Dispelling the Myths

Dispelling the Myths

Bad practices still in use that put people and assets at risk

We hear the term “best practices” a lot, but the truth is, there are still plenty of bad practices in use that put people and assets at risk every day. Many of those bad practices are grounded in one or more of the following myths that commonly lure people and organizations into a false sense of security. Don’t let these myths be responsible for a breach or an attack via edge devices. Here are five common myths that deserve to be busted once and for all.

1. Micro-segmentation alleviates risk. This myth is based on the opinion that “if I create a security system network that is segmented from the operational network, then the devices in this segment are not at risk. No one can access these devices on my network.”

While segmenting the security network from the operational network is a good practice, it is far from a bulletproof cyber security strategy. Back in the early days of the analog to IP transition, a systems integrator (SI) would use segmentation as a way to appease IT departments. DVRs commonly had two network interface cards, one for the device network and one for the operational network, so IT departments felt confident in only having to monitor two connections.

Unsurprisingly, this became a best practice for decades. In truth, it is easy to improperly create a segmented network that exposes backdoors. As more operational technology and industrial IoT gets connected, it’s clear that the internet is far from the only attack vector. There are plenty of insider threats to consider along with innocent mistakes when users, just trying to get something to work, assume that if it has Wi-Fi or an Ethernet jack they can just plug it in.

Take any of the above and sprinkle it with a “set it and forget it” mentality, it becomes paramount to go beyond simply segmenting a network to be truly secure.
 
2. Life cycle management. If it’s is not broken, then don't fix it. It can be a tough one to crack for many organizations. Unfortunately, “if it’s not broken, then don’t fix it” typically leads to a “we don’t need to update the firmware” mindset. This myth also encompasses a “products don’t need to be cycled out if they are still working” sentiment.

Without robust life cycle management of security devices, exploits and backdoors that hackers expose only increase the vulnerability of these devices over time. A critical part of any cyber secure implementation is ensuring devices are updated with the latest firmware so that any known weak points are patched. It is the manufacturers’ responsibility to keep their devices secure, but it’s also the integrators’ responsibility to keep systems they support up to date.

Finally, no life cycle management would be complete without a strategy for changing out end-of-life or end-of-support devices. In either case, just because it is still running is not a reason to leave it on the network.
 
3. Identity management. One admin account is fine for all. This myth is more commonly believed than you might think. The thought is that one admin account can be used across an SI or end user’s entire installed base. The thinking seems to be that such an account is secure because it’s not with the end user or at least not with day-to-day users.

Like everything else, usernames and passwords must be properly managed. A best practice is to create multiple usernames and passwords so that the VMS connects with one username/password combination, the IT department has another, and the contracted maintenance techs have their own too. This helps a device log discern if something has changed or happened and which account was involved. Sadly, in the security industry this rarely happens.

It is typically one admin account for all devices which is not adequate. Admin privileges should only be reserved for those who understand network security management. We’ve even seen the same username and password used for every account that an SI services. In this case, the SI believed this made it secure since it was “their” password (used across hundreds of sites) and not the end users.

As privacy concerns arise, it is also important to demonstrate that not everyone has the same privileges to view security footage. The principle of least privilege states that a subject should only be given those privileges required to complete its task. As an example, privacy masking at the edge is a popular way to blur faces captured on security cameras. Only certain senior-level users or admins should have the privileges required to expose identities or view certain streams as part of a documented event. This demonstrates accountability within operations and security departments and goes a long way towards building good will.

4. No one can use an end-point device as an attack vector. It can be hard to imagine, with so many attack vectors out there (malware, ransomware, phishing, and compromised or weak credentials), that a network camera would be a legitimate target that hackers would seek out. In fact, the exponential growth of IoT devices on corporate networks has made end-point devices a major target for bad individuals both inside and outside of a company.

Not long ago, a major manufacturer suffered a Distributed Denial of Service (DDOS) attack that was waged in part from another company’s unsecured cameras that were co-opted by a botnet. The vulnerability of those cameras had been previously detected, and the camera manufacturer had issued a firmware patch to address the weak point, but unfortunately, it had not been applied.

When it comes to ensuring cyber security for end-point devices, everyone shares some of the responsibility. The manufacturer must ensure that their device is properly designed to thwart attempts to gain access to the camera or its accompanying network infrastructure. If a vulnerability is discovered, it is the manufacturer’s responsibility to address the situation, issue an update that remedies the problem and notify their suppliers and partners.

Once such an update is available, it’s the responsibility of the reseller or integrator to notify end users that the update is available and ensure that it is installed. This is also why it’s so important to have a service contract in place that provides continual maintenance and updates. The end user is also responsible for making sure their devices are regularly inspected and adheres to any regulations or best practices that their industry requires.

5. Data in the cloud is safe and secure. This popular myth is based on the belief that when utilizing a cloud-based security system, it is solely the cloud provider’s responsibility to ensure everything is cyber secure. While it is true that the cloud provider is responsible for the security of their datacenter, the access to media on the cloud is still in the domain of the user.

Not long ago, a cloud-based security provider suffered a major breach because super admin-level credentials were widely shared by more than 100 employees. Those credentials ended up online, which let hackers have access to more than 150,000 cameras. The best things about the cloud (scale) can also be the worst things about the cloud when things go wrong. So, it is paramount to choose a cloud provider with a proven track record of cyber security that uses best practices for how data is accessed.

Cloud vendors can vary widely regarding the levels of protection offered. It is critical to conduct due diligence and understand what your service level agreement (SLA) is with a cloud provider. There are different SLAs for different types of clouds. For example, if you're using a cloud provider just as a container, then typically you're responsible for all of the security.

It is advisable to perform a security-focused vendor assessment, such as the one created by the National Institute of Standards and Technology (NIST), prior to signing up with a cloud provider. Are they Criminal Justice Information Service (CJIS) or System and Organization Controls (SOC) compliant? How do they vet their employees? How do you ensure that your data isn’t mixed with other people’s data? How do they manage access control so that only the authorized people have access to your content?

Many verticals have their own methods for vendor assessment such as HECVAT for education and HITRUST for health care. If you’re in a regulated environment, you need to ensure that whatever design implementation, policy or process that you are required to adhere to is represented in the cloud workflow you adopt.

There are plenty of myths and long-held beliefs in our industry about how to best protect security systems and network infrastructure. Some of these may have represented adequate protection years ago, but as we all know, technology evolves quickly, and with it, so do the tools and techniques designed to take advantage and exploit any perceived weaknesses.

In our rush to make things work and move onto the next task, it can be tempting to take shortcuts and calculated risks that may seem unlikely to result in a serious event. We’ve also heard from people that no one could possibly care about these mundane video feeds — until they are forced to — when a company’s intellectual property is compromised, or someone uses an unprotected device to inject malware and ransomware that brings an organization to its knees.

With everything you do to help protect people and assets, don’t toss it down the drain by relying on outdated information. Make it a priority to stay on top of the basics of cyber security.

This article originally appeared in the September / October 2022 issue of Security Today.

Featured

  • Survey: Less Than Half of IT Leaders are Confident in their IoT Security Plans

    Viakoo recently released findings from its 2024 IoT Security Crisis: By the Numbers. The survey uncovers insights from IT and security executives, exposes a dramatic surge in enterprise IoT security risks, and highlights a critical missing piece in the IoT security technology stack. The clarion call is clear: IT leaders urgently need to secure their IoT infrastructure one application at a time in an automated and expeditious fashion. Read Now

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3