Dahua’s cybersecurity approach

CCTV Handbook 2021 Cyber Security

In the AIoT era, the world is getting smarter. Everything is going to have an online ID and then connect into a vast network of IoT devices, like a laptop computer, a mobile phone, a connected thermostat or a network security camera.

Cybersecurity to watch in the AIoT era

According to a Marketsandmarkets report, IoT devices are extensively used by smart cars, smart manufacturing, connected homes and building automation solutions. However, there are currently no unified global technical standards for IoT, especially in terms of communications. This results in inefficient

data management and reduced interoperability and ultimately may cause reduced security in the IoT network. The global IoT security market is expected to grow from USD 12,5 billion in 2020 to USD 36,6 billion by 2025, at a compound annual growth rate (CAGR) of 23,9%.

Dahua Technology believes cybersecurity is of vital strategic importance in the age of AIoT. In various vertical industries, such as traffic, banking and finance, healthcare and critical infrastructure, organisations collect, process and store unprecedented amounts of data on devices like IP cameras and NVRs. A significant portion of that data can be sensitive or private information, which can be prone to cyber-attacks and the situation is getting worse. As a security solution provider, Dahua Technology continuously invests in cybersecurity and actively addresses network security issues.

Continuous investment

Committed to becoming a leader in cybersecurity and privacy protection in the global security industry, Dahua Technology has been developing cybersecurity for nearly 10 years. The company keeps investing about 10% of its annual sales revenue in R&D; every year, including cybersecurity. In addition, the company put together a professional team of nearly 100 people to focus on cybersecurity issues. With rich experience and sufficient resources, Dahua Technology promises to be positive, open, cooperative and responsible when it comes to cybersecurity.

Breaking down Dahua’s approach

Organisational structure

In order to achieve better efficiency and effectivity, Dahua operates a comprehensive system to cope with all cybersecurity-related issues. The system, led by a cybersecurity committee, also contains a cybersecurity and data protection compliance group, a cybersecurity institute and a Product Security Incident Response Team (PSIRT). The cybersecurity committee, above all departments or teams, can call on resources from the whole company, from the R&D; centre, to the legal department, supply chain, overseas business department, etc. when necessary. The cybersecurity institute is in charge of building sSDLC (secure software development lifecycle) processes and implementing them in all Dahua products.

Security development lifecycle

Dahua adopts a bunch of professional sSDLC security applications to improve product security. During the security design phase, STRIDE + Attack Tree + PIA are adapted to improve threat modelling. During the security realisation phase, OWASP (Open Web Application Security Project) top 10 and over 150 CWEs (Common Weakness Enumeration) are used to achieve static code analysis. During the security test phase, over 20 tools within seven fields are applied to complete multiple security testing processes. CompTIA PenTest+/Security+ are used to carry out professional penetration testing, while compliance to ISO 30111, ISO 290147 and MITRE are followed during vulnerability management after the products are sold.

Emergency response system

Cooperation with professionals from across the globe is a great way to improve vulnerability detection. Therefore, the Dahua Cybersecurity Centre (DHCC) was established to solve cybersecurity issues with security vulnerability reporting, announcement/notice and cybersecurity knowledge sharing with its global customer base in order to provide them with more robust and secure products and solutions.

The PSIRT is an integral part of the DHCC. Composed of professionals ranging from marketing, supply chain, service and legal representatives, PSIRT is responsible for receiving, processing and disclosing Dahua product and solution-related security vulnerabilities. Team members are on duty seven days a week and guarantee to respond to an emergency within 48 hours. End users, partners, suppliers, government agencies, industry association and independent researchers are encouraged to report potential risks or vulnerabilities to PSIRT at cybersecurity@dahuatech.com.

Personal data and privacy protection

Dahua also attaches great importance to personal data and privacy protection. Complying with applicable laws and regulations such as the EU’s General Data Protection Regulation (GDPR), the European Data Protection Board’s (EDPB) ETSI EN 303645 as well as the California Consumer Privacy Act, the company established the Personal Data & Privacy Protection Standard.

The standard stipulates that privacy protection methods such as de-identification, data encryption and systematic access control, privacy-friendly settings are fully adapted to the complete data life cycle all the way from collection, transmitting and storage, to sharing, copying and deleting. In addition, working with third-party institutions, Dahua has received the Protected Privacy IoT Product Certification and ETSI Certification from TÜV Rheinland, as well as an ISO 27018 Certification and ISO 27701 Certification from the BSI, which demonstrates its capability in managing personal information and compliance in line with privacy regulations around the world.

Continuously iterating security baseline

Centred on the core principles of security by design and security by default, the Dahua security baseline initiative taps into product safety technology to provide users with adequate safety guarantees. The security baseline builds a security element layout of ‘AAA+CIA+P’, forming a systematic protection framework covering physical security, system security, application security, data security, network security and privacy protection. Seven versions of the baseline and 100+ principles have been developed to adapt authentication, authorisation, audit, confidentiality, integrity, availability and privacy protection deeply into its product quality assurance system, making sure that all Dahua products enjoy factory default security.

Product security centre

In order to help users clearly understand the security status and capabilities of devices, the product security centre assists users to quickly set up the right security configuration to suit their requirements. General security capabilities include privacy protection (face occlusion, information hiding etc.), video encryption, security alarm, trusted protection, CA certification management, key management services, attack defence and so on.

Cybersecurity ecosystem

Adhering to openness and cooperation, Dahua Technology keeps cooperating with international authoritative security institutions to jointly build a security ecosystem. Through in-depth communicating and cooperating with institutions like TÜV Rheinland, BSI, DNV·GL, Intertek EWA-Canada and brightsight security lab, the company stays ahead of the curve in its security capabilities and systems.

In a widely networked world of IoT, cybersecurity challenges are pretty much a universal sore spot for companies. Dahua Technology, in the business of keeping people safe, takes cybersecurity seriously. With a mindset that emphasises cybersecurity and all the resources that it can allocate to establish, carry out and strengthen its cybersecurity approach, Dahua plans to stay positive, open, responsible and improving in all aspects of cybersecurity.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Cyber attackers used over 500 tools and tactics in 2022
Cyber Security News
The most common root causes of attacks were unpatched vulnerabilities and compromised credentials, while ransomware continues to be the most common ‘end game’ and attacker dwell time is shrinking – for better or worse.

Addressing the SCADA in the room
Industrial (Industry) Cyber Security
Few other sectors command the breadth of purpose-built and custom devices necessary to function, as the industrial and manufacturing industries. These unique devices create an uncommon risk that must be assessed and understood to fully protect against incoming attacks.

Recession or stress?
Cyber Security News
The economic landscape has seen many technology companies lay off vast numbers of employees, but for cybersecurity, the picture looks very different – a dynamic mixture of excitement, challenges and toxicity.

Invisible connection and tangible protection via cloud
Dahua Technology South Africa Perimeter Security, Alarms & Intruder Detection CCTV, Surveillance & Remote Monitoring Products
Dahua Technology has launched its AirShield security solution that uses advanced, stable and reliable RF communication technology and cloud services, integrating alarm hubs, various detectors and accessories, with several software apps.

Vulnerabilities in industrial cellular routers’ cloud management platforms
Industrial (Industry) Cyber Security Security Services & Risk Management
Research from OTORIO, a provider of operational technology cyber and digital risk management solutions, unveils cyber risks in M2M protocols and asset registration that expose hundreds of thousands of devices and OT networks to attack

NEC XON appoints Armand Kruger as Head of Cybersecurity
News Cyber Security
NEC XON has announced the appointment of Armand Kruger as the Head of Cybersecurity. Kruger will oversee all cybersecurity offerings including cybersecurity strategy, programmes, and executive advisory.

Caesar Tonkin new head of cybersecurity business, Armata
News Cyber Security
Vivica Holdings has announced the appointment of cybersecurity expert Caesar Tonkin to head up its cybersecurity business Armata, which provides technology solutions and niche expertise needed to help businesses better protect themselves.

Surveillance-free surfing
News Cyber Security Products
Zoho has launched Ulaa, a privacy-centric browser built specifically to help users secure their personal data and activity by providing a browser solution that universally blocks tracking and website surveillance.

Troye and Arctic Wolf join forces
News Cyber Security Security Services & Risk Management
Troye has announced a strategic partnership with Arctic Wolf to enable Troye to provide customers with enhanced cybersecurity solutions and services that help protect their businesses from advanced cyber threats.

Preventing forest fires with digital intelligence
Dahua Technology South Africa Fire & Safety Products
Technologies such as dual-spectrum video monitoring, intelligent image analysis and recognition, and three-dimensional positioning, enable the smart system to detect a fire, quickly locate the fire source and automatically send alarm to on-duty personnel.