I ran a VoIP server for an application. It received daily attack attempts in various formats. The only reason it never got abused was that I tightly bound it to

I ran a VoIP server for an application. It received daily attack attempts in various formats. The only reason it never got abused was that I tightly bound it to the application logic, so essentially no call outside the application could be placed. You can secure it without doing that, but it's very easy to get it wrong - there's a lot of horror stories out there. I definitely would've been pwned if I didn't write direct application code into the server from the get-go. I only learned of the various attacks over time from inspecting the logs.