i) there was AST-2011-003 which 4) did nothing to prevent.

ii) fail2ban is a useless tool for blocking bruteforce attacks which do not use REGISTER methods.

iii) point 6) is rather problematic with people using config managers like FreePBX. This is wishful thinking at its finest.

iiii) point 2) does nothing to prevent extension scanning. It is possible the patch from AST-2011-011 did fix the problem.

The biggest problem many of us have is the remote extension (not sitting on your LAN, but somewhere else out on the wide open Internet) that is at some random IP address that could change at the whim of the user’s ISP (or, if the user moves, even if only temporarily). In some cases the authentication name and the password were programmed into the phone and device before they were given/sent to the user, so there’s no way to change them, and trying to talk the user through changing them would be an exercise in frustration. One tool I have wished for is something that would at least allow geographic blocking, so that if you have a user in Minnesota and you get a connection from Nigeria purporting to be that user, you can kick them off and ban them, even if they authenticate correctly. One example of a way to do this is shown at http://michigantelephone.wordpress.com/2010/07/07/geolock-%E2%80%94-a-perl-script-for-asterisk-or-freepbx-users-to-enhance-security/ but as written it only allows limitation by country (so while you could maybe shut down the user from Nigeria, you might not be able to give the boot to a hacker from Utah), and it doesn’t update its database automatically. Also, it’s a Perl script, and I think many users find Perl a bit difficult to work with).

Finally, I’m confused by your fifth item. How do you “Allow only one or two calls at a time per SIP entity, where possible.” IS that even possible when FreePBX is used?