Securing Cameras and Software Used in Physical Security During the Pandemic

While the global pandemic continues to disrupt business, cybersecurity threats increase as companies and workers become even more dependent on digital workflows and tools. Some hackers are leveraging the pandemic as an additional means to spread malware and ransomware. With empty buildings and the rush to enable remote access, it’s never been more important to protect security cameras and accompanying infrastructure from threats.

An ideal situation for a hacker is to gain access to an organization’s internal protected network by exploiting a network device. Once inside, they try to find valuable information. Some of the most serious threats come from installed ransomware which can make every file on infected machines encrypted with a key that only the hacker can unlock in exchange for payment. Since these types of attacks can cripple a business, it’s important to not let the security system be the way they gain access.

Who’s Responsible for Cybersecurity?

Everyone is responsible for cybersecurity at some level. The manufacturer of cameras and other devices, the systems integrator that installs and maintains the system and the end user or IT manager where the system is installed. If any of these stakeholders becomes a weak link in the chain, it can compromise the rest, regardless of how responsibly they’ve tried to build their part of the solution. There are multiple aspects to consider including the camera itself, the network infrastructure and utilizing cybersecurity best practices across the board.

The Camera and other Devices

It’s vital to have confidence in the security of devices themselves. With cameras, it is important to know as much as possible about the manufacturing process and supply chain in regards to internal components. What chipset is used, where was it made and who made it? Is it an OEM or white label product versus an actual manufacturer developed and designed product? These are important factors that can impact the underlying security of a device. You can do your best to secure the network, but, if you don’t know what’s going on inside the device, those efforts could be wasted.

IoT devices are everywhere. In the business world, we have thermostats and control systems, clocks, TV and displays, everything is an IoT device. California took a good first step with the California IoT security law with regard to not having default passwords on these devices, but it will take time to be implemented. Despite these efforts, we're still going to see low-cost, cheap products that are not conforming. So, it’s critical to discover improperly designed devices and not properly locked down as a result. If an organization wants to install a low-cost solution, it might solve a need initially, but the product might not receive support or updates and patches for vulnerabilities going forward.

Hanwha is working on cameras featuring OTP (One Time Program) hardware. This feature burns certain unique pieces of information like decryption keys into the Wisenet chip during manufacturing. When firmware is installed and a certificate is verified, it uses these keys that can never be reprogramed. A manufacturer that’s not building its own chip typically doesn't have that capability. This creates a trusted platform module that separates the end user facing sides of the camera application from the network (Linux). If a malicious user gets access to certain pieces, it makes it one step harder because there is type of firewall physically isolating them. Another cybersecurity feature is called Secure Boot. When the camera is booted up, it verifies these signatures in the boot image in its secure operating system and then runs Linux on top of that for the network interface. This is another way to isolate Linux from the chipset and decryption keys.

Best Practices

A fundamental best practice involves segregating networks to keep cameras and supporting infrastructure separate from a business’ primary network and off the internet entirely whenever possible. This is also the best way to protect critical systems from ransomware attacks. Similarly, any security device utilizing Wi-Fi should be on a completely separate Wi-Fi network that doesn't have access to anything else. This exposes fewer devices, making your overall attack surface smaller. If you have a VMS, it accesses both cameras and the outside world, so that is your bridge. Not having all your cameras exposed directly is a great strategy. In terms of the devices themselves, best practices that have been around a long time include turning off protocols, functions, ports and services you don't need. Best practice also means having these features turned off by default so that default deployments aren’t at risk out of the box.

Beyond the security devices themselves, social engineering is used by hackers to convince users to click on links they shouldn’t. It’s critical that security operators not “surf the web” on VMS workstations and servers.

The Cloud

There's plenty of momentum behind utilizing the cloud for remote access of video assets, which can be good and bad when it comes to cybersecurity. It’s important to think about the cloud in terms of who is managing the datacenter, where the data physically resides and who owns it? Is it encrypted properly? Is it secured properly? Because the last thing we want is to use the cloud for remote access when a breach occurs making it even easier for someone to access a system. Using the cloud to remotely manage and connect to VMS systems and mobile apps is a great way to remotely manage security systems. Where we want to be particularly cautious is having cloud access directly to each individual camera.


You can turn on encryption in your cameras using certificates and secure communications protocols. Some enterprises will insist that devices support HTTPS, SSL or TLS. Plenty of VMSs still don't support encrypted communications and for those that do, they may only encrypt the communication channel or the API, not the actual video. So, when looking at VMS cybersecurity, looking at the total solution is important. Does this vendor provide end to end encryption? That's particularly important when looking at enterprise installations or remote deployments when you’re pulling in cameras from offsite locations.

Cybersecurity Is an Ongoing Process

Installing a secure device on a secure network following best practices is great, but it doesn’t end there. Exploits evolve over time and weaknesses are going to be found. Savvy manufacturers employ outside “white hat” hackers to try and break into their devices. As weaknesses are discovered, a reputable manufacturer will issue firmware updates addressing any weaknesses which must be rolled out.

When a manufacturer has a new firmware update, how do you find out? This is an important consideration and some vendors have made the process easy for integrators and end users. For a small business owner with a handful of cameras, installing a firmware update might be trivial. However, for enterprise scale rollouts, you need to be able to deploy updates quickly, easily and accurately with a tool that can install updates in bulk. Make sure your chosen vendor has software to update all of your cameras in the most efficient way possible.

Don’t fall behind in your knowledge. Continue to research and attend webinars on cybersecurity best practices. Read whitepapers, study hardening guides and other reference materials. The more you know about cybersecurity, the more valuable you can be to your organization and your organization’s customers.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • ResponderLink


    Shooter Detection Systems (SDS), an company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3