Shopping for Cybersecurity Assurance

Shopping for Cybersecurity Assurance

Four questions every integrator should be asking their video surveillance providers

Walk into any grocery store today and you’ll see shelves of products claiming to be “organic” and “natural”, but, if you carefully inspect the ingredients, it becomes evident that most of the products are neither natural nor organic. Shoppers need to do their homework and look beyond the shiny labels. Security integrators are in a similar situation when it comes to cybersecurity.

An afterthought for most security integrators a decade ago, cybersecurity is now understood to be inseparable from effective physical security. How should integrators and business customers assess the cybersecurity credentials of their video surveillance providers? They need to be smart shoppers, ask the right questions, read the fine print, and get to know some of the basics of cybersecurity standards and certifications. For starters, here are four questions that every security integrator should be asking their prospective video surveillance partners.

1. Are automatic updates part of your video surveillance system?

Think about who is responsible for ensuring that on-site video surveillance equipment has the latest cybersecurity patches and updates. Even with heightened cybersecurity awareness, cybersecurity responsibilities are still not clearly delineated today: Integrators often assume it’s an end user’s responsibility, and the end user assumes the security integrator is taking care of cybersecurity.

There are many notable exceptions. Many businesses have IT departments who scan their networks and proactively maintain all systems on their networks. Likewise, some security integrators, especially those who came from the IT world, offer cybersecurity services to their customers.

Nevertheless, the reality is that onsite video surveillance equipment is often not regularly patched and updated. No one thinks about it–at least not until a breach occurs.

This is where automatic updates come in. Ask your video surveillance provider if they offer “continuous delivery” of all updates and features as they become available via the cloud. Resellers and end users can both sleep easier knowing that the latest cybersecurity updates are taken care of by the cloud provider. Automatic updates are also a valuable built-in service that resellers can deliver to their customers without any extra work or cost.

2. Does your video surveillance system include health monitoring?

One of the downsides of traditional on-premises video surveillance systems is that when your video is stored on an NVR, a criminal can grab the NVR and literally walk out the door with your data. That’s not possible with cloud video surveillance because your video is safely stored in the cloud. You can’t steal the cloud.

While there are countless examples of NVRs being stolen, there are other nuances to consider with the NVR versus cloud video surveillance question. Generally when data is lost on an NVR, it’s because a problem with the system has gone undetected (someone forgot to back up the video or the NVR wasn’t programmed correctly). The problem goes unnoticed and is only discovered at the worst possible time–when an incident has occurred and the business owner needs specific video. Searching for video, the security director learns that the video was lost or was never recorded.

To avoid that situation, integrators should ask their video surveillance providers if they offer video management system (VMS) health monitoring. Health monitoring will instantly alert the reseller and/or the end user if cameras go offline. Health monitoring is designed to minimize the risk of losing video because of system error, but it’s also helpful in understanding if there’s a cybersecurity issue.

3. Can your cloud video surveillance system isolate cameras from the internet?

Numerous high profile cybersecurity breaches have made it clear that any internet-connected device that is infected with malware or hacked can be used as a vector to cause major disruptions to their business and beyond.

Security cameras are IoT devices, and, like any IoT device, they can be compromised, or infected with malware intentionally or unintentionally. The last thing any business wants is an infected IoT device on their network.

Fortunately, it is possible to lock down security cameras that are connected to your VMS, ensuring that any camera--even cameras that are infected with malware--cannot transmit that virus to your network. Cameras can also be locked down to ensure that no data is transmitted out to other destinations.

Ask your video surveillance provider if they can lockdown your cameras, blocking them from communicating with the internet, stopping them from being attacked and compromised, and ensuring that any trojans that may have been implanted in the camera cannot communicate with the internet.

4. Which cybersecurity certification and audits does your video surveillance provider have?

As an integrator, you want to be confident that your cloud provider has built the most cyber secure platform, but you also want to know that you can trust your cloud provider to be a good steward with your customers’ data. Certifications such as SOC 2 Type 2 and ISO 27001:2013 provide independent third-party verification that your vendor has processes and procedures in place to securely protect and manage data. These audits are rigorous evaluations that take more than six months to complete.

If your provider is touting SOC 2 Type 2 and ISO 27001:2013, that’s very good news, but it’s essential to ask who holds the certifications. Is it your cloud video surveillance provider, or is the certification held by one of their vendors? For example, some cloud video surveillance providers use a public cloud to run their software, but it’s the public cloud company–not the cloud video surveillance provider–who has the SOC 2 Type 2 certification.

Integrators need to understand that a public cloud company’s certifications do not apply to their customers’ cybersecurity and data privacy practices and procedures. To ensure your cloud provider is compliant with a certification, they need to pass the audit themselves.

Security integrators who are smart shoppers that take the time to carefully assess the cybersecurity credentials of their video surveillance partners will help move the video surveillance industry forward, protecting their customers, their own business, and the health of the internet.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.