Page 2 of 2
Securing Cameras and Software Used in Physical Security During the Pandemic
Best Practices
A fundamental best practice involves segregating networks to keep cameras and supporting infrastructure separate from a business’ primary network and off the internet entirely whenever possible. This is also the best way to protect critical systems from ransomware attacks. Similarly, any security device utilizing Wi-Fi should be on a completely separate Wi-Fi network that doesn't have access to anything else. This exposes fewer devices, making your overall attack surface smaller. If you have a VMS, it accesses both cameras and the outside world, so that is your bridge. Not having all your cameras exposed directly is a great strategy. In terms of the devices themselves, best practices that have been around a long time include turning off protocols, functions, ports and services you don't need. Best practice also means having these features turned off by default so that default deployments aren’t at risk out of the box.
Beyond the security devices themselves, social engineering is used by hackers to convince users to click on links they shouldn’t. It’s critical that security operators not “surf the web” on VMS workstations and servers.
The Cloud
There's plenty of momentum behind utilizing the cloud for remote access of video assets, which can be good and bad when it comes to cybersecurity. It’s important to think about the cloud in terms of who is managing the datacenter, where the data physically resides and who owns it? Is it encrypted properly? Is it secured properly? Because the last thing we want is to use the cloud for remote access when a breach occurs making it even easier for someone to access a system. Using the cloud to remotely manage and connect to VMS systems and mobile apps is a great way to remotely manage security systems. Where we want to be particularly cautious is having cloud access directly to each individual camera.
Encryption
You can turn on encryption in your cameras using certificates and secure communications protocols. Some enterprises will insist that devices support HTTPS, SSL or TLS. Plenty of VMSs still don't support encrypted communications and for those that do, they may only encrypt the communication channel or the API, not the actual video. So, when looking at VMS cybersecurity, looking at the total solution is important. Does this vendor provide end to end encryption? That's particularly important when looking at enterprise installations or remote deployments when you’re pulling in cameras from offsite locations.
Cybersecurity Is an Ongoing Process
Installing a secure device on a secure network following best practices is great, but it doesn’t end there. Exploits evolve over time and weaknesses are going to be found. Savvy manufacturers employ outside “white hat” hackers to try and break into their devices. As weaknesses are discovered, a reputable manufacturer will issue firmware updates addressing any weaknesses which must be rolled out.
When a manufacturer has a new firmware update, how do you find out? This is an important consideration and some vendors have made the process easy for integrators and end users. For a small business owner with a handful of cameras, installing a firmware update might be trivial. However, for enterprise scale rollouts, you need to be able to deploy updates quickly, easily and accurately with a tool that can install updates in bulk. Make sure your chosen vendor has software to update all of your cameras in the most efficient way possible.
Don’t fall behind in your knowledge. Continue to research and attend webinars on cybersecurity best practices. Read whitepapers, study hardening guides and other reference materials. The more you know about cybersecurity, the more valuable you can be to your organization and your organization’s customers.
About the Author
Aaron Saks is the product and technical manager at Hanwha Techwin America.