  Voice over IP (VoIP) is the transmission of voice and multimedia content over
Internet Protocol (IP) networks, this paper reviews models, frameworks and
auditing standards proposed to this date to manage VoIP security through a
literature review, with descriptions of both the historical and philosophical
evolution reflecting an adequate knowledge of related research. Three research
questions are raised here: RQ1. What are the requirements to be met by a model
of security audit in VoIP systems to achieve their goals? RQ2. Today, are there
additional attacks that previous works have not considered? RQ3. Which security
requirements in the VoIP systems are covered (and which are not covered) by
security frameworks? After some discussion about VoIP Protocols, Attacks on
VoIP, Information Technology (IT) audit, IT security audits, Frameworks and
auditing standards, we present a unified view of VoIP Security Requirements; as
well as considering the contributions and disadvantages of frameworks and
auditing standards toward achieving those requirements through a comparative
evaluation. It was determined that there is no security framework which
considers social engineering attacks in spite of being an important aspect to
consider in security management VoIP; also there is no specific framework that
covers all categories of security requirements for VoIP system, therefore, a
more extensive model is needed.
