Shopping for Cybersecurity Assurance

Shopping for Cybersecurity Assurance

Four questions every integrator should be asking their video surveillance providers

Walk into any grocery store today and you’ll see shelves of products claiming to be “organic” and “natural”, but, if you carefully inspect the ingredients, it becomes evident that most of the products are neither natural nor organic. Shoppers need to do their homework and look beyond the shiny labels. Security integrators are in a similar situation when it comes to cybersecurity.

An afterthought for most security integrators a decade ago, cybersecurity is now understood to be inseparable from effective physical security. How should integrators and business customers assess the cybersecurity credentials of their video surveillance providers? They need to be smart shoppers, ask the right questions, read the fine print, and get to know some of the basics of cybersecurity standards and certifications. For starters, here are four questions that every security integrator should be asking their prospective video surveillance partners.

1. Are automatic updates part of your video surveillance system?

Think about who is responsible for ensuring that on-site video surveillance equipment has the latest cybersecurity patches and updates. Even with heightened cybersecurity awareness, cybersecurity responsibilities are still not clearly delineated today: Integrators often assume it’s an end user’s responsibility, and the end user assumes the security integrator is taking care of cybersecurity.

There are many notable exceptions. Many businesses have IT departments who scan their networks and proactively maintain all systems on their networks. Likewise, some security integrators, especially those who came from the IT world, offer cybersecurity services to their customers.

Nevertheless, the reality is that onsite video surveillance equipment is often not regularly patched and updated. No one thinks about it–at least not until a breach occurs.

This is where automatic updates come in. Ask your video surveillance provider if they offer “continuous delivery” of all updates and features as they become available via the cloud. Resellers and end users can both sleep easier knowing that the latest cybersecurity updates are taken care of by the cloud provider. Automatic updates are also a valuable built-in service that resellers can deliver to their customers without any extra work or cost.

2. Does your video surveillance system include health monitoring?

One of the downsides of traditional on-premises video surveillance systems is that when your video is stored on an NVR, a criminal can grab the NVR and literally walk out the door with your data. That’s not possible with cloud video surveillance because your video is safely stored in the cloud. You can’t steal the cloud.

While there are countless examples of NVRs being stolen, there are other nuances to consider with the NVR versus cloud video surveillance question. Generally when data is lost on an NVR, it’s because a problem with the system has gone undetected (someone forgot to back up the video or the NVR wasn’t programmed correctly). The problem goes unnoticed and is only discovered at the worst possible time–when an incident has occurred and the business owner needs specific video. Searching for video, the security director learns that the video was lost or was never recorded.

To avoid that situation, integrators should ask their video surveillance providers if they offer video management system (VMS) health monitoring. Health monitoring will instantly alert the reseller and/or the end user if cameras go offline. Health monitoring is designed to minimize the risk of losing video because of system error, but it’s also helpful in understanding if there’s a cybersecurity issue.

3. Can your cloud video surveillance system isolate cameras from the internet?

Numerous high profile cybersecurity breaches have made it clear that any internet-connected device that is infected with malware or hacked can be used as a vector to cause major disruptions to their business and beyond.

Security cameras are IoT devices, and, like any IoT device, they can be compromised, or infected with malware intentionally or unintentionally. The last thing any business wants is an infected IoT device on their network.

Fortunately, it is possible to lock down security cameras that are connected to your VMS, ensuring that any camera--even cameras that are infected with malware--cannot transmit that virus to your network. Cameras can also be locked down to ensure that no data is transmitted out to other destinations.

Ask your video surveillance provider if they can lockdown your cameras, blocking them from communicating with the internet, stopping them from being attacked and compromised, and ensuring that any trojans that may have been implanted in the camera cannot communicate with the internet.

4. Which cybersecurity certification and audits does your video surveillance provider have?

As an integrator, you want to be confident that your cloud provider has built the most cyber secure platform, but you also want to know that you can trust your cloud provider to be a good steward with your customers’ data. Certifications such as SOC 2 Type 2 and ISO 27001:2013 provide independent third-party verification that your vendor has processes and procedures in place to securely protect and manage data. These audits are rigorous evaluations that take more than six months to complete.

If your provider is touting SOC 2 Type 2 and ISO 27001:2013, that’s very good news, but it’s essential to ask who holds the certifications. Is it your cloud video surveillance provider, or is the certification held by one of their vendors? For example, some cloud video surveillance providers use a public cloud to run their software, but it’s the public cloud company–not the cloud video surveillance provider–who has the SOC 2 Type 2 certification.

Integrators need to understand that a public cloud company’s certifications do not apply to their customers’ cybersecurity and data privacy practices and procedures. To ensure your cloud provider is compliant with a certification, they need to pass the audit themselves.

Security integrators who are smart shoppers that take the time to carefully assess the cybersecurity credentials of their video surveillance partners will help move the video surveillance industry forward, protecting their customers, their own business, and the health of the internet.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3