Making IP Video Cyber Secure

How financial institutions should be implementing video surveillance on their networks

Financial institutions have been historically slow to adopt IP video surveillance citing concerns about possibly compromising network security. But, in fact, there are steps institutions can take to harden network access through the camera so that the risk is no higher than any other devices attached to the company’s super information highway. Furthermore, the economic and operational advantages of going digital—from centralized storage to authorized real-time access through the cloud to remote diagnostics and remote maintenance—make a strong case for migration.

For the transition from analog to digital surveillance to go smoothly, however, corporate security officers need to work closely with their IT counterparts to better understand and align themselves with current network policies and standards. They need to convey bandwidth requirements for any new technology so that the network infrastructure can be designed to accommodate IP video traffic. And they need to work closely with manufacturers to understand the security features of the products they intend to install so that they can limit potential vulnerabilities to cyber threats.

Cyber Security: A Process Not a Product

Technology and features are important, but they won’t eliminate all risks or threats. According to a report issued by Trustwave Security, more than 90 percent of successful breaches are due to human error, poor configuration and poor maintenance, which is why it is so important to understand and rigorously adhere to corporate IT standards and policies when deploying any solution or device on the corporate network. This first line defense includes:

  • Strong password management:requires everyone to use strong or complex passwords with multiple characters, numbers and special symbols.
  • Common sense IT storage policies: restrict offloading sensitive files to unsecure locations like DropBox.
  • Timely patch downloads, consistent system upgrades and continuous virus protection updates.
  • Company-wide security education: embraces a security culture that teaches users to be more cautious and automatically report suspicious behavior.

With active cyber threat analysis, corporate security officers can identify potential risks and determine what steps should be taken for protection. Whether opportunistic or a targeted attack, it’s impossible to eliminate all risks. So it’s imperative to identify the institution’s “critical assets” and take aggressive measures to make their protection a priority.

While corporate policies and procedures for cyber security are all well and good, without someone to take ownership of their implementation they’re just empty words. It would be like putting a lock on the door and then leaving the key in it. Furthermore, instituting cyber security measures isn’t a one-and-done task. Systems need to be constantly audited to ensure everyone continues to adhere to cyber security measures and that those measures adapt to changing threats and risks. Risk and threat assessments need to be the standard and not an exception. In an environment that’s constantly changing, these processes need to be evaluated on a regular basis to ensure new potential threats have not emerged.

Video Cyber Security: Part of an Integrated Protection Strategy

Network cameras don’t determine the level of security on an institution’s network. They integrate into the security settings already in place. Therefore a corporate security officer should consider a number of factors when choosing an IP camera.

  • Security is a priority: The manufacturer should have a reputation for providing cameras with minimal exploitable flaws. The firmware and interfaces need to be robust and resilient. All components should be quality assurance validated. And the manufacturer should be keeping abreast of cybersecurity trends and updating their products in response.
  • Built on a standard platform: The camera and features should easily align with the organization’s infrastructure and IT policies. The platform kernel and services should be constantly monitored and updated when vulnerabilities and flaws come to light.
  • Ongoing support: The manufacturer/ integrator should provide assistance in configuring, managing and maintaining the camera for optimal benefit. As corporate security dives deeper into camera features and capabilities they should examine how they can be used to harden network protection. For instance, out of the box cameras come with default passwords and default settings. If left as is, they would certainly provide an exploitable path to the network.

As a standard level of protection, corporate security should review and establish configuration standards that should be implemented. This would include changing those defaults to strong passwords and implementing customized network settings for their specific network environment. They should also set the date and time parameters to establish an audit trail for any setting changes. Some of the other hardening measures network cameras should support include.

  • HTTPS encryption for network traffic
  • 802.1X protection against port hijacking.
  • Unique VMS/client account credentials.
  • Backup admin account credentials.
  • Disabling services that aren’t being used to prevent malware insertion
  • An IP address filter to precisely define what IP traffic can be received and sent by the router.
  • A remote syslog for auditing purposes
  • Certificates of authority for managing and authenticating permissions to access video .
  • Advanced compression algorithms like H.264, H.265 and Zipstream to minimize bandwidth consumption and storage.
  • Edge storage encryption for installations where recorded video needs to reside incamera for an extended length of time.
  • In the not-too-distant future, we’ll likely see IP cameras integrating with other common network security features such as: Active Directory for authenticating and authorizing who can access, install or update network camera settings.
  • Lightweight Directory Access Protocol (LDAP) for accessing and maintaining distributed director information services over the IP network. network[WU1].

Creating a Cyber Secure Ecosystem

A cyber secure ecosystems relies on the coordinated efforts of physical security and IT. If corporate security managers adhere to IT guidelines and best security practices when implementing their IP video surveillance system their solution won’t introduce any more vulnerability to the institution’s network than any other device attached to the backbone.

Bringing surveillance into the digital age provides significant advantages to both corporate security and the organization as a whole. First is the adoption of a technology based on open standards that can create greater long term value. In an analog technology world, video systems and sites usually operate as independent silos which require extra manpower to manage and retrieve information. These proprietary systems have limited scalability and don’t easily integrate across locations or with other security technologies such as fire detection and access control. As a result, unlike IP-based systems, their investment value tends to diminish as the institution grows and expands its portfolio of security tools.

With IP video, corporate security becomes a seamless part of the institution’s digital world and can be more agile and responsive to threats. IP video provides a security solution that easily scales and adapts as the business grows and the landscape of cyber threats continues to evolve.

This article originally appeared in the February 2017 issue of Security Today.

Featured

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

  • 2025 Security LeadHER Conference Program Announced

    ASIS International and the Security Industry Association (SIA) – the leading membership associations for the security industry – have announced details for the 2025 Security LeadHER conference, a special event dedicated to advancing, connecting and empowering women in the security profession. The third annual Security LeadHER conference will be held Monday, June 9 – Tuesday, June 10, 2025, at the Detroit Marriott Renaissance Center in Detroit, Michigan. This carefully crafted program represents a comprehensive professional development opportunity for women in security this year. To view the full lineup at this year’s event, please visit securityleadher.org. Read Now

    • Industry Events

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.