Shopping for Cybersecurity Assurance

Four questions every integrator should be asking their video surveillance providers

• By Hans Kahler
• Oct 07, 2022

Walk into any grocery store today and you’ll see shelves of products claiming to be “organic” and “natural”, but, if you carefully inspect the ingredients, it becomes evident that most of the products are neither natural nor organic. Shoppers need to do their homework and look beyond the shiny labels. Security integrators are in a similar situation when it comes to cybersecurity.

An afterthought for most security integrators a decade ago, cybersecurity is now understood to be inseparable from effective physical security. How should integrators and business customers assess the cybersecurity credentials of their video surveillance providers? They need to be smart shoppers, ask the right questions, read the fine print, and get to know some of the basics of cybersecurity standards and certifications. For starters, here are four questions that every security integrator should be asking their prospective video surveillance partners.

1. Are automatic updates part of your video surveillance system?

Think about who is responsible for ensuring that on-site video surveillance equipment has the latest cybersecurity patches and updates. Even with heightened cybersecurity awareness, cybersecurity responsibilities are still not clearly delineated today: Integrators often assume it’s an end user’s responsibility, and the end user assumes the security integrator is taking care of cybersecurity.

There are many notable exceptions. Many businesses have IT departments who scan their networks and proactively maintain all systems on their networks. Likewise, some security integrators, especially those who came from the IT world, offer cybersecurity services to their customers.

Nevertheless, the reality is that onsite video surveillance equipment is often not regularly patched and updated. No one thinks about it–at least not until a breach occurs.

This is where automatic updates come in. Ask your video surveillance provider if they offer “continuous delivery” of all updates and features as they become available via the cloud. Resellers and end users can both sleep easier knowing that the latest cybersecurity updates are taken care of by the cloud provider. Automatic updates are also a valuable built-in service that resellers can deliver to their customers without any extra work or cost.

2. Does your video surveillance system include health monitoring?

One of the downsides of traditional on-premises video surveillance systems is that when your video is stored on an NVR, a criminal can grab the NVR and literally walk out the door with your data. That’s not possible with cloud video surveillance because your video is safely stored in the cloud. You can’t steal the cloud.

While there are countless examples of NVRs being stolen, there are other nuances to consider with the NVR versus cloud video surveillance question. Generally when data is lost on an NVR, it’s because a problem with the system has gone undetected (someone forgot to back up the video or the NVR wasn’t programmed correctly). The problem goes unnoticed and is only discovered at the worst possible time–when an incident has occurred and the business owner needs specific video. Searching for video, the security director learns that the video was lost or was never recorded.

To avoid that situation, integrators should ask their video surveillance providers if they offer video management system (VMS) health monitoring. Health monitoring will instantly alert the reseller and/or the end user if cameras go offline. Health monitoring is designed to minimize the risk of losing video because of system error, but it’s also helpful in understanding if there’s a cybersecurity issue.

3. Can your cloud video surveillance system isolate cameras from the internet?

Numerous high profile cybersecurity breaches have made it clear that any internet-connected device that is infected with malware or hacked can be used as a vector to cause major disruptions to their business and beyond.

Security cameras are IoT devices, and, like any IoT device, they can be compromised, or infected with malware intentionally or unintentionally. The last thing any business wants is an infected IoT device on their network.

Fortunately, it is possible to lock down security cameras that are connected to your VMS, ensuring that any camera--even cameras that are infected with malware--cannot transmit that virus to your network. Cameras can also be locked down to ensure that no data is transmitted out to other destinations.

Ask your video surveillance provider if they can lockdown your cameras, blocking them from communicating with the internet, stopping them from being attacked and compromised, and ensuring that any trojans that may have been implanted in the camera cannot communicate with the internet.

4. Which cybersecurity certification and audits does your video surveillance provider have?

As an integrator, you want to be confident that your cloud provider has built the most cyber secure platform, but you also want to know that you can trust your cloud provider to be a good steward with your customers’ data. Certifications such as SOC 2 Type 2 and ISO 27001:2013 provide independent third-party verification that your vendor has processes and procedures in place to securely protect and manage data. These audits are rigorous evaluations that take more than six months to complete.

If your provider is touting SOC 2 Type 2 and ISO 27001:2013, that’s very good news, but it’s essential to ask who holds the certifications. Is it your cloud video surveillance provider, or is the certification held by one of their vendors? For example, some cloud video surveillance providers use a public cloud to run their software, but it’s the public cloud company–not the cloud video surveillance provider–who has the SOC 2 Type 2 certification.

Integrators need to understand that a public cloud company’s certifications do not apply to their customers’ cybersecurity and data privacy practices and procedures. To ensure your cloud provider is compliant with a certification, they need to pass the audit themselves.

Security integrators who are smart shoppers that take the time to carefully assess the cybersecurity credentials of their video surveillance partners will help move the video surveillance industry forward, protecting their customers, their own business, and the health of the internet.