Don’t Reinvent the Wheel

Don’t Reinvent the Wheel

Six critical cybersecurity issues for video networks

As engineers, integrators, and administrators of IP video management and other network-based security systems, we have a heavy reliance on the network. If the core network system isn’t working correctly— or is under attack from internal as well as external threats—the system will not be able to perform its functions as intended, and any security breach can reach far beyond the security network to the rest of the organization’s digital infrastructure.

Edge devices of all types, including cameras, are a vulnerable part of a network. Any video security system design must take this into account. Because no single solution can meet all applications or address all threats, a multi-layered approach is best for deploying an optimally functional and secure network.

Fortunately, there are proven, standardized frameworks available that systematically bring together network best practices. There’s no reason for video surveillance and security professionals to re-invent the wheel. Taking an IT industry standards approach makes it easy to design and deploy secure video networks. Here are several network security topics often overlooked by video surveillance professionals.

Brute Force Attack

A brute force attack is a trial-and-error method used to obtain information such as user passwords or PIN numbers. Hackers use software that tries different character combinations in quick succession to crack passwords. Short and simple passwords—those that only use alphabetical characters—are easier to break than longer passwords with a mix of letters, numbers and special characters. Hackers often persist for hours, days, or even years in finding a way into a target.

Edge devices are some of the most vulnerable pieces in installations. Most cameras today can encrypt command and control traffic, but to do this, a certificate needs to be assigned to it. Typically, a selfassigned certificate is used, but which in itself is not inherently secure. So how do we introduce some certificate authority and manage the certificates from the devices and the recording servers, with a thirdparty, certificate/policy enforcement utility.

Policy management utilities can dictate password changes and password hygiene. Administrators can request that they want all cameras to have a password, say, with 25 characters, and the server will randomly generate and assign the passwords. No one involved would know the passwords, and that information is not needed as long as it resides in both the recording platform and on the camera. The policy management server can even go out to the cameras and apply password changes on a schedule, and at the same time update the video management system to ensure zero downtime.

Active Directory Attack

Active Directory is a Windows OS directory service that facilitates working with interconnected network resources. Active Directory was launched almost twenty years ago, and the security landscape has changed dramatically since. Unfortunately, businesses have not adapted their Active Directory environment to meet these new security needs and, as a result, we are seeing attackers exploit this weakness more frequently.

One of the first steps in preventing an attack on Active Directory is to make sure there’s visibility into all Active Directory activities. An Active Directory auditing solution can assist with this and help administrators be proactively alerted to suspicious activity before a full-blown attack. For every enterprise network, there should be a complete Active Directory Disaster Recovery plan in place to minimize the impact of an attack, and all for damage to be reversed within just a few hours.

Lost and Stolen Asset Devices

There are vulnerabilities everywhere, and much is dictated by the number of system endpoints. The number of PCs on a network used to be the main concern, but the primary concern now is all the IoT and edge devices—including cameras and all types of sensors—that connect to a network.

It is critical to secure all device communications with the backend systems and make it difficult for someone to access the network from the outside world, through a lost or stolen device. Keep in mind that if it’s easy to access a network, it’s probably vulnerable. Administrators have to strike a balance between security and usability and make sure we err on the side of assuring security.

The practice of Network Segmentation is a useful security layer within an overall security system design. It’s surprising how many video management software (VMS) systems don’t use any network segmentation methodology. Through network segmentation best practices, we can add difficulty in accessing parts of a network.

Insider Threats

An insider threat is a security threat that originates from within the organization being targeted, often by an employee or officer of an organization. An insider threat does not have to be a current employee, but can also be a former employee or anyone who at one time had access to the network. Logic Bombs are a type of malicious software that can be left running on a system by former employees, which can cause a wide range of problems.

Contractors, business associates, and other individuals or thirdparty entities who have or have had access to protected networks or databases also fall under the umbrella of insider threat. Network segmentation, robust password policies, and a pro-active, on-going review of all network activity is critical in protecting against internal threats.


Ransomware is a type of malicious software that threatens to publish the victim’s data or perpetually block access to the data unless a ransom is paid. User education and awareness are critical when it comes to defeating ransomware. Treat suspicious emails with caution. Inspect email domain names and hover over links to see where they lead. Extending security through the use of anti-virus, anti-spyware on devices at the network perimeter is critical.

Most ransomware will try to spread from the endpoint to the server/storage where all the data and mission-critical applications reside. Segmenting the network and keeping critical apps and devices isolated on a separate network or virtual LAN can limit the spread.

Sandboxing technologies can provide the ability to quarantine suspicious files for analysis before they can enter the network. The files are held at the gateway for evaluation. Adopt a layered approach to stop ransomware by avoiding a single point of failure in the security architecture, and have a robust backup and recovery plan in place.

Physical Layer Compromise

Many company server rooms and data centers have easy-to-exploit physical vulnerabilities that don’t require digitally hacking into the network. Intruders simply looking to vandalize the servers can create a huge and costly level of damage.

Some of the ways of gaining access simply include accessing improperly installed doors or windows, picking locks, crawling through void spaces in the walls or above false ceilings, and “tailgating” into the building by posing as a contractor or vendor.

A major physical design flaw with server rooms is with the drop ceilings and raised floors where the walls don’t go up to the real ceiling or down to the subfloor. Intruders need to simply remove a ceiling tile from a nearby area and then crawl to the server room from above. And raised floors and crawl spaces—built for cabling and cooling purposes—can also be physically exploited.

For optimum physical protection, a combination of multiple security strategies is needed, including the use of professional-grade access control systems and locks requiring authentication, proper wall and structure design that reduces void spaces and presents physical barriers. Alarm sensors placed within potential access points is a good strategy as well. Of course, clear and detailed, documented security and access polices must be established, communicated with employees and strictly followed.

ISO 27001 and the Risk Assessment

The days of system and network isolation are over. Organizations must adopt policies and best practices that allow decision makers to have clear insight into security all practices. These policies must reach across network design, information system use, product development and, in many cases, the entire supply chain. Successful integrated solutions are the ones that withstand the test of time and are built with the cooperation of users and administrators with proper processes and technology.

The ISO/IEC 27001 information security standard, being the most widely accepted framework for the development and improvement of information security management systems, belongs to the consistently growing ISO 27000 family of best-practice security frameworks—an assembly of resources that make for seamless integration of disciplines and sub-systems. Among the others are the ISO 27005 standard, which speaks specifically to information risk management, offers a pragmatic mapping to enterprise risk management following standards like ISO 3100.

Also, the recently updated ISO/IEC 27004:2016 provides systematic guidance on how to develop and operate measurement processes for the effectiveness of security controls of products and services, as well as how to assess and report the results in the form of functional information security metrics for continuous improvement.

Whether you are an engineer or consultant responsible for security and reporting to management or an executive who needs better information for decision making, security metrics have become an essential vehicle for communicating the state of an organization’s cyber-risk posture.

To mitigate risk, comply with legislation, and assure the confidentiality, integrity, availability, and accountability of information for your company, employees, and customers—create a written data security policy based on established guidelines, enforced through regular training, reviews, and assessments.

Milestone Systems Cybersecurity Technical Forum

A critical component of defending against cyber-attacks and vulnerabilities is to stay informed. IT and security managers need to be aware of issues that affect software and hardware, including operating systems, mobile devices, cameras, storage devices, and network devices.

A reliable point-of-contact should be established for all system components, with reporting procedures to track bugs and system vulnerabilities. It’s important to keep current on common vulnerabilities and exposures for all system components and to communicate with manufacturers often.

This article originally appeared in the July/August 2019 issue of Security Today.


  • Top 5 Cybersecurity Trends of 2023

    Top 5 Cybersecurity Trends for 2023

    Cybersecurity is a rapidly evolving field, and staying on top of the latest trends is essential for organizations looking to protect themselves from cyber threats. Read Now

  • See How Reddit Users Have Unlocked the Dark Side of ChatGPT

    See How Reddit Users Have Unlocked the Dark Side of ChatGPT

    In less than four months after its debut, ChatGPT continues to garner attention from users all around the world who have made use of the AI system that answers questions, creates computer code, and much more. Read Now

  • Enforcing Zero Trust in a Hybrid Work Environment

    Enforcing Zero Trust in a Hybrid Work Environment

    The effects of the pandemic have rippled across the business world like a meteor hitting a pond, creating a new plethora of challenges that incorporated into MBA curriculum for years to come. Read Now

  • First Responders Give NIST Their Communications Tech Wish Lists

    First Responders Give NIST Their Communications Tech Wish Lists

    Our first responders have spoken. An extensive research project conducted by experts at the National Institute of Standards and Technology (NIST) reveals what our country’s police, fire, emergency medical and 911 dispatch responders think about the communications technology they use on a regular basis and how they would like developers to improve it in the future. Read Now

Featured Cybersecurity

New Products

  • Tyco Kantech EntraPass security management software

    Tyco Kantech EntraPass security management software

    Johnson Controls, the global leader in smart, healthy and sustainable buildings, and architect of the Open Blue digital connected platforms, has released the newest version of the Tyco Kantech EntraPass security management software. 3

  • LiftMaster Garage Door Opener

    LiftMaster Garage Door Opener

    LiftMaster Transforms the Garage Door Opener Into a Sleek Smart Home Device That Does More Than Open and Close the Garage Door 3

  • Schlage RC reader controller

    Schlage RC Reader Controller

    This new innovative device combines the power of the Pure IP™ access control technology pioneered by ISONAS with Schlage’s intelligent hardware and credentials, delivering a comprehensive and cost-effective perimeter solution to customers. 3