Hacked Off

Hacked Off

7 ways to protect security cameras from hackers

The digital writing is on the wall for the physical security industry. We’ve recently witnessed some of the biggest distributed denial of service (DDoS) attacks in history, facilitated by devices such as network security cameras. Yet while our industry is fairly good at anticipating and reacting to new physical security threats, we’ve been very slow to react to the clear and present danger from cybersecurity attacks.

There are myriad reasons for this, including lack of knowledge about how to properly secure cameras. So far, the camera attacks have been focused on disrupting the business of those other than the camera owner. With code floating around the Internet that breaks into poorly protected cameras, how long will it be before hackers modify that code to attack the camera’s owner?

What has become obvious in the last year is that simple devices such as security cameras must be installed and administered with cybersecurity in mind. Fortunately, while the risks are real, it doesn’t take a CCNA certification to apply cybersecurity defenses. Here are seven simple measures to take to protect your cameras, your network, your revenues, and your reputations.

Change Your Passwords

Many installed cameras are still using the manufacturer’s default passwords. Many others have weak passwords that are easy to guess. Hackers can easily exploit this by writing programs that try a list of default and common weak passwords very quickly, hoping to stumble on one that works.

Isolate Your Cameras

If criminals can’t talk to your cameras, they can’t attack them either. Do not put them on the corporate network with all of the other PCs and Workstations. Isolate them with a Virtual LAN (VLAN). Only the Video Management System (VMS) should be able to talk to them.

Lock Down the Network

Hackers can gain access to any camera on your network by unplugging any camera and replacing it with a laptop. Thwart this by configuring the network so that the only devices allowed to communicate over those ports are the cameras you installed. Each camera has a unique identifier called a MAC address. A network can be configured to only allow a certain MAC address on each port (a feature called MAC Binding). With this in place, all communications from other devices get thrown away, and the hacker gets a dead connection.

Use Two Logins for Each Camera

IT departments discovered a long time ago that computers should use at least two logins: a user with a minimal amount of privileges and an administration login with full privileges. This separation of users minimizes the chances of a frequently used login falling into the wrong hands. Cameras should be set up the same way: one login used by the VMS that allows for streaming video only, and an admin login that is only used on rare occasions, such as needing to update firmware.

Monitor for Unusual Events

Hacking often leaves signs. If a hacker unplugs a camera for nefarious purposes it will, of course, go offline. That said, the hacker may try to plug the camera back in, so you should regard even a short outage with suspicion. If a new set of firmware is uploaded, the camera will reboot.

Viruses often place a load on the camera and reduce performance. You might get lucky and notice one of these during your normal use of the system, but good security takes more than luck. The best practice is to set up the system to monitor for events like these with immediate notification.

Purchase Cameras from Reputable Companies

There is much concern over the security of certain brands of cameras. Most certainly, checking the “cyber reputation” of any system component vendor should be on your checklist prior to a major purchase. Look for vendors that have a public reputation for attention to proper cyber aware design. They should respond rapidly to any issues.

If you already have a significant investment in cameras from a less than trustworthy vendor, following these best-practice recommendations will significantly lower the risk.

Apply Automation

Automated cyber protection mechanisms can make the administration of these best practices scalable and automated. On the front end, automation tools can configure best practices such as enabling a protected VLAN for the security system and changing a camera’s default login credentials. Once the system is installed, automated cyber protections can also monitor network flows, detect abnormalities, and respond immediately to suspected attacks.

Don’t wait to be attacked to take proactive cybersecurity measures.

This article originally appeared in the September 2017 issue of Security Today.

Featured

  • A Break from Routine

    It was three years ago right about now that COVID was bringing the world to its knees. In mid-March of 2020, the president put travel restrictions on all flights in and out of Europe, the NBA suspended its season, and Tom Hanks announced that he’d tested positive for the disease—all in the same night. It was officially a national emergency two days later. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2023 Preview

    ISC West 2023 is right around the corner! This year’s trade show is scheduled from March 28–31 at the Venetian Expo in Las Vegas, Nevada. The Campus Security & Life Safety and Security Today staff will be on hand to provide live updates about the security industry’s latest innovations, trends, and products. Read Now

    • Industry Events
    • ISC West
  • Until We Meet Again

    A short three years ago we were all pondering whether to attend any tradeshows all thanks to COVID-19. Sorry to bring that nightmare up again, but it seems that little pandemic is in the rear-view mirror, and it’s time to meet again. Read Now

    • ISC West
  • Cyber Hygiene: What it Looks Like for IoT Devices

    Cyber Hygiene: What it Looks Like for IoT Devices

    For our second pillar about the Industrial Internet of Things (IIoT) Pillars of Security, we are going to discuss what cyber hygiene looks like for IoT devices. Read Now

Featured Cybersecurity

New Products

  • ABLOY IP54-rated Integrated Dust Cover

    ABLOY IP54-rated Integrated Dust Cover

    One of the things that keep security managers on high alert is the real possibility the security locks used to safeguard their properties may unexpectedly fail due to environmental conditions. 3

  • ComNet NW1 Gen 4

    ComNet NW1 Gen 4

    ComNet, Communication Networks, is announcing the introduction of its Generation 4 line of NetWave® wireless products that offer greater performance and increased stability in applications where throughput and increased bandwidth is increasingly important. 3

  • BIO-key MobileAuth

    BIO-key MobileAuth

    BIO-key International has introduced its new mobile app, BIO-key MobileAuth™ with PalmPositive™ the latest among over sixteen strong authentication factors available for BIO-key's PortalGuard® Identity-as-a-Service (IDaaS) platform. 3