Securing your surveillance

CCTV Handbook 2018 Cyber Security, CCTV, Surveillance & Remote Monitoring, Integrated Solutions

IT security used to be about securing your PC with an antivirus package and not putting any strange disks in your drives. That has changed dramatically over the years and today there is no industry that uses electronics that does not have to cater for cybersecurity defence in their budget. Physical security and, in particular, surveillance is no different.

Hi-Tech Security Solutions wanted to know what your average company can do to secure their surveillance infrastructure from the various threats out there.

We approached two companies in the security industry to give us an insight into cybersecurity in the physical security world. We went to a physical security stalwart who has been in the news over the past few months specifically with respect to cybersecurity, Genetec; as well as a traditional cybersecurity company that has also been in the news over the past few months as a result of some American politicians panicking that the Russians are on their doorstep, Kaspersky.

We started out asking our two interviewees what cybersecurity means in terms of surveillance technology and installations. Specifically, what is at risk and how do you protect it?

Brent Cary, regional sales manager, sub-Saharan Africa for Genetec, says a hacker doesn’t see a camera as a specialised surveillance device, they see it as a computer with a lens sending video packets over a network, which means they can use the same attack techniques as they do for other networked computers.

“Therefore, generally speaking, the cyber defence used in the IT world can be applied to defend the systems in the surveillance industry. The risks are also similar, namely: unauthorised access to a device, confidentiality breach of sensitive data, denial of service of systems and tampering of data.

Denis Legezo, technology positioning manager at Kaspersky Lab adds, “if we are speaking about web cameras along with routers and digital videos recorders (which could also be a part of surveillance systems), they are one of the most popular embedded devices to infect. The reason is simple. Despite their low computing power, these devices are typically on-line 24/7.

As such, it’s almost the perfect situation for the botnet’s host, which waits for a command to start a DDoS-attack.” So what can be done?

Legezo explains that only top-notch cyber-criminal actors will search for the famed zero-day exploits in embedded devices. Most malefactors will scan your devices multiple times per day trying to find known passwords or vulnerabilities. And some still succeed with such tactics. Kaspersky advise owners of IoT devices, which includes users who have surveillance installed, to firstly change the passwords of their devices to one that’s difficult to compromise by brute force (which means that passwords like ‘password’, ‘12345’, ‘qwerty’ or ‘password123’, and other favourites are taboo). Secondly, he encourages users to ensure their surveillance devices (cameras, recorders, network switches etc.) are all running the latest firmware.

Cary’s agrees, noting that the first step is to complete a risk assessment. “This means you have to define what you care about and what you want to defend against.”

The second step is to make sure that those risks are addressed. This generally involves implementing some security controls, and in the majority of cases in the physical security industry, basic IT practices are used. Some examples can include: changing the default passwords of cameras, applying the latest patches supplied by the manufacturers, updating device firmware and using a secure communication protocol like HTTPS.

Technical assistance

An IT expert may take the advice above and be quite happy implementing it, but what about the rest of us who have no time to research all the ins and outs of the cybersecurity world? We still need to be secure, but we need assistance, preferably in the form of standard tools or practices that will help us in protecting our surveillance infrastructure.

Cary says there is help at hand. Depending on your particular context, you can apply many tools. One example he gives is Microsoft’s Security Compliance Manager which offers a set of security configurations for almost all versions of Windows. This can be used to harden the windows image running your VMS software.

He adds, “You should be working with reputable manufacturers who are offering features and tools in their platform focused on the ‘security of security’ and come secure by design. ‘System Integrators’ skills sets have had to evolve with the rest of the physical security industry. Today, it is crucial for an SI to not only understand how IP networks are designed and configured, but they should also have skills in and be offering the industry’s best information security practices.”

Additionally, employees need to have incident response skills in case of infection to ensure they are able to find the vulnerability and close it for future usage, notes Legezo.

What do they do?

To end the discussion, we asked our interviewees what their company does in terms of security in the surveillance market.

“We do not play significantly in the hardware market and as such, we cannot answer these questions with authority,” answers Legezo. “We are mostly into security software and in our own field timely updates of heuristic and behavioural rules to detect malicious activity are absolutely crucial.”

As far as Genetec is concerned, Cary says multiple security functions are included in Genetec Security Center. These include:

• A Password Strength Metre and Password Composition Rule to make sure users are using strong passwords.

• Genetec’s authorisation feature is a comprehensive privilege system to assign specific users only the access rights they need.

• Genetec’s usage of cryptographically strong protocols to protect the confidentiality and integrity of data, including video and audio data while in transit and at rest, are leading the physical security industry. Protocols used include HTTPS, TLS, and SRTP.

In addition, he says Security Center updates can be set to update automatically. “We also have a new feature created explicitly for updating vulnerable cameras in the new Security Center 5.7. This feature scans the firmware used by cameras in our VMS and compares it against a database of firmware that have known vulnerabilities. If a vulnerable firmware is detected on our platform, we will alert the user and suggest an update for the specific camera.

“These advanced features as well as simple features you find in Windows, such as Auto-Locking of inactive sessions, ensure Genetec is secure by design,” he concludes.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Retail solutions beyond security
Issue 8 2020, Axis Communications SA, Technews Publishing, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring
The need for security technology to deliver more than videos of people falling or stealing from retail stores is greater than ever.

Read more...
AI-powered hardhat detection
Issue 8 2020, Hikvision South Africa , Industrial (Industry), CCTV, Surveillance & Remote Monitoring
Hardhats save lives, but only if people wear them. Intelligent, AI-powered hardhat cameras are helping to ensure workers in dangerous locations stay safe at all times.

Read more...
S&ST launches second App Challenge
Issue 2 2021 , Integrated Solutions, CCTV, Surveillance & Remote Monitoring
Security & Safety Things has launched its second App Challenge for the development of creative, specialised video analytic applications for specific use cases in retail, transportation/smart cities, healthcare and entertainment/stadiums.

Read more...
More is less in cybersecurity
Issue 2 2021 , Cyber Security
Post-pandemic paradox: more solutions do not bring better protection. Despite 80% of organisations running up to 10 different protection and cybersecurity solutions simultaneously, more than 50% of them experienced downtime from data loss last year.

Read more...
Ransomware and Microsoft Exchange Server attacks are surging
Issue 2 2021 , Cyber Security
Check Point Research sees global surges in ransomware attacks, alongside increases in cyberattacks targeting Microsoft Exchange Server vulnerabilities at a time where CISA has raised the alarm about ransomware attacks against Microsoft Exchange servers.

Read more...
Geutebrück releases latest management system
Issue 2 2021 , CCTV, Surveillance & Remote Monitoring, Integrated Solutions
G-SIM X Panopticon, the latest release of Geutebrück's management system, integrates additional features designed for more rapid and cost-effective setup, enhanced intuitive operation, and multi-site networking.

Read more...
Surveillance in remote areas
Issue 2 2021, LD Africa , Products, CCTV, Surveillance & Remote Monitoring
The JH016 4G Solar Powered Outdoor Security Camera is designed to meet the security needs for remotely monitoring off-the-grid locations, without Internet/Wi-Fi or power.

Read more...
Malware disguised as meeting apps spiked by 1067%
Issue 2 2021 , Cyber Security
Atlas VPN analysis reveals that cyber threats disguised as videoconferencing applications jumped by 1067% in a year. The data analysed was provided by Kaspersky.

Read more...
The realities of AI in cybersecurity: catastrophic forgetting
Issue 2 2021 , Cyber Security
There is a lot of hype about the use of artificial intelligence (AI) in cybersecurity. The truth is that the role and potential of AI in security is still evolving and often requires experimentation and evaluation.

Read more...
Cyber makes it secure
Issue 2 2021 , Cyber Security
Stas Protassov, Acronis co-founder and technology president comments on the recent hacking of over 150 000 Verkada surveillance cameras.

Read more...