Securing your surveillance

CCTV Handbook 2018 Information Security, Surveillance, Integrated Solutions

IT security used to be about securing your PC with an antivirus package and not putting any strange disks in your drives. That has changed dramatically over the years and today there is no industry that uses electronics that does not have to cater for cybersecurity defence in their budget. Physical security and, in particular, surveillance is no different.

Hi-Tech Security Solutions wanted to know what your average company can do to secure their surveillance infrastructure from the various threats out there.

We approached two companies in the security industry to give us an insight into cybersecurity in the physical security world. We went to a physical security stalwart who has been in the news over the past few months specifically with respect to cybersecurity, Genetec; as well as a traditional cybersecurity company that has also been in the news over the past few months as a result of some American politicians panicking that the Russians are on their doorstep, Kaspersky.

We started out asking our two interviewees what cybersecurity means in terms of surveillance technology and installations. Specifically, what is at risk and how do you protect it?

Brent Cary, regional sales manager, sub-Saharan Africa for Genetec, says a hacker doesn’t see a camera as a specialised surveillance device, they see it as a computer with a lens sending video packets over a network, which means they can use the same attack techniques as they do for other networked computers.

“Therefore, generally speaking, the cyber defence used in the IT world can be applied to defend the systems in the surveillance industry. The risks are also similar, namely: unauthorised access to a device, confidentiality breach of sensitive data, denial of service of systems and tampering of data.

Denis Legezo, technology positioning manager at Kaspersky Lab adds, “if we are speaking about web cameras along with routers and digital videos recorders (which could also be a part of surveillance systems), they are one of the most popular embedded devices to infect. The reason is simple. Despite their low computing power, these devices are typically on-line 24/7.

As such, it’s almost the perfect situation for the botnet’s host, which waits for a command to start a DDoS-attack.” So what can be done?

Legezo explains that only top-notch cyber-criminal actors will search for the famed zero-day exploits in embedded devices. Most malefactors will scan your devices multiple times per day trying to find known passwords or vulnerabilities. And some still succeed with such tactics. Kaspersky advise owners of IoT devices, which includes users who have surveillance installed, to firstly change the passwords of their devices to one that’s difficult to compromise by brute force (which means that passwords like ‘password’, ‘12345’, ‘qwerty’ or ‘password123’, and other favourites are taboo). Secondly, he encourages users to ensure their surveillance devices (cameras, recorders, network switches etc.) are all running the latest firmware.

Cary’s agrees, noting that the first step is to complete a risk assessment. “This means you have to define what you care about and what you want to defend against.”

The second step is to make sure that those risks are addressed. This generally involves implementing some security controls, and in the majority of cases in the physical security industry, basic IT practices are used. Some examples can include: changing the default passwords of cameras, applying the latest patches supplied by the manufacturers, updating device firmware and using a secure communication protocol like HTTPS.

Technical assistance

An IT expert may take the advice above and be quite happy implementing it, but what about the rest of us who have no time to research all the ins and outs of the cybersecurity world? We still need to be secure, but we need assistance, preferably in the form of standard tools or practices that will help us in protecting our surveillance infrastructure.

Cary says there is help at hand. Depending on your particular context, you can apply many tools. One example he gives is Microsoft’s Security Compliance Manager which offers a set of security configurations for almost all versions of Windows. This can be used to harden the windows image running your VMS software.

He adds, “You should be working with reputable manufacturers who are offering features and tools in their platform focused on the ‘security of security’ and come secure by design. ‘System Integrators’ skills sets have had to evolve with the rest of the physical security industry. Today, it is crucial for an SI to not only understand how IP networks are designed and configured, but they should also have skills in and be offering the industry’s best information security practices.”

Additionally, employees need to have incident response skills in case of infection to ensure they are able to find the vulnerability and close it for future usage, notes Legezo.

What do they do?

To end the discussion, we asked our interviewees what their company does in terms of security in the surveillance market.

“We do not play significantly in the hardware market and as such, we cannot answer these questions with authority,” answers Legezo. “We are mostly into security software and in our own field timely updates of heuristic and behavioural rules to detect malicious activity are absolutely crucial.”

As far as Genetec is concerned, Cary says multiple security functions are included in Genetec Security Center. These include:

• A Password Strength Metre and Password Composition Rule to make sure users are using strong passwords.

• Genetec’s authorisation feature is a comprehensive privilege system to assign specific users only the access rights they need.

• Genetec’s usage of cryptographically strong protocols to protect the confidentiality and integrity of data, including video and audio data while in transit and at rest, are leading the physical security industry. Protocols used include HTTPS, TLS, and SRTP.

In addition, he says Security Center updates can be set to update automatically. “We also have a new feature created explicitly for updating vulnerable cameras in the new Security Center 5.7. This feature scans the firmware used by cameras in our VMS and compares it against a database of firmware that have known vulnerabilities. If a vulnerable firmware is detected on our platform, we will alert the user and suggest an update for the specific camera.

“These advanced features as well as simple features you find in Windows, such as Auto-Locking of inactive sessions, ensure Genetec is secure by design,” he concludes.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Pentagon appointed as Milestone distributor
Elvey Security Technologies News & Events Surveillance
Milestone Systems appointed Pentagon Distribution (an Elvey Group company within the Hudaco Group of Companies) as a distributor. XProtect’s open architecture means no lock-in and the ability to customise the connected video solution that will accomplish the job.

Read more...
Deception technology crucial to unmasking data theft
Information Security Risk Management & Resilience
The ‘silent theft’ of data is an increasingly prevalent cyber threat to businesses, driving the ongoing leakage of personal information in the public domain through undetected attacks that cannot even be policed by data privacy legislation.

Read more...
Data security and privacy in global mobility
Risk Management & Resilience Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
Re-imagining business operations with the power of AI
AI & Data Analytics Surveillance
inq., a Convergence Partners company, has introduced a range of artificial intelligence (AI) solutions to assist organisations across industry verticals in optimising business operations and improving internal efficiencies.

Read more...
Enhance control rooms with surveillance and intelligence
Leaderware Editor's Choice Surveillance Mining (Industry)
Dr Craig Donald advocates the use of intelligence and smart surveillance to assist control rooms in dealing with the challenges of the size and dispersed nature common in all mining environments.

Read more...
Future trends for electronic safety and security in mining
Fang Fences & Guards Mining (Industry) Integrated Solutions AI & Data Analytics
The mining industry is ever evolving, driven by technological advancements and the growing need for enhanced safety and security measures, with significant innovation seen in turnkey electronic security for mining operations.

Read more...
Unlocking enhanced security for mining
Mining (Industry) Integrated Solutions
In the dynamic landscape of African mining, security remains of paramount concern as threats evolve and challenges persist, and mining companies seek innovative solutions to safeguard their operations, assets, and personnel.

Read more...
A constant armed struggle
Technews Publishing XtraVision Editor's Choice Integrated Solutions Mining (Industry) IoT & Automation
SMART Security Solutions asked a few people involved in servicing mines to join us for a virtual round table and give us their insights into mine security today. A podcast of the discussion will be released shortly-stay tuned.

Read more...
The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

Read more...