Internet-connected devices, can create a door for cyber-attacks. By connecting the cameras to the internet for remote viewing, the system becomes vulnerable to potential cyber-attacks. If the security camera system is not properly secured, it can leave the system open to cyber criminals who can compromise the security of the system and potentially access sensitive information or data. The danger is particularly pronounced as the trend towards connected security camera systems continues to grow. It is important for security camera owners and operators to take appropriate steps to secure their systems against cyber threats.
Five major cyber-attack vectors for surveillance camera systems are:
Cloud-based surveillance systems may have different security requirements compared to traditional DVR/VMS/NVR systems connected to the internet, or traditional systems connected to a local network which is connected to the internet.
For cloud-based systems, security measures may include using encryption for data in transit and at rest, implementing multi-factor authentication, and regularly monitoring the system for unusual activity.
For traditional systems connected to the internet, security measures may include securing the network with firewalls and virtual private networks (VPNs), regularly updating software, and changing default passwords.
For traditional systems connected to a local network which is connected to the internet, security measures may include limiting access to the local network, regularly updating network equipment, and implementing network segmentation.
It is important to understand the specific security requirements of the surveillance camera system being used and to implement best practices accordingly to keep the system secure.
security risks exist with the web-based graphical user interface (GUI) of cameras that are commonly sold today. The issue is compounded by the fact that many cameras come with a default username and password that is readily available on the internet and some installers fail to change the password, leaving the same default password for all cameras. The statement also mentions that it is estimated that a significant portion (one in five) of web users still use easy-to-hack passwords, which increases the security vulnerability.
The top 10 most common passwords list:
Very few cameras have a way to disable the GUI, so the security vulnerability is that someone can attempt to hack into the camera via the web GUI to guess a password.
The hacker must have network access to do this, but the cameras are often on a shared network, not a physically separate network or a VLAN.
The ideal best practice is to assign a unique long non-obvious password for each camera. Such a meticulous process takes time to setup, is more difficult to administer, and is very hard to track. Therefore, many installers, unfortunately, use a single password for all of the cameras in an account.
To allow for this challenge, an acceptable best practice is:
The increasing demand for video access from remote mobile devices has created a security vulnerability by exposing the DVR, NVR, or VMS to the internet through an HTTP server. This vulnerability is dangerous because it opens the system up to numerous malicious exploits that can be used to gain access, and internet-connected machines are scanned over 10,000 times a day. The statement provides an example of a security issue that can result from this vulnerability with the Heartbleed OpenSSL exploit in 2014, which forced many manufacturers to ask users to reset their passwords
Connecting an unprotected server to the internet is not recommended, as it can pose a security risk. If it is necessary to expose the server to the internet, we suggest limiting the number of ports that are “port forwarded” and using a next-generation firewall to block incorrect protocols. we also recommend deploying an IDS/IPS for additional protection. The statement notes that cloud-based systems are typically more secure, as they do not have port forwarding, and therefore do not have any security vulnerabilities. We advise to check with an integrator or provider to verify the security measures in place for any system in use or being considered
The increasing demand for video access from remote mobile devices has created a security vulnerability by exposing the DVR, NVR, or VMS to the internet through an HTTP server. This vulnerability is dangerous because it opens the system up to numerous malicious exploits that can be used to gain access, and internet-connected machines are scanned over 10,000 times a day. The statement provides an example of a security issue that can result from this vulnerability with the Heartbleed OpenSSL exploit in 2014, which forced many manufacturers to ask users to reset their passwords
To ensure the best possible protection, it is important to assign a professional network security expert to configure a modern firewall. We emphasize the importance of having clear documentation on the firewall configuration and regularly monitoring and making any necessary changes to maintain security.
for a cloud-based solution without port forwarding, an on-site firewall configuration is not necessary. We advise speaking with an integrator or system manufacturer to confirm this, as the security measures in place may vary among different cloud-based solutions.
Mixing the cameras on a standard network without separation is a recipe for disaster.
If your security camera system is connected to your main network, you are creating a doorway for hackers to enter your main network via your surveillance system, or to enter your physical security system through your main network.
Some DVRs can even be shipped with a virus.
Ideally, place the security camera system on a physically separate network from the rest of your network.
Acceptable Best Practice:
If you are integrating with a sophisticated IT environment, it is not always possible to separate the two systems physically.
In this event, you should use a VLAN.
As with camera passwords, a weak system password can create an opportunity for cyber-attacks on the surveillance system and the network.
Unfortunately in many OS environments, the root password or the administrator password is shared among all the admins, spreading the security risk. Employee turnover, either through attrition or a change of roles can create unexpected security holes.
Set high quality long passwords for the operating system.
Additionally, establish policies and procedures for changing passwords. For example, the root admin password should be changed every time an employee with password access leaves the company or changes roles.
True cloud systems do not have separate passwords for OS access. They only have system passwords for individual accounts (see below) which are explicitly deleted when employees leave or their roles change
Unauthorized access to your security camera system leaves both the surveillance system vulnerable and network connected to it vulnerable.
Change your surveillance system passwords on a schedule. Enforce security quality with the same stringency as your company standard. Long, strong passwords are the best.
A surprising number of DVR/NVR/VMS’s use connections which are not encrypted with SSL or equivalent.
This risk would be identical to logging into a bank or doing online shopping without https. It creates password vulnerability and allows potential for privacy and eavesdropping breaches.
It is imperative that the connection be encrypted with SSL or equivalent.
Ask your vendor how they handle this. Only choose vendors who encrypt their connections.
Many cloud vendors provide connection encryption, but it is variable. Confirm with your cloud vendor how their system handles this.
In addition to insecure connections due to lack of encryption, the same privacy risks apply when the video is not encrypted when stored on the disk or in transit.
For a truly secure system, the video should be encrypted, both when it is stored on disk and when it is in transit.
Password, account deletion and encryption vulnerabilities apply doubly to mobile.
Just as when you run the application on your personal computer, ensure that you have an encrypted connection for the mobile application on the iPhone or Android to the VMS or NVR/DVR. Set high-quality passwords and do password enforcement and account deletion when staff changes.
The financial rewards for stealing company data are sufficiently high enough that intruders will also seek to access your network by directly hacking into your onsite physical equipment.
Keep secure: your cabinets; the cables; and the room where the DVR/NVR/VMS, switches and video storage servers are located. Provide secure access control to the room, including video security to monitor it. This practice not only protects your network, but prevents ‘smash and dash’ thefts at your facilities, where the recording DVR/NVR is stolen along with any other items.
Although the same principle clearly applies to a cloud-based system, there is much less on premise equipment to protect. The immediate cloud recording also protects against smash and dash theft of the on-site recording.
It is important to inquire of your integrator or vendor what general security measures they take for their cloud servers.
Video Management Software use a lot of components beyond the operating system, such as Microsoft database applications. As with the operating system itself, these components must be upgraded and secure.
Many VMS’s for example use, Microsoft Access, or libraries, as well as the software that they have written. New system vulnerabilities can be introduced if the supporting software is not kept up-to-date, including security patches.
If you are passive here, you are highly dependent on the provider sending patches for you to update the system for such vulnerabilities.
Ask your VMS vendor about their policy for keeping the components they use up-to-date and secure. Check for and install regular updates. Be proactive in monitoring the known security vulnerabilities in the industry and contact your integrator or vendor when you learn of new breaches.
It is important to make sure the VMS vendor has a team focused on this and is sending you updates regularly.
True cloud managed systems do not have software on site, so no vulnerability exists here.
However, it is very important to confirm if the system is truly ‘cloud- managed’ vs. internet-connected before making this assumption, or you risk exposure to a potential vulnerability.
Securing IP cameras over the internet is important to protect your privacy and the security of the camera’s footage. Here are some ways to secure an IP camera:
![pcard](https://secureitglobal.com/wp-content/uploads/2023/03/paypal-credit-card-logo_300x100.jpg"){kind=logo}
