Be prepared for these three cyber threats

CCTV Handbook 2017 Editor's Choice, Surveillance, Information Security, Integrated Solutions

When talking about information security, CIA stands for Confidentiality, Integrity and Availability. It is a model designed to guide efficient information security policies within an organisation.

J.O.S. Svendsen, Milestone Systems.
J.O.S. Svendsen, Milestone Systems.

• Confidentiality is roughly equivalent to privacy. This means ensuring that the VMS infrastructure is only accessed by the right people.

• Integrity entails maintaining optimal consistency, accuracy, and trustworthiness throughout the entire data life cycle.

• Availability is best ensured by designing the entire infrastructure to be as robust as possible. It also means maintaining a correctly functioning operating system and continuously updated application environment.

A person or organisation with malicious intent can harm or sabotage a VMS system in several ways. This means that people or assets could be at risk.

Hijacking can happen

A VMS system can quite easily be hijacked, by form of remote control with malign intent or for ransom or espionage purposes. A breached VMS-system’s data and recordings can be used in an array of negative contexts. User accounts, camera placement or general VMS data can be used as a stepping stone to get closer to an organisation’s total infrastructure.

If the location and capabilities of all cameras and alarms are known, it is easy to plan a break-in. And you’re not likely to discover it in the process: Spies do their utmost to avoid detection, as this would lead to countermeasures.

Some of the biggest cybersecurity risks include the following.

Systems with bad perimeter defences

Today’s VMS systems are often part of a business IT infrastructure. A successful attack in one part of the infrastructure might lead to confidentiality breaches in other parts. Therefore, it is generally recommended to isolate VMS systems from the rest of the IT infrastructure: If you can’t get to a system, you can’t harm it.

If the VMS system needs integration to other systems, it should be done via a secure bridge. Software should always be updated to the latest versions, as all serious software vendors will update it as new security threats are discovered.

It is important to remember that this not only goes for computers: All cameras, mobile clients and NVR systems need the same level of attention and precautions. In these cases, it is vital to be able to document the entire security infrastructure to ensure that no devices or computers have slipped under the radar.

Any system functions not needed for visual security should be shut down, like browsers, mail clients and file transfers. Again, if you can’t access a function, you can’t harm it.

This also means that access to the Internet should be avoided for any device in the VMS infrastructure. In the case of mobile clients, ensure that the mobile server is secured.

Stolen identities

It does not help to have a well-defended VMS system if anyone can guess user accounts and corresponding passwords. A password policy for VMS systems and mobile devices needs to ensure that all necessary passwords are changed regularly.

Depending on the system, stronger types of user identification might be used. Two-level authentication (where a user is identified by more than just a password) is a way of securing the system even further. Biometric identification in combination with a password gives an extra layer of security.

The inside factor

People are an organisation’s biggest asset. In some cases, they also pose a risk. As organisations implement increasingly sophisticated physical and cybersecurity measures to protect their assets from external threats, the recruitment of insiders becomes a more attractive option for those attempting to gain access.

An insider is a person who exploits or intends to exploit their authorised access to an organisation’s assets for unauthorised purposes. It could be a full-time or part-time employee, a contractor or even a business partner. An insider could deliberately seek to join your organisation to conduct an insider act or be triggered to act at some point during their employment.

Employees may inadvertently trigger security breaches by ignoring rules or through non-compliance due to the work pressure or an oversight.

Physical access controls to VMS-systems should be in place, as should procedures for screening personnel. It is essential that all staff be trained in security measures. A second security system securing the primary security VMS system is becoming a more relevant option as VMS systems turn increasingly business critical.

It is important to harden all VMS systems as much as possible, by following the general guidelines as outlined by CERT (https://ics-cert.us-cert.gov/Standards-and-References, short URL: securitysa.com/*ics) and the Milestone Hardening guide (http://news.milestonesys.com/is-your-network-secure-hardening-guide-for-deploying-milestone-ip-video/, short URL: securitysa.com/*msys1).

A good place to get more informed about all aspects on cybersecurity is the Microsoft cybersecurity blog (https://blogs.microsoft.com/microsoftsecure/category/cybersecurity/cybersecurity-policy-cybersecurity/, short URL: securitysa.com/*mscs1).



Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Pentagon appointed as Milestone distributor
Elvey Security Technologies News & Events Surveillance
Milestone Systems appointed Pentagon Distribution (an Elvey Group company within the Hudaco Group of Companies) as a distributor. XProtect’s open architecture means no lock-in and the ability to customise the connected video solution that will accomplish the job.

Read more...
Data security and privacy in global mobility
Risk Management & Resilience Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
Re-imagining business operations with the power of AI
AI & Data Analytics Surveillance
inq., a Convergence Partners company, has introduced a range of artificial intelligence (AI) solutions to assist organisations across industry verticals in optimising business operations and improving internal efficiencies.

Read more...
Enhance control rooms with surveillance and intelligence
Leaderware Editor's Choice Surveillance Mining (Industry)
Dr Craig Donald advocates the use of intelligence and smart surveillance to assist control rooms in dealing with the challenges of the size and dispersed nature common in all mining environments.

Read more...
A long career in mining security
Technews Publishing Editor's Choice Mining (Industry) Risk Management & Resilience
Nash Lutchman recently retired from a security and law enforcement career, initially as a police officer, and for the past 16 years as a leader of risk and security operations in the mining industry.

Read more...
Future trends for electronic safety and security in mining
Fang Fences & Guards Mining (Industry) Integrated Solutions AI & Data Analytics
The mining industry is ever evolving, driven by technological advancements and the growing need for enhanced safety and security measures, with significant innovation seen in turnkey electronic security for mining operations.

Read more...
Unlocking enhanced security for mining
Mining (Industry) Integrated Solutions
In the dynamic landscape of African mining, security remains of paramount concern as threats evolve and challenges persist, and mining companies seek innovative solutions to safeguard their operations, assets, and personnel.

Read more...
A constant armed struggle
Technews Publishing XtraVision Editor's Choice Integrated Solutions Mining (Industry) IoT & Automation
SMART Security Solutions asked a few people involved in servicing mines to join us for a virtual round table and give us their insights into mine security today. A podcast of the discussion will be released shortly-stay tuned.

Read more...
Risk management: There's an app for that
Editor's Choice News & Events Risk Management & Resilience
Zulu Consulting has streamlined the corporate risk management process with the launch of Risk-IO, a web-based app designed to consolidate and guide risk managers through the process, monitoring progress as one proceeds.

Read more...