From Physical To Cyber
Locking down network video surveillance
- By Steve Surfaro
- Apr 01, 2012
Both physical security and IT professionals place great importance on cyber security. When it comes to protecting people and assets in 2012—as PhySec systems are increasingly moving into the all-digital realm—the data created by video and access control communications falls under the cyber umbrella, and both camps must be well-versed in the threats of the other.
In fact, ASIS International President Eduard Emde, CPP, stated in a recent interview that he was “convinced that 2012 will continue to be dominated by all facets of cyber-related security risks.” In another recent piece of news, the ASIS International 58th Annual Seminar and Exhibits and (ISC)2, the world’s largest not-for-profit membership body of certified information security professionals, announced that the second annual (ISC)2 Security Congress will be collocated with ASIS in Philadelphia in 2012. This places greater emphasis on the increasing importance and interdependence of both physical and Information Systems Security in the network ecosystem.
But why now? Why the seemingly sudden need to educate the respective security owners—logical and physical—on what the other hand is doing? It’s simple: physical security is moving toward intelligent devices. Intelligence devices produce data and provide a portal into the enterprise infrastructure. Both the data and the portal must be protected.
Network video surveillance systems are composed of “edge” devices, such as network cameras and encoders that produce video content, and metadata, control, analysis, media search and content management, storage and display components. Physical and logical infrastructure provides connectivity between categories and also conforms to useful standards (e.g., 802.1x and port-based network access control). This ensures a user or device cannot make a full network connection until he or it is properly authenticated.
To the IT-focused world, the cameras, encoders and readers will be just another node on the network (when it comes to securing their infrastructure, that is). Thus, the physical security practitioner must be able to relate to the need for proper authentication.
Authenticate for a Secure State
Aside from making their IT counterparts happy, physical security practitioners, too, need to understand the importance of protecting their data—namely the video and its quality.
An important trend in IP video development is the increase in the power and sophistication of today’s network video cameras, making them small computers, complete with solid-state storage, room for on-board security, video content analysis apps, and enhanced image processing. Improving the fidelity of the video content right at the source provides the physical security industry with problem-solving technologies like wide dynamic range and improved ultra-low-light performance. With more important processes at these “non-person entities” and edge devices, it is vital that they be resistant to intrusion exploits and they achieve a trusted identity.
To date, most physical security practitioners and integrators practice some form of logical security with password protection and user-assigned permissions. Best practice dictates that the default passwords for network-connected physical security devices (cameras, encoders, etc.) be changed upon installation. However, as the industry moves to all-IP and the IT world becomes increasingly more influential in the installation and maintenance of surveillance systems, the physical world must abide by IT security best practices: namely, authentication and standards acceptance.
The National Institute of Standards (NIST) recently published an education video illustrating how the National Strategy for Trusted Identities in Cyberspace will work. The goal is to establish identity solutions and privacy-enhancing technologies that will improve security by authenticating individuals and infrastructure. In this structure, the selection of secure and independent identity providers is followed by users proving their identity and the provider issuing a trusted credential.
Users, especially in the government arena, have started to apply this structure to network video. Cameras and encoders will be expected to run a cryptographic application that communicates to a digital certificate authority that registers, validates and, in some cases, revokes the network device’s access to core digital video services.
Just like the mobile banking customer who must answer security questions and validate site keys, the network video camera will “prove” its identity through this validation process. The world of “non-person entities” can also include Voice over IP (VoIP) communications, electronic access control readers, intelligent perimeter sensors and mobile devices. A secure application on a smartphone can initiate a payment of funds to a quickserve establishment’s owner/operator while decoding video and statistical content such as customer volume from the “meta” or “feature” data.
For the world of video, not only does this methodology protect camera streams from being accessed and the cameras themselves from being controlled, but recordings that reside on the server are safe. If unauthorized access does occur, steps can be taken to corrupt the video file so it is unplayable for the hacker.
Permission to Come Aboard: How it Works
The specification of a network video surveillance system architecture and function, together with the authentication requirements, can enhance the definition of use cases—which in the IT/ software/engineering realm means a list of steps that define interactions between a “role” (a human, camera, etc.) and the system as a whole.
The network video authentication requirements can be looked at on a step-by-step basis:
- Verify the network video plus metadata or “Digital Multimedia Content” (DMC) source(s) with Network Intrusion Detection Systems (IDS) and Network Management Systems (NMS) for authorized consumption of network resources.
- Provision the appropriate DMC-source(s) network resources in accordance with NMS and Quality of Service (QoS) definitions, as defined by the user/integrator.
- Verify the DMC user/consumer(s) (such as smartphones and workstations) with IDS and NMS for authorized consumption of network resources (bandwidth, etc.) and access to DMC source(s).
- Process DMC-source(s) Public Key Infrastructure (PKI) certificate(s) and validate or reject, as required.
- Provision appropriate DMC user/consumer(s) network resources and DMC source(s) access in accordance with NMS, QoS definitions, local and global rules, and credential authorities. Establish the validity of the identity credential presented as part of the authentication transaction. Process DMC user PKI certificate(s) and validate or reject, as required using revocation status checking and certificate path validation.
- The DMC user/consumer(s) then can access DMC-source live
or recorded content.
Growing Need for Authentication
Network video allows police officers to be more operationally effective
in fighting crime. Video and Physical Security Information
Management (PSIM) applications are designed to give authorities
minute-by-minute situational awareness about public safety
and crime, as well as to a number of medical emergencies to
which officers respond on any given day. The flexibility and performance
of network security solutions are equally important to
the valuable content and intelligence these systems provide.
Therefore, the necessity of improved authentication in public
safety applications is becoming of greater importance. The Department
of Homeland Security’s “Hot Spots of Terrorism and
Other Crimes in the United States, 1970 to 2008” report, January
2012, illustrates the need for enhanced public safety through tools
like video surveillance in major cities such as New York, Miami,
Washington, D.C., Chicago, Los Angeles and San Francisco.
Nearly 30 percent of all attacks took place in just five counties in
the United States, permitting focused efforts of video surveillance
as forensic and observation tools.
Should a pen tester or hacker gain access to a law enforcement
vehicle or command center’s video content and surveillance device,
movements in real time can be tracked and security in these
areas of high risk become compromised. Video could also be potentially
altered, destroyed or lose the proper chain of custody.
This, of course, isn’t a new problem—and network cameras
and encoders today have the same IT security protocols and certificates
in place as any other network-connected device—but as
more physical security devices connect to the network and practitioners
increase their use of critical digital surveillance, increased
digital security must be considered.
Even at the Consumer Electronics Show in January 2012, a
“Digital Health Summit” showed how doctors are using technology
to eliminate distance and borders and be preventative in
their treatment approach. Network video will enhance this style
of treatment and require proven security. Of course, this type of
sensitive data must be protected not only for peace of mind but
also, in some cases, for compliance requirements.
And while authentication of devices provides an extra layer to
the system, it’s comforting to know that the validation of trusted
network devices also makes bandwidth management easier for
the IT administrators. It’s a logical companion to network management
systems, which is another point that will gain favor in the
growing IT/physical security management relationship.
Hackers will forever search for ways to compromise a system—
and unfortunately no network-connected system has proven unhackable.
Even today we see hackers targeting teleconferencing
systems. So as the inevitable use of IP-based
surveillance systems grows and becomes more
public, we can close the window of opportunity
on hacking threats through authentication before
This article originally appeared in the April 2012 issue of Security Today.
Steve Surfaro is an industry liaison at Axis Communications.