classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2018


Securing your surveillance
April 2018, Cyber Security, CCTV, Surveillance & Remote Monitoring, Integrated Solutions

IT security used to be about securing your PC with an antivirus package and not putting any strange disks in your drives. That has changed dramatically over the years and today there is no industry that uses electronics that does not have to cater for cybersecurity defence in their budget. Physical security and, in particular, surveillance is no different.

Hi-Tech Security Solutions wanted to know what your average company can do to secure their surveillance infrastructure from the various threats out there.

We approached two companies in the security industry to give us an insight into cybersecurity in the physical security world. We went to a physical security stalwart who has been in the news over the past few months specifically with respect to cybersecurity, Genetec; as well as a traditional cybersecurity company that has also been in the news over the past few months as a result of some American politicians panicking that the Russians are on their doorstep, Kaspersky.

We started out asking our two interviewees what cybersecurity means in terms of surveillance technology and installations. Specifically, what is at risk and how do you protect it?

Brent Cary, regional sales manager, sub-Saharan Africa for Genetec, says a hacker doesn’t see a camera as a specialised surveillance device, they see it as a computer with a lens sending video packets over a network, which means they can use the same attack techniques as they do for other networked computers.

“Therefore, generally speaking, the cyber defence used in the IT world can be applied to defend the systems in the surveillance industry. The risks are also similar, namely: unauthorised access to a device, confidentiality breach of sensitive data, denial of service of systems and tampering of data.

Denis Legezo, technology positioning manager at Kaspersky Lab adds, “if we are speaking about web cameras along with routers and digital videos recorders (which could also be a part of surveillance systems), they are one of the most popular embedded devices to infect. The reason is simple. Despite their low computing power, these devices are typically on-line 24/7.

As such, it’s almost the perfect situation for the botnet’s host, which waits for a command to start a DDoS-attack.” So what can be done?

Legezo explains that only top-notch cyber-criminal actors will search for the famed zero-day exploits in embedded devices. Most malefactors will scan your devices multiple times per day trying to find known passwords or vulnerabilities. And some still succeed with such tactics. Kaspersky advise owners of IoT devices, which includes users who have surveillance installed, to firstly change the passwords of their devices to one that’s difficult to compromise by brute force (which means that passwords like ‘password’, ‘12345’, ‘qwerty’ or ‘password123’, and other favourites are taboo). Secondly, he encourages users to ensure their surveillance devices (cameras, recorders, network switches etc.) are all running the latest firmware.

Cary’s agrees, noting that the first step is to complete a risk assessment. “This means you have to define what you care about and what you want to defend against.”

The second step is to make sure that those risks are addressed. This generally involves implementing some security controls, and in the majority of cases in the physical security industry, basic IT practices are used. Some examples can include: changing the default passwords of cameras, applying the latest patches supplied by the manufacturers, updating device firmware and using a secure communication protocol like HTTPS.

Technical assistance

An IT expert may take the advice above and be quite happy implementing it, but what about the rest of us who have no time to research all the ins and outs of the cybersecurity world? We still need to be secure, but we need assistance, preferably in the form of standard tools or practices that will help us in protecting our surveillance infrastructure.

Cary says there is help at hand. Depending on your particular context, you can apply many tools. One example he gives is Microsoft’s Security Compliance Manager which offers a set of security configurations for almost all versions of Windows. This can be used to harden the windows image running your VMS software.

He adds, “You should be working with reputable manufacturers who are offering features and tools in their platform focused on the ‘security of security’ and come secure by design. ‘System Integrators’ skills sets have had to evolve with the rest of the physical security industry. Today, it is crucial for an SI to not only understand how IP networks are designed and configured, but they should also have skills in and be offering the industry’s best information security practices.”

Additionally, employees need to have incident response skills in case of infection to ensure they are able to find the vulnerability and close it for future usage, notes Legezo.

What do they do?

To end the discussion, we asked our interviewees what their company does in terms of security in the surveillance market.

“We do not play significantly in the hardware market and as such, we cannot answer these questions with authority,” answers Legezo. “We are mostly into security software and in our own field timely updates of heuristic and behavioural rules to detect malicious activity are absolutely crucial.”

As far as Genetec is concerned, Cary says multiple security functions are included in Genetec Security Center. These include:

• A Password Strength Metre and Password Composition Rule to make sure users are using strong passwords.

• Genetec’s authorisation feature is a comprehensive privilege system to assign specific users only the access rights they need.

• Genetec’s usage of cryptographically strong protocols to protect the confidentiality and integrity of data, including video and audio data while in transit and at rest, are leading the physical security industry. Protocols used include HTTPS, TLS, and SRTP.

In addition, he says Security Center updates can be set to update automatically. “We also have a new feature created explicitly for updating vulnerable cameras in the new Security Center 5.7. This feature scans the firmware used by cameras in our VMS and compares it against a database of firmware that have known vulnerabilities. If a vulnerable firmware is detected on our platform, we will alert the user and suggest an update for the specific camera.

“These advanced features as well as simple features you find in Windows, such as Auto-Locking of inactive sessions, ensure Genetec is secure by design,” he concludes.


  Share via Twitter   Share via LinkedIn      

Further reading:

  • Trust but continually verify
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions, IT infrastructure
    Hi-Tech Security Solutions looks at access and identity management and asks some industry players what ‘zero trust’ and ‘least privilege’ access means.
  • Managing who, what and why
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security
    Today’s access control isn’t only concerned with who has access, but also what has access, why they need it and what they are doing with it.
  • Physical/logical convergence
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Integrated Solutions, IT infrastructure
    The convergence between physical and logical (or cyber) security will be a game-changer because it will change the way we do everything, from planning to design and all the way to installation and maintenance.
  • Physical and logical convergence is a fact
    November 2018, This Week's Editor's Pick, Integrated Solutions, IT infrastructure
    Convergence, the next buzzword? A dated buzzword? Is convergence ­merely ­integration on steroids? What is convergence?
  • Taking augmented identity to the world
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    Hi-Tech Security Solutions spoke to Gary Jones, VP Global Channel and Marketing biometric access and time solutions) at IDEMIA (formerly Morpho) about his career with the company and its new vision of Augmented Identity.
  • BIMS set to change identity ­management
    November 2018, Technews Publishing, Access Control & Identity Management, Integrated Solutions, IT infrastructure
    Local biometrics integrator, Ideco Biometric Security Solutions, has announced that its Biometric Identity Management System (BIMS) has been launched to market.
  • Tracking biometrics into a brave new digital world
    November 2018, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    The industry is increasingly transitioning from unimodal to more integrated multimodal biometric solutions for more accurate identity verification and faster real-time results.
  • Panasonic’s Face Recognition Server
    November 2018, Panasonic South Africa, Access Control & Identity Management, CCTV, Surveillance & Remote Monitoring, Products
    Panasonic has adopted deep learning technology in its face recognition products that overcomes the difficulties of conventional technologies.
  • Your face tells a story
    November 2018, Technews Publishing, Access Control & Identity Management, CCTV, Surveillance & Remote Monitoring, Government and Parastatal (Industry)
    Facial recognition has advanced to the point where it can be rolled out over large areas and accuracy is no longer a hit-and-miss affair.
  • Key components of access control
    November 2018, Paxton Access, Access Control & Identity Management, Integrated Solutions
    Dan Drayton speaks to Hi-Tech Security Solutions about what the key components in modern access control systems are.
  • IP is no stranger to access control
    November 2018, Technews Publishing, Access Control & Identity Management, Integrated Solutions, IT infrastructure
    Just as the surveillance market made the move to IP-based communications, the access control market is also moving to IP (or some say it already has).
  • Applying the SaaS model to access control
    November 2018, Technews Publishing, Access Control & Identity Management, Integrated Solutions
    The software-as-a-service model has proven transformative to many organisations, and even entire industries. The benefits it can offer are undeniable, but in the security sector which is risk-averse by necessity, we wanted to hear the views of some local experts in access control as a service (ACaaS) to find out what some of the pros and cons are.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.