Shopping for Cybersecurity Assurance

Shopping for Cybersecurity Assurance

Four questions every integrator should be asking their video surveillance providers

Walk into any grocery store today and you’ll see shelves of products claiming to be “organic” and “natural”, but, if you carefully inspect the ingredients, it becomes evident that most of the products are neither natural nor organic. Shoppers need to do their homework and look beyond the shiny labels. Security integrators are in a similar situation when it comes to cybersecurity.

An afterthought for most security integrators a decade ago, cybersecurity is now understood to be inseparable from effective physical security. How should integrators and business customers assess the cybersecurity credentials of their video surveillance providers? They need to be smart shoppers, ask the right questions, read the fine print, and get to know some of the basics of cybersecurity standards and certifications. For starters, here are four questions that every security integrator should be asking their prospective video surveillance partners.

1. Are automatic updates part of your video surveillance system?

Think about who is responsible for ensuring that on-site video surveillance equipment has the latest cybersecurity patches and updates. Even with heightened cybersecurity awareness, cybersecurity responsibilities are still not clearly delineated today: Integrators often assume it’s an end user’s responsibility, and the end user assumes the security integrator is taking care of cybersecurity.

There are many notable exceptions. Many businesses have IT departments who scan their networks and proactively maintain all systems on their networks. Likewise, some security integrators, especially those who came from the IT world, offer cybersecurity services to their customers.

Nevertheless, the reality is that onsite video surveillance equipment is often not regularly patched and updated. No one thinks about it–at least not until a breach occurs.

This is where automatic updates come in. Ask your video surveillance provider if they offer “continuous delivery” of all updates and features as they become available via the cloud. Resellers and end users can both sleep easier knowing that the latest cybersecurity updates are taken care of by the cloud provider. Automatic updates are also a valuable built-in service that resellers can deliver to their customers without any extra work or cost.

2. Does your video surveillance system include health monitoring?

One of the downsides of traditional on-premises video surveillance systems is that when your video is stored on an NVR, a criminal can grab the NVR and literally walk out the door with your data. That’s not possible with cloud video surveillance because your video is safely stored in the cloud. You can’t steal the cloud.

While there are countless examples of NVRs being stolen, there are other nuances to consider with the NVR versus cloud video surveillance question. Generally when data is lost on an NVR, it’s because a problem with the system has gone undetected (someone forgot to back up the video or the NVR wasn’t programmed correctly). The problem goes unnoticed and is only discovered at the worst possible time–when an incident has occurred and the business owner needs specific video. Searching for video, the security director learns that the video was lost or was never recorded.

To avoid that situation, integrators should ask their video surveillance providers if they offer video management system (VMS) health monitoring. Health monitoring will instantly alert the reseller and/or the end user if cameras go offline. Health monitoring is designed to minimize the risk of losing video because of system error, but it’s also helpful in understanding if there’s a cybersecurity issue.

3. Can your cloud video surveillance system isolate cameras from the internet?

Numerous high profile cybersecurity breaches have made it clear that any internet-connected device that is infected with malware or hacked can be used as a vector to cause major disruptions to their business and beyond.

Security cameras are IoT devices, and, like any IoT device, they can be compromised, or infected with malware intentionally or unintentionally. The last thing any business wants is an infected IoT device on their network.

Fortunately, it is possible to lock down security cameras that are connected to your VMS, ensuring that any camera--even cameras that are infected with malware--cannot transmit that virus to your network. Cameras can also be locked down to ensure that no data is transmitted out to other destinations.

Ask your video surveillance provider if they can lockdown your cameras, blocking them from communicating with the internet, stopping them from being attacked and compromised, and ensuring that any trojans that may have been implanted in the camera cannot communicate with the internet.

4. Which cybersecurity certification and audits does your video surveillance provider have?

As an integrator, you want to be confident that your cloud provider has built the most cyber secure platform, but you also want to know that you can trust your cloud provider to be a good steward with your customers’ data. Certifications such as SOC 2 Type 2 and ISO 27001:2013 provide independent third-party verification that your vendor has processes and procedures in place to securely protect and manage data. These audits are rigorous evaluations that take more than six months to complete.

If your provider is touting SOC 2 Type 2 and ISO 27001:2013, that’s very good news, but it’s essential to ask who holds the certifications. Is it your cloud video surveillance provider, or is the certification held by one of their vendors? For example, some cloud video surveillance providers use a public cloud to run their software, but it’s the public cloud company–not the cloud video surveillance provider–who has the SOC 2 Type 2 certification.

Integrators need to understand that a public cloud company’s certifications do not apply to their customers’ cybersecurity and data privacy practices and procedures. To ensure your cloud provider is compliant with a certification, they need to pass the audit themselves.

Security integrators who are smart shoppers that take the time to carefully assess the cybersecurity credentials of their video surveillance partners will help move the video surveillance industry forward, protecting their customers, their own business, and the health of the internet.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West: Day 2

    What a great show ISC West 2024 has been so far. The second day on Thursday was as busy or even more hectic than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Sands Expo, because there’s more news coming out than anyone could be expected to keep track of. Read Now

    • Industry Events
    • ISC West
  • A Unique Perspective on ISC West 2024

    Navigating a tradeshow post-knee surgery can be quite the endeavor, but utilizing an electric scooter adds an interesting twist to the experience. While it may initially feel like a limitation, it actually provides a unique perspective on traversing through the bustling crowds and expansive exhibition halls. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3