

decision to implement is business driven rather than technology driven. Project

success is dependent on having a clear understanding of the business needs and

strategic organisational goals that can be satisfied by new IP Telephony applications.

Since the commercial availability of VoIP, cost reduction has been the major driver.

Using data lines instead of the PSTN enables toll-bypass between an organisation’s

sites. However, many organisations have been able to postpone the implementation

of VoIP by negotiating volume discounts on their traditional telephone service.

In addition to toll-bypass, there are many cases of cost savings being demonstrated

by factors such as: reduced maintenance; reduction in the number of PSTN access

points; standardised infrastructure; and simplified administration. For most large

organisations, however, these cost savings alone will not provide a compelling

argument for adoption compared to the risks of change and implementation.

For organisations considering the change, potential cost savings need to be balanced

against:

• Associated costs of replacing or updating data network infrastructure including

servers, switches, routers and cabling (especially older cabling installations)

• Extra bandwidth required (Local Area Network (LAN), Wide Area Network

(WAN), internet)

• Additional devices to be managed in its data network (such as handsets).

Real business benefits can be achieved when the organisation can identify new

service offerings, new channels or improvements in customer service that might

otherwise not be possible. In anticipation of ‘killer applications’ entering the market,

some organisations are implementing VoIP as a means to future-proof their telephony

infrastructure.

With maturity of the applications, the drivers for VoIP and IP Telephony will become

clearer and finding a compelling business case will probably be as easy as justifying

a corporate website today.

“To date, almost all VoIPinvestments were strictly for toll-bypass cost savings.While this still drives mostinvestments, we are seeingmore business justification from other benefits,” says Sage Research PresidentKathryn Korostoff2.

A Japanese financial institutionincurred higher than budgetedcosts after conducting a pilotimplementation of thetechnology at one of its sites. The additional costsrevolved around additionalbandwidth, handsets andupgrading cabling.

2 Intelligent Asia, http://www.intelligentasia.com/ieasiaViewArt.cfm?Artid=21631&catid=5&subcat=55, 16/08/04

Context


Some of the other common drivers today are:

• Improved productivity enabled by integrated collaboration tools

• Standardisation across the organisation

• Consolidation of operational support and functions. For example, the functions of

end-user management are simplified to mostly keyboard tasks.

VoIP and IP Telephony make the implementation of complex features easier and

more flexible than traditional telephony. Examples of some features are outlined in

the table below.

VoIP and IP Telephonyimplementation must be linkedto clear business benefits.

Lastminute.com is using an IPTelephony-based application(VoiceXML) in the UnitedKingdom to process thousandsof accommodation bookingswith no human interaction. Thisapplication allows real-timeinformation to becommunicated to callers bytelephone, based on individualcustomer queries3.

3 Communications Convergence,http://www.cconvergence.com/article/CTM20020804S0008, 04/08/02

Features in practice

Unified messaging

Mobility

Integration with CRM

Integration with Enterprise

Resource Planning (ERP)

systems

Description

Integration of several communication modes

(such as email, telephone, instant messaging,

fax) to enable sending and receiving from a

single interface

IP Telephony allows organisations to further

harness Virtual Private Network (VPN) technology

to improve workforce mobility, as phone numbers

follow staff wherever they log in

VoIP allows a caller to be recognised by their

number and have the information on-screen in

the call centre before the call is answered. Whilst

this technology is currently available with

traditional PABX, it is easier with VoIP

Integration of IP handsets with Enterprise

Resource Planning (ERP) applications (such as

SAP) for improved billing and call monitoring.

This enables organisations to internally charge

departments for phone usage

Mr Tim Gadsby, Manager Telecommunications & Security Servicesat Australia’s Challenger Financial Services, stated that the coredriver of the VoIP project was the requirement of a flexibletelephony system over a number of sites to meet the physicalexpansion of the business.


The marketThe market for VoIP and IP Telephony is being led by the U.S. The Asia Pacific

region is also demonstrating aggressive adoption.

Current market activity includes the following developments:

• Enterprise IP phone shipments in Japan are expected to grow at 150-250 percent

per year from 2004 to 20075

• Implementation is usually a phased approach and mainly based around pilot

programmes at one site

• Based on discussions with a number of clients, many organisations in the Asia

Pacific region only consider implementing VoIP when traditional PABX systems

have reached their end-of-life

• The rapid uptake of broadband in countries like Korea6 provides an attractive

framework for the deployment of VoIP and IP Telephony direct to consumers.

4 New Voice over Internet technology, http://www.voipbox.de/archive.php?blogid=1=2004=07<http://www.voipbox.de/archive.php?blogid=1&y=2004&m=07> , 31/07/04

5 Enterprise VoIP in Japan Accelerates with Broadcom's IP Phone Chips,http://www.embeddedstar.com/press/content/2003/9/embedded10346.html, 6/08/04

6 Leaders or Laggards - Australia's Broadband Future, KPMG, 2004

“A few years ago they said itwas a toy. Now, the biggestcompanies in the U.S. areadopting the technology.”4

Mr Fu Chi-chung, Vice President,

Seednet (Internet Service

Provider), Taiwan.


There is extensive information available fromnumerous sources including vendors, researchersand the media, regarding the benefits of VoIP and IP Telephony. However, there is a distinct absence of information detailing the risks and associated riskmanagement practices. As a result, organisations’preparedness for these new technologies isinadequate.

Without adequate risk management, VoIP implementations can result in reputation

damage, a negative impact on customer service or affect the bottom line. The

overriding risk is that the implementation of VoIP and IP Telephony will not meet the

requirements of the business. Organisations need to understand the impacts that these

technologies have on their business processes, and then match them to the business

strategy.

Discussions with our member firms’ clients and recent project examples of VoIP

project failure demonstrate that organisations require a greater focus on risk

management as the level of technology sophistication increases over time (refer to

diagram below).

Consider the risks

Risk management of projects such as VoIP is crucialconsidering there are no long-term experiences to draw upon.

$

Technologysophistication

Capital expenditureOperating costs

Risk management requirements

Technology sophistication over time


We believe that the risks of VoIP and IP Telephony implementation can be broadly

categorised into two core areas:

• Project risks

• Security risks.

Project risksThe implementation of VoIP and IP Telephony may be organisation-wide or in key

lines of business (such as the customer service call centre) where the most immediate

benefits might be realised. In either case, they are likely to represent a dramatic

change to critical organisational infrastructure and therefore, require strong project

management principles to be followed. Examples of implementation risks and the

potential effects are outlined in the table below.

Inherent risk

Unclear business case

Unclear roles and

responsibilities of involved

parties (eg. vendor, integrator,

organisation, outsourcer)

Inappropriate vendor

selection

Inappropriate system

selection

Failure to accurately evaluate

bandwidth and other capacity

requirements

Lack of internal resources

with the necessary skill sets

Potential effect

Unrealised benefits (eg. technology goals

achieved, but no business advantage)

Lack of accountability and key tasks

incomplete

Unable to meet project needs (eg.

hardware lacks required functionality)

Unable to meet business requirements

(eg. applications do not fully integrate with

VoIP infrastructure)

Unexpected cost increases (eg. additional

bandwidth required or cabling upgrades)

Degraded project quality and/or delays (eg.

unable to effectively negotiate with vendor

or integrator to achieve stated security and

other business objectives)

Example controls7

Clear cost/benefit and business impact

analyses, project metrics and appropriate

project monitoring controls

Clear definition of roles and responsibilities

(the importance of this is magnified when a

business function is outsourced)

Vendor selection due diligence

Definition and matching of business

requirements

Definition of business requirements

Understanding of business strategies and

direction

Technical understanding of network,

applications and devices

Skills inventory

Appropriate training

Use of appropriate external resources

7 These controls are examples only. Control design would require detailed analysis based on specific network characteristics and business needs. Controls cannot be totally effective in all circumstances and some residualrisks might remain.


A retailer based in Singapore has recently implemented VoIPwithin one of its main outlets. During the planning phase, theproject team underestimated the volume of traffic that wouldtraverse the network. Due to congestion, it was necessary toredesign and upgrade the network infrastructure, which had cost implications that had not been factored into the originalproject plan.

Part of project risk management requires consideration of the cultural impact to the

organisation. Any technology implementation will affect end users.

Some of the cultural risks associated with the uptake of VoIP and IP

Telephony include:

• Changing telephony (a key working tool) without consultation and end user

buy-in could have consequences such as rejection of new features or functionality

• In many organisations, voice and data communications are managed by separate

groups. For example, PPL Services Corporation (a U.S. energy utility company),

identified the merging of staff and duties as an issue and started planning a

restructure prior to implementation8

• Ownership of the IP Telephony service, with one party looking after networking

and another looking after application servers. There may be a lack of clarity over

key roles and responsibilities, which leads to inefficiencies.

Widespread dissatisfaction wasexperienced when a Philippines-based hospitality companyreplaced its handsets withphone applications running onindividual computers. To make aphone call, users were requiredto have their computerswitched on and be logged ontothe network. Consequently,mobile phone usage increased.

8 Computerworld, http://www.computerworld.com/networkingtopics/networking/voip/story/0,10801,90808,00.html, 18/08/04

Security risksThe introduction of VoIP means that voice traffic needs to be treated in the same

context as data for security purposes since it will share a common medium.

The increased technical complexity of integrating voice and data into one network

further increases an organisation’s dependence on network availability. Many

organisations fail to recognise that with this increased technical complexity comes

increased security and availability risks that must be appropriately assessed, and the

necessary risk management measures applied.

As hardware PABX systems are replaced with computers and network hardware

running common operating systems, networks will become increasingly vulnerable

to common threats such as viruses and denial of service (DoS) attacks. Exposures

that were experienced with traditional systems are more prevalent with VoIP and IP

Telephony, as networking awareness is more widespread. Each entry point to a

network is a potential point of attack and therefore risk management is essential. This

logically includes every IP-enabled telephone handset or other IP Telephony device.

Hacking techniques for VoIP networks are widely published (refer to the table

below).


Hacking technique

Call redirection

Use of inactive handsets as listening

devices

Use of IT network tools to intercept

data packets

Reprogramming handset

Potential outcome

All calls diverted to a premium cost

service such as '1900' services in

Australia or the U.S.

Eavesdropping on sensitive

discussions eg. Board meetings

Eavesdropping or retransmission of

telephone conversations

Network flooded with meaningless

traffic

A disgruntled employee of a multi-national insurancecompany used a recentlyinstalled VoIP/IP Telephonysystem to eavesdrop on aBoard meeting. The employeeintercepted confidentialinformation that wassubsequently leaked to the press.


9 These controls are examples only. Control design would require detailed analysis based on specific network characteristics and business needs. Controls cannot be totally effective in all circumstances and some residualrisks might remain.

The following table summarises VoIP and IP Telephony security risks and controls

based upon the three tenets of security - confidentiality, integrity and availability.

Security characteristic

Confidentiality

Integrity

Availability

Definition

Assurance that only the

intended recipient receives

the communication

Assurance that the

communication is unaltered

Assurance that the VoIP

communication medium is

efficient and effective

Inherent risk

Eavesdropping through

interception or duplication

Packet loss, insertion or

alteration

Lack of capacity

Inadequate system

management

Denial of service attacks

Viruses and other malicious

software

Increased number of

attack points

Example controls9

VoIP encryption

Use of strong authentication

and access controls

Confidentiality controls plus:

Quality of service protocols

Integrity controls plus:

Gateway security controls

and configuration

Segmentation of voice

and data components

Anti-virus software

Hardware redundancy,

Service Level Agreement

(SLA) with vendor

Endpoint operating

system controls


A potential implication of notencrypting is having a user'sphone banking details (accountnumber or pin tones)intercepted across the network.

A Korean utilities companyimplemented encryption overits entire VoIP network acrossthe country. This wasundertaken to mitigate againstintegrity and confidentialitythreats.

ConfidentialityTraditional telephony operating over a dedicated PSTN network does not require

encryption. A confidentiality breach in the traditional network generally requires

physical connection to the network to eavesdrop on conversations from selected

lines. This can be complex in large networks.

With VoIP, the nature of the underlying protocol makes it relatively easy to identify

calls from a particular location from anywhere in the direct network. Tools to enable

eavesdropping are widely available and encryption of voice traffic is the essential

means to combat this. In the event that voice traffic is carried over an external

network (such as the internet) eavesdropping would be a risk. An example of the

potential implication of not encrypting is having a user's phone banking details

(account number or pin tones) intercepted across the network.

Encryption can minimise the threat of VoIP eavesdropping, however, a risk

assessment must be made based on the sensitivity of calls and the level of control

over the network infrastructure. That is, use of Private IP networks as opposed to the

public internet. A dedicated VoIP VPN can be used to encrypt data over disparate

locations, however, if encryption is not performed between the appropriate endpoints

(for example, between gateways instead of between handsets), the encryption might

not be effective.

Another consideration is the risk that infrastructure might not be compliant with the requirements of future privacy ortelecommunications legislation, particularly where there aremultiple jurisdictions involved.

IntegrityVoIP packets travel independently of one another, and like data packets are

vulnerable to loss. This does not generally pose a problem for data packets, however,

this may have implications for VoIP communication. Out-of-sequence or lost data

packets can result in degraded voice quality.

Strategies to minimise this data loss include jitter control, sending duplicate data or

concealing lost data. Jitter occurs where the timing between VoIP traffic varies. Jitter

control holds VoIP packets in memory until the slowest packets arrive and then

transmits them in the correct sequence10. Correct sequencing of voice packets will be

aided by prioritising voice data over conventional data on the network.

The risk of insertion and alteration of packets can be reduced by the adoption ofencryption. Without knowledge of the encryption key (ordinarily kept confidential),encryption makes it very difficult for a packet to be altered, or for a rogue packet to be inserted.10 Achieving voice quality in packet networks, Sandeep Sharma, Express Computer, 11/11/02


AvailabilityWith voice and data now sharing the same medium, the risks associated with

availability increase and require appropriate assessment by management. Voice is

a critical real-time application for every organisation, and quality cannot be

compromised. Threats to availability range from small errors which affect voice

quality through to system outages affecting part or all of the network.

One concept that has been used to deal with availability is quality of service (QoS).

VoIP requires a different approach to the way in which information is delivered

compared to traditional data networks. This is because historically, IP was designed

to deliver data on a 'best effort' basis, whereas, VoIP must deliver voice on a much

more reliable, low-latency basis.

VoIP availability is complicated further due to the links between local and wide area

networks over which the data must transfer. To combat these issues, a level of

intelligence must be built into the network to give voice priority over regular data.

Therefore, QoS protocols have been designed to provide for some level of control

over latency and delivery issues. Furthermore, as IP Telephony applications are

implemented, the bandwidth availability will increase and this will require

appropriate planning. Failure to accurately predict or manage overall network

capacity needs can lead to service degradation and outages.

For health and safety reasons, a manufacturing company in Hong Kong installed a small number of ordinary phone lines foremergency purposes in the event of a power or network outagewhich would affect VoIP.

DoS attacks can occur when a network or device is overloaded with meaningless

traffic or sent a specific command that will disable it, rendering the network

unavailable. One example of a DoS attack is repeatedly sending a hang-up command

to each handset, which is difficult to detect or prevent11. As voice is sharing a

network with traditional data, it is susceptible to the DoS techniques that have been

applied against data networks for many years. A malfunctioning or manipulated

handset has the ability to cause a DoS attack by flooding the network with traffic.

VoIP is also susceptible to viruses and therefore requires an appropriate management

framework. Depending on the telephone handset operating system, handsets might

also require virus protection.

11 Lurking threats to VoIP, Adam Turner, The Age, 20/07/04

Service quality and availabilityare now your problem.


For organisations to have confidence that the introduction of VoIP and IP Telephony

will not increase their risk profile, they must give consideration to project and

security risks.

There are a number of management, operational and technical controls to consider.

These are summarised in the diagram below.

From the initial decision to implement VoIP and IP Telephony, organisations must

assess a number of critical areas including a clear understanding of:

• Business benefits and opportunities

• Appropriate processes to identify technologies, suppliers and implementation

requirements

• Ongoing maintenance and operational requirements

• Security and availability risks relative to the organisation's risk profile and how

these will be dealt with.

As with the adoption of all new technology, the benefits are widely discussed in the

market, however the risks to the organisation are often overlooked. Assessment of the

critical areas, in conjunction with implementation of the appropriate controls, will

ultimately shape the outcome of the project and VoIP's ongoing success. It is

important not to lose sight of the overall objective of the project and ensure that the

technology supports the strategic directions of the organisation.

Next steps

Key IT

management controls

Key IT

technical controls

Key IT

operational controls • Perform cost-benefit analysis • Perform benchmarking of technologies against successful implementation projects at other organisations • Perform formal product/system selection of potential solutions • Implement pilot project • Implement formal project risk management controls • Integrate VoIP and IP Telephony into existing security policy • End user acceptance

• Configuration management (inc. asset management) • IT change management • Security control design • Include VoIP and IP Telephony requirements as part of business continuity and disaster recovery planning • Physical security • Capacity and performance planning • Effective risk management

• Encryption • Network segmentation • Gateway security configuration • High availability network architecture • Authentication • Periodic security testing and assessment

Effective

risk

management


Key elements of VoIP and IP Telephony implementations

Define needs

Assess risks

Manage change

Plan the project

Develop controls

Understand your organisation's needs and businessstrategies to develop a business case with clear andmeasurable success criteria

Conduct a risk assessment based on your unique businessfeatures, including the Business Continuity Managementimplications

Consider the impact on your workforce, work practices and organisation

Define a technology implementation plan considering pilotsand phased introduction

Implement key management, operational and technical controls


pull-out quotes

Glossary of terms

Customer Relationship

Management (CRM)

Denial of service (DoS)

Enterprise Resource

Planning (ERP)

Extensible Markup

Language (XML)

IP Telephony application

Internet Protocol (IP)

Killer application

Local Area Network (LAN)

Packet

Private Automated Branch

Exchange (PABX)

Publicly Switched Telephone

Network (PSTN)

Quality of service (QoS)

Router

Service Level Agreement (SLA)

Switch

Toll-bypass

Toll expenses

Virtual Private Network (VPN)

Voice over IP (VoIP)

Wide Area Network (WAN)

VoiceXML

Methodologies and software that help an organisation manage customer relationships

Incident in which a user or organisation is deprived of the services or a resource they would

normally expect to have

A system that permits organisations to manage resources across the business

A new technology for web applications, which allows for simple data interchange between

disparate systems

Application that uses VoIP to provide enhanced functions

The method by which data is sent from one device to another (eg. one computer to another

on the internet) where each device has at least one IP address that uniquely identifies it from

all other devices on the network

The use of an innovative technology in business that disrupts traditional business models and

undermines customer relationships, distribution networks, competitor behaviour and

economies of scale and size

A group of computers and associated devices that share a common communications line or

wireless link and typically share the resources of a single processor or server within a small

geographic area

A unit of data that is routed between an origin and a destination on the internet or any other

packet switched network

An automatic telephone switching system within a private organisation. Sometimes known

as a PBX

The world's collection of interconnected voice-oriented public telephone networks, both

commercial and government-owned, also referred to as the Plain Old Telephone System

(POTS)

The use of certain technologies to obtain a high degree of quality for VoIP systems

Device or software in a computer that determines the next network point to which a packet

should be forwarded on its way to its destination

An agreement between a customer and a service provider that guarantees an agreed level of

service delivery

Device that channels incoming data from any number of multiple input ports to the specific

output port that will take the data toward its intended destination

Avoidance of telephone company long distance telephone charges over the Public Switched

Telephone Network (PSTN)

The costs associated with making telephone calls over the PSTN

Method of using a telecommunication infrastructure, such as the internet, to provide remote

offices or individual users with secure access to their organisation's network

The delivery of voice services (such as local and international telephone calls) over a data

network using the Internet Protocol

Geographically dispersed telecommunications network

Use of eXtensible Markup Language to enable the conversion of text to spoken words


Contact us

Egidio Zarrella

Global and Asia Pacific Partner in Charge


KPMG in Australia

+61 2 9335 7590

[email protected]

Peter McNally

Asia Pacific Leader

Security, Privacy and Continuity


KPMG in Australia

+61 2 9335 7987

[email protected]

Sean Choi

Asia Pacific Head

Information, Communications & Entertainment

KPMG in Korea

+82 2 2112 0300

[email protected]

For further information on the services offered by KPMG's Information Risk

Management or Information, Communications & Entertainment practices, please

contact:


KPMG’s Information Risk ManagementRobert Goldberg

+61 2 9335 7728

[email protected]

John Barnes

+852 2978 8248

[email protected]

Iwan Atmawidjaja

+62 21 574 2333

[email protected]

Hiromi Iwashita

+81 3 3266 7617

[email protected]

Chang Soo Lee

+82 2 2112 0600

[email protected]

Huckhai Lim

+60 3 2095 3388

[email protected]

Graeme Sinclair

+64 4 802 1218

[email protected]

Jorge Ma. S. Sanagustin

+63 2 885 7000

[email protected]

Ho Wah Lee

+65 6213 2563

[email protected]

Richard Chen

+886 2 2715 9813

[email protected]

Chainarong Kaeowaranonchai

+66 2 677 2000

[email protected]

KPMG’s Information, Communications & EntertainmentBruce Phillips

+61 2 9335 8200

[email protected]

David Collins

+852 2826 7204

[email protected]

Istata Siddharta

+62 21 574 2333

[email protected]

Hideki Amano

+81 3 3266 7002

[email protected]

Sean Choi

+82 2 2112 0300

[email protected]

Nicholas Crist

+60 3 2095 3388

[email protected]

Ross Buckley

+64 4 802 1203

[email protected]

Jose Valencia

+63 2 885 7000

[email protected]

David Leaver

+65 6213 2538

[email protected]

Alfred Wei

+886 3 5782479

[email protected]

Somboon Supasiripinyo

+66 2 677 2000

[email protected]

Location

Australia

China/Hong Kong

Indonesia

Japan

Korea

Malaysia

New Zealand

Philippines

Singapore

Taiwan

Thailand

Leaders or Laggards? Australia's Broadband Future

Security Strategies - Adopting a strategic approach to security management

Asia Pacific Business Continuity Management Benchmarking Survey

Wireless Networking - Issues to consider

International Programme Management Survey

KPMG thought leadership publications

kpmg.com

© 2004 KPMG International. KPMGInternational is a Swiss cooperative of whichall KPMG firms are members. KPMGInternational provides no services to clients.Each member firm is a separate andindependent legal entity and each describesitself as such. All rights reserved. Printed inAustralia.

KPMG International is a Swiss cooperative that serves as a coordinating entity for a network ofindependent member firms. KPMG International provides no audit or other client services. Suchservices are provided solely by member firms in their respective geographic areas. KPMGInternational and its member firms are legally distinct and separate entities. They are not and nothingcontained herein shall be construed to place these entities in the relationship of parents, subsidiaries,agents, partners, or joint venturers. No member firm has any authority (actual, apparent, implied orotherwise) to obligate or bind KPMG International or any other member firm in any mannerwhatsoever, or vice versa.

understanding and managing the technology risks of adoption

Documents