Securing Cameras and Software Used in Physical Security During the Pandemic

• By Aaron Saks
• Jun 01, 2020

While the global pandemic continues to disrupt business, cybersecurity threats increase as companies and workers become even more dependent on digital workflows and tools. Some hackers are leveraging the pandemic as an additional means to spread malware and ransomware. With empty buildings and the rush to enable remote access, it’s never been more important to protect security cameras and accompanying infrastructure from threats.

An ideal situation for a hacker is to gain access to an organization’s internal protected network by exploiting a network device. Once inside, they try to find valuable information. Some of the most serious threats come from installed ransomware which can make every file on infected machines encrypted with a key that only the hacker can unlock in exchange for payment. Since these types of attacks can cripple a business, it’s important to not let the security system be the way they gain access.

Who’s Responsible for Cybersecurity?

Everyone is responsible for cybersecurity at some level. The manufacturer of cameras and other devices, the systems integrator that installs and maintains the system and the end user or IT manager where the system is installed. If any of these stakeholders becomes a weak link in the chain, it can compromise the rest, regardless of how responsibly they’ve tried to build their part of the solution. There are multiple aspects to consider including the camera itself, the network infrastructure and utilizing cybersecurity best practices across the board.

The Camera and other Devices

It’s vital to have confidence in the security of devices themselves. With cameras, it is important to know as much as possible about the manufacturing process and supply chain in regards to internal components. What chipset is used, where was it made and who made it? Is it an OEM or white label product versus an actual manufacturer developed and designed product? These are important factors that can impact the underlying security of a device. You can do your best to secure the network, but, if you don’t know what’s going on inside the device, those efforts could be wasted.

IoT devices are everywhere. In the business world, we have thermostats and control systems, clocks, TV and displays, everything is an IoT device. California took a good first step with the California IoT security law with regard to not having default passwords on these devices, but it will take time to be implemented. Despite these efforts, we're still going to see low-cost, cheap products that are not conforming. So, it’s critical to discover improperly designed devices and not properly locked down as a result. If an organization wants to install a low-cost solution, it might solve a need initially, but the product might not receive support or updates and patches for vulnerabilities going forward.

Hanwha is working on cameras featuring OTP (One Time Program) hardware. This feature burns certain unique pieces of information like decryption keys into the Wisenet chip during manufacturing. When firmware is installed and a certificate is verified, it uses these keys that can never be reprogramed. A manufacturer that’s not building its own chip typically doesn't have that capability. This creates a trusted platform module that separates the end user facing sides of the camera application from the network (Linux). If a malicious user gets access to certain pieces, it makes it one step harder because there is type of firewall physically isolating them. Another cybersecurity feature is called Secure Boot. When the camera is booted up, it verifies these signatures in the boot image in its secure operating system and then runs Linux on top of that for the network interface. This is another way to isolate Linux from the chipset and decryption keys.

Best Practices

A fundamental best practice involves segregating networks to keep cameras and supporting infrastructure separate from a business’ primary network and off the internet entirely whenever possible. This is also the best way to protect critical systems from ransomware attacks. Similarly, any security device utilizing Wi-Fi should be on a completely separate Wi-Fi network that doesn't have access to anything else. This exposes fewer devices, making your overall attack surface smaller. If you have a VMS, it accesses both cameras and the outside world, so that is your bridge. Not having all your cameras exposed directly is a great strategy. In terms of the devices themselves, best practices that have been around a long time include turning off protocols, functions, ports and services you don't need. Best practice also means having these features turned off by default so that default deployments aren’t at risk out of the box.

Beyond the security devices themselves, social engineering is used by hackers to convince users to click on links they shouldn’t. It’s critical that security operators not “surf the web” on VMS workstations and servers.

The Cloud

There's plenty of momentum behind utilizing the cloud for remote access of video assets, which can be good and bad when it comes to cybersecurity. It’s important to think about the cloud in terms of who is managing the datacenter, where the data physically resides and who owns it? Is it encrypted properly? Is it secured properly? Because the last thing we want is to use the cloud for remote access when a breach occurs making it even easier for someone to access a system. Using the cloud to remotely manage and connect to VMS systems and mobile apps is a great way to remotely manage security systems. Where we want to be particularly cautious is having cloud access directly to each individual camera.

Encryption

You can turn on encryption in your cameras using certificates and secure communications protocols. Some enterprises will insist that devices support HTTPS, SSL or TLS. Plenty of VMSs still don't support encrypted communications and for those that do, they may only encrypt the communication channel or the API, not the actual video. So, when looking at VMS cybersecurity, looking at the total solution is important. Does this vendor provide end to end encryption? That's particularly important when looking at enterprise installations or remote deployments when you’re pulling in cameras from offsite locations.

Cybersecurity Is an Ongoing Process

Installing a secure device on a secure network following best practices is great, but it doesn’t end there. Exploits evolve over time and weaknesses are going to be found. Savvy manufacturers employ outside “white hat” hackers to try and break into their devices. As weaknesses are discovered, a reputable manufacturer will issue firmware updates addressing any weaknesses which must be rolled out.

When a manufacturer has a new firmware update, how do you find out? This is an important consideration and some vendors have made the process easy for integrators and end users. For a small business owner with a handful of cameras, installing a firmware update might be trivial. However, for enterprise scale rollouts, you need to be able to deploy updates quickly, easily and accurately with a tool that can install updates in bulk. Make sure your chosen vendor has software to update all of your cameras in the most efficient way possible.

Don’t fall behind in your knowledge. Continue to research and attend webinars on cybersecurity best practices. Read whitepapers, study hardening guides and other reference materials. The more you know about cybersecurity, the more valuable you can be to your organization and your organization’s customers.