Be prepared for these three cyber threats

CCTV Handbook 2017 Editor's Choice, Surveillance, Information Security, Integrated Solutions

When talking about information security, CIA stands for Confidentiality, Integrity and Availability. It is a model designed to guide efficient information security policies within an organisation.

J.O.S. Svendsen, Milestone Systems.
J.O.S. Svendsen, Milestone Systems.

• Confidentiality is roughly equivalent to privacy. This means ensuring that the VMS infrastructure is only accessed by the right people.

• Integrity entails maintaining optimal consistency, accuracy, and trustworthiness throughout the entire data life cycle.

• Availability is best ensured by designing the entire infrastructure to be as robust as possible. It also means maintaining a correctly functioning operating system and continuously updated application environment.

A person or organisation with malicious intent can harm or sabotage a VMS system in several ways. This means that people or assets could be at risk.

Hijacking can happen

A VMS system can quite easily be hijacked, by form of remote control with malign intent or for ransom or espionage purposes. A breached VMS-system’s data and recordings can be used in an array of negative contexts. User accounts, camera placement or general VMS data can be used as a stepping stone to get closer to an organisation’s total infrastructure.

If the location and capabilities of all cameras and alarms are known, it is easy to plan a break-in. And you’re not likely to discover it in the process: Spies do their utmost to avoid detection, as this would lead to countermeasures.

Some of the biggest cybersecurity risks include the following.

Systems with bad perimeter defences

Today’s VMS systems are often part of a business IT infrastructure. A successful attack in one part of the infrastructure might lead to confidentiality breaches in other parts. Therefore, it is generally recommended to isolate VMS systems from the rest of the IT infrastructure: If you can’t get to a system, you can’t harm it.

If the VMS system needs integration to other systems, it should be done via a secure bridge. Software should always be updated to the latest versions, as all serious software vendors will update it as new security threats are discovered.

It is important to remember that this not only goes for computers: All cameras, mobile clients and NVR systems need the same level of attention and precautions. In these cases, it is vital to be able to document the entire security infrastructure to ensure that no devices or computers have slipped under the radar.

Any system functions not needed for visual security should be shut down, like browsers, mail clients and file transfers. Again, if you can’t access a function, you can’t harm it.

This also means that access to the Internet should be avoided for any device in the VMS infrastructure. In the case of mobile clients, ensure that the mobile server is secured.

Stolen identities

It does not help to have a well-defended VMS system if anyone can guess user accounts and corresponding passwords. A password policy for VMS systems and mobile devices needs to ensure that all necessary passwords are changed regularly.

Depending on the system, stronger types of user identification might be used. Two-level authentication (where a user is identified by more than just a password) is a way of securing the system even further. Biometric identification in combination with a password gives an extra layer of security.

The inside factor

People are an organisation’s biggest asset. In some cases, they also pose a risk. As organisations implement increasingly sophisticated physical and cybersecurity measures to protect their assets from external threats, the recruitment of insiders becomes a more attractive option for those attempting to gain access.

An insider is a person who exploits or intends to exploit their authorised access to an organisation’s assets for unauthorised purposes. It could be a full-time or part-time employee, a contractor or even a business partner. An insider could deliberately seek to join your organisation to conduct an insider act or be triggered to act at some point during their employment.

Employees may inadvertently trigger security breaches by ignoring rules or through non-compliance due to the work pressure or an oversight.

Physical access controls to VMS-systems should be in place, as should procedures for screening personnel. It is essential that all staff be trained in security measures. A second security system securing the primary security VMS system is becoming a more relevant option as VMS systems turn increasingly business critical.

It is important to harden all VMS systems as much as possible, by following the general guidelines as outlined by CERT (https://ics-cert.us-cert.gov/Standards-and-References, short URL: securitysa.com/*ics) and the Milestone Hardening guide (http://news.milestonesys.com/is-your-network-secure-hardening-guide-for-deploying-milestone-ip-video/, short URL: securitysa.com/*msys1).

A good place to get more informed about all aspects on cybersecurity is the Microsoft cybersecurity blog (https://blogs.microsoft.com/microsoftsecure/category/cybersecurity/cybersecurity-policy-cybersecurity/, short URL: securitysa.com/*mscs1).



Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Surveillance on the perimeter
Axis Communications SA Hikvision South Africa Technews Publishing Editor's Choice Perimeter Security, Alarms & Intruder Detection
Cameras have long been a feature in perimeter security, with varying reports of success and failure, often dependent on the cameras’ planning, installation and configuration, as well as their integration with other perimeter solutions and centralised management platforms.

Read more...
Onyyx wireless alarm
Technews Publishing Editor's Choice Smart Home Automation
IDS has introduced Onyyx, a wireless alarm system engineered to provide complete system control via the Onyyx app or keyring, as well as seamless installation.

Read more...
Visual verification raises the security game
Technews Publishing Inhep Electronics Holdings Videofied SA Editor's Choice Perimeter Security, Alarms & Intruder Detection
Incorporating alarm signals with live surveillance footage, visual verification enables a human observer in a control room (onsite or offsite) to gain a clear understanding of the situation, thereby facilitating informed decision-making.

Read more...
The AX Hybrid PRO Series offers reliable wired and wireless protection
Hikvision South Africa Editor's Choice Perimeter Security, Alarms & Intruder Detection Products & Solutions
Hikvision has announced the launch of a new AX Hybrid PRO alarm system with innovative Hikvision ‘Speed-X’ transmission technology. This system offers reliable wired protection while delivering expanded flexibility with seamless wireless integration.

Read more...
Advanced Perimeter Intrusion Detection Systems
XtraVision OPTEX Technews Publishing Modular Communications Perimeter Security, Alarms & Intruder Detection Integrated Solutions Products & Solutions
Making full use of fibre installations around the perimeter by adding Perimeter Intrusion Detection Systems means you can easily add another layer of security to existing surveillance and fencing systems.

Read more...
A critical component of perimeter security
Nemtek Electric Fencing Products Gallagher Technews Publishing Stafix Editor's Choice Perimeter Security, Alarms & Intruder Detection Integrated Solutions
Electric fences are standard in South Africa, but today, they also need to be able to integrate with other technologies and become part of a broader perimeter security solution.

Read more...
SMARTpod talks to The Risk Management Forum
SMART Security Solutions Editor's Choice News & Events Security Services & Risk Management Videos Training & Education
SMART Security Solutions recently released its first SMARTpod podcast, discussing the upcoming Risk Management Forum Conference 2024, which will be held on 26 September 2024 at the Indaba Conference Centre in Fourways, Johannesburg.

Read more...
There is a SaaS for everything, but at what cost, especially to SMEs?
Editor's Choice Information Security Security Services & Risk Management
Relying on SaaS platforms presents significant cybersecurity risks as the number of providers in your landscape increases, expanding your attack surface. It is important to assess the strength of the SaaS providers in your chain.

Read more...
New State of Physical Access Control Report from HID
HID Global Editor's Choice Access Control & Identity Management News & Events
HID released the 2024 State of Physical Access Control Report, identifying five key trends shaping access control's future and painting a picture of an industry that has been undergoing considerable transformation.

Read more...
Addressing today’s mining challenges: cyber risks beyond IT
Editor's Choice Information Security Mining (Industry)
Despite the mining industry’s operational technology systems being vulnerable to cyberattacks, many decision-makers still see these threats as purely an IT issue, even though a breach could potentially disrupt mining operations.

Read more...