Dispelling the Myths

Dispelling the Myths

Bad practices still in use that put people and assets at risk

We hear the term “best practices” a lot, but the truth is, there are still plenty of bad practices in use that put people and assets at risk every day. Many of those bad practices are grounded in one or more of the following myths that commonly lure people and organizations into a false sense of security. Don’t let these myths be responsible for a breach or an attack via edge devices. Here are five common myths that deserve to be busted once and for all.

1. Micro-segmentation alleviates risk. This myth is based on the opinion that “if I create a security system network that is segmented from the operational network, then the devices in this segment are not at risk. No one can access these devices on my network.”

While segmenting the security network from the operational network is a good practice, it is far from a bulletproof cyber security strategy. Back in the early days of the analog to IP transition, a systems integrator (SI) would use segmentation as a way to appease IT departments. DVRs commonly had two network interface cards, one for the device network and one for the operational network, so IT departments felt confident in only having to monitor two connections.

Unsurprisingly, this became a best practice for decades. In truth, it is easy to improperly create a segmented network that exposes backdoors. As more operational technology and industrial IoT gets connected, it’s clear that the internet is far from the only attack vector. There are plenty of insider threats to consider along with innocent mistakes when users, just trying to get something to work, assume that if it has Wi-Fi or an Ethernet jack they can just plug it in.

Take any of the above and sprinkle it with a “set it and forget it” mentality, it becomes paramount to go beyond simply segmenting a network to be truly secure.
 
2. Life cycle management. If it’s is not broken, then don't fix it. It can be a tough one to crack for many organizations. Unfortunately, “if it’s not broken, then don’t fix it” typically leads to a “we don’t need to update the firmware” mindset. This myth also encompasses a “products don’t need to be cycled out if they are still working” sentiment.

Without robust life cycle management of security devices, exploits and backdoors that hackers expose only increase the vulnerability of these devices over time. A critical part of any cyber secure implementation is ensuring devices are updated with the latest firmware so that any known weak points are patched. It is the manufacturers’ responsibility to keep their devices secure, but it’s also the integrators’ responsibility to keep systems they support up to date.

Finally, no life cycle management would be complete without a strategy for changing out end-of-life or end-of-support devices. In either case, just because it is still running is not a reason to leave it on the network.
 
3. Identity management. One admin account is fine for all. This myth is more commonly believed than you might think. The thought is that one admin account can be used across an SI or end user’s entire installed base. The thinking seems to be that such an account is secure because it’s not with the end user or at least not with day-to-day users.

Like everything else, usernames and passwords must be properly managed. A best practice is to create multiple usernames and passwords so that the VMS connects with one username/password combination, the IT department has another, and the contracted maintenance techs have their own too. This helps a device log discern if something has changed or happened and which account was involved. Sadly, in the security industry this rarely happens.

It is typically one admin account for all devices which is not adequate. Admin privileges should only be reserved for those who understand network security management. We’ve even seen the same username and password used for every account that an SI services. In this case, the SI believed this made it secure since it was “their” password (used across hundreds of sites) and not the end users.

As privacy concerns arise, it is also important to demonstrate that not everyone has the same privileges to view security footage. The principle of least privilege states that a subject should only be given those privileges required to complete its task. As an example, privacy masking at the edge is a popular way to blur faces captured on security cameras. Only certain senior-level users or admins should have the privileges required to expose identities or view certain streams as part of a documented event. This demonstrates accountability within operations and security departments and goes a long way towards building good will.

4. No one can use an end-point device as an attack vector. It can be hard to imagine, with so many attack vectors out there (malware, ransomware, phishing, and compromised or weak credentials), that a network camera would be a legitimate target that hackers would seek out. In fact, the exponential growth of IoT devices on corporate networks has made end-point devices a major target for bad individuals both inside and outside of a company.

Not long ago, a major manufacturer suffered a Distributed Denial of Service (DDOS) attack that was waged in part from another company’s unsecured cameras that were co-opted by a botnet. The vulnerability of those cameras had been previously detected, and the camera manufacturer had issued a firmware patch to address the weak point, but unfortunately, it had not been applied.

When it comes to ensuring cyber security for end-point devices, everyone shares some of the responsibility. The manufacturer must ensure that their device is properly designed to thwart attempts to gain access to the camera or its accompanying network infrastructure. If a vulnerability is discovered, it is the manufacturer’s responsibility to address the situation, issue an update that remedies the problem and notify their suppliers and partners.

Once such an update is available, it’s the responsibility of the reseller or integrator to notify end users that the update is available and ensure that it is installed. This is also why it’s so important to have a service contract in place that provides continual maintenance and updates. The end user is also responsible for making sure their devices are regularly inspected and adheres to any regulations or best practices that their industry requires.

5. Data in the cloud is safe and secure. This popular myth is based on the belief that when utilizing a cloud-based security system, it is solely the cloud provider’s responsibility to ensure everything is cyber secure. While it is true that the cloud provider is responsible for the security of their datacenter, the access to media on the cloud is still in the domain of the user.

Not long ago, a cloud-based security provider suffered a major breach because super admin-level credentials were widely shared by more than 100 employees. Those credentials ended up online, which let hackers have access to more than 150,000 cameras. The best things about the cloud (scale) can also be the worst things about the cloud when things go wrong. So, it is paramount to choose a cloud provider with a proven track record of cyber security that uses best practices for how data is accessed.

Cloud vendors can vary widely regarding the levels of protection offered. It is critical to conduct due diligence and understand what your service level agreement (SLA) is with a cloud provider. There are different SLAs for different types of clouds. For example, if you're using a cloud provider just as a container, then typically you're responsible for all of the security.

It is advisable to perform a security-focused vendor assessment, such as the one created by the National Institute of Standards and Technology (NIST), prior to signing up with a cloud provider. Are they Criminal Justice Information Service (CJIS) or System and Organization Controls (SOC) compliant? How do they vet their employees? How do you ensure that your data isn’t mixed with other people’s data? How do they manage access control so that only the authorized people have access to your content?

Many verticals have their own methods for vendor assessment such as HECVAT for education and HITRUST for health care. If you’re in a regulated environment, you need to ensure that whatever design implementation, policy or process that you are required to adhere to is represented in the cloud workflow you adopt.

There are plenty of myths and long-held beliefs in our industry about how to best protect security systems and network infrastructure. Some of these may have represented adequate protection years ago, but as we all know, technology evolves quickly, and with it, so do the tools and techniques designed to take advantage and exploit any perceived weaknesses.

In our rush to make things work and move onto the next task, it can be tempting to take shortcuts and calculated risks that may seem unlikely to result in a serious event. We’ve also heard from people that no one could possibly care about these mundane video feeds — until they are forced to — when a company’s intellectual property is compromised, or someone uses an unprotected device to inject malware and ransomware that brings an organization to its knees.

With everything you do to help protect people and assets, don’t toss it down the drain by relying on outdated information. Make it a priority to stay on top of the basics of cyber security.

This article originally appeared in the September / October 2022 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Busy South Africa Building Integrates Custom Access Control System

    Nicol Corner, based in Bedfordview, Johannesburg, South Africa, is home to a six-star fitness club, prime office space, and an award-winning rooftop restaurant. This is the first building in South Africa to have its glass façade fully incorporate fritted glazing, saving 35% on energy consumption. Nicol Corner (Pty) LTD has developed a landmark with sophisticated design and unique architecture by collaborating with industry-leading partners and specifying world-class equipment throughout the project. This includes installing a high-spec, bespoke security and access control system. Read Now

  • Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

Featured Cybersecurity

Webinars

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3