Shopping for Cybersecurity Assurance

Shopping for Cybersecurity Assurance

Four questions every integrator should be asking their video surveillance providers

Walk into any grocery store today and you’ll see shelves of products claiming to be “organic” and “natural”, but, if you carefully inspect the ingredients, it becomes evident that most of the products are neither natural nor organic. Shoppers need to do their homework and look beyond the shiny labels. Security integrators are in a similar situation when it comes to cybersecurity.

An afterthought for most security integrators a decade ago, cybersecurity is now understood to be inseparable from effective physical security. How should integrators and business customers assess the cybersecurity credentials of their video surveillance providers? They need to be smart shoppers, ask the right questions, read the fine print, and get to know some of the basics of cybersecurity standards and certifications. For starters, here are four questions that every security integrator should be asking their prospective video surveillance partners.

1. Are automatic updates part of your video surveillance system?

Think about who is responsible for ensuring that on-site video surveillance equipment has the latest cybersecurity patches and updates. Even with heightened cybersecurity awareness, cybersecurity responsibilities are still not clearly delineated today: Integrators often assume it’s an end user’s responsibility, and the end user assumes the security integrator is taking care of cybersecurity.

There are many notable exceptions. Many businesses have IT departments who scan their networks and proactively maintain all systems on their networks. Likewise, some security integrators, especially those who came from the IT world, offer cybersecurity services to their customers.

Nevertheless, the reality is that onsite video surveillance equipment is often not regularly patched and updated. No one thinks about it–at least not until a breach occurs.

This is where automatic updates come in. Ask your video surveillance provider if they offer “continuous delivery” of all updates and features as they become available via the cloud. Resellers and end users can both sleep easier knowing that the latest cybersecurity updates are taken care of by the cloud provider. Automatic updates are also a valuable built-in service that resellers can deliver to their customers without any extra work or cost.

2. Does your video surveillance system include health monitoring?

One of the downsides of traditional on-premises video surveillance systems is that when your video is stored on an NVR, a criminal can grab the NVR and literally walk out the door with your data. That’s not possible with cloud video surveillance because your video is safely stored in the cloud. You can’t steal the cloud.

While there are countless examples of NVRs being stolen, there are other nuances to consider with the NVR versus cloud video surveillance question. Generally when data is lost on an NVR, it’s because a problem with the system has gone undetected (someone forgot to back up the video or the NVR wasn’t programmed correctly). The problem goes unnoticed and is only discovered at the worst possible time–when an incident has occurred and the business owner needs specific video. Searching for video, the security director learns that the video was lost or was never recorded.

To avoid that situation, integrators should ask their video surveillance providers if they offer video management system (VMS) health monitoring. Health monitoring will instantly alert the reseller and/or the end user if cameras go offline. Health monitoring is designed to minimize the risk of losing video because of system error, but it’s also helpful in understanding if there’s a cybersecurity issue.

3. Can your cloud video surveillance system isolate cameras from the internet?

Numerous high profile cybersecurity breaches have made it clear that any internet-connected device that is infected with malware or hacked can be used as a vector to cause major disruptions to their business and beyond.

Security cameras are IoT devices, and, like any IoT device, they can be compromised, or infected with malware intentionally or unintentionally. The last thing any business wants is an infected IoT device on their network.

Fortunately, it is possible to lock down security cameras that are connected to your VMS, ensuring that any camera--even cameras that are infected with malware--cannot transmit that virus to your network. Cameras can also be locked down to ensure that no data is transmitted out to other destinations.

Ask your video surveillance provider if they can lockdown your cameras, blocking them from communicating with the internet, stopping them from being attacked and compromised, and ensuring that any trojans that may have been implanted in the camera cannot communicate with the internet.

4. Which cybersecurity certification and audits does your video surveillance provider have?

As an integrator, you want to be confident that your cloud provider has built the most cyber secure platform, but you also want to know that you can trust your cloud provider to be a good steward with your customers’ data. Certifications such as SOC 2 Type 2 and ISO 27001:2013 provide independent third-party verification that your vendor has processes and procedures in place to securely protect and manage data. These audits are rigorous evaluations that take more than six months to complete.

If your provider is touting SOC 2 Type 2 and ISO 27001:2013, that’s very good news, but it’s essential to ask who holds the certifications. Is it your cloud video surveillance provider, or is the certification held by one of their vendors? For example, some cloud video surveillance providers use a public cloud to run their software, but it’s the public cloud company–not the cloud video surveillance provider–who has the SOC 2 Type 2 certification.

Integrators need to understand that a public cloud company’s certifications do not apply to their customers’ cybersecurity and data privacy practices and procedures. To ensure your cloud provider is compliant with a certification, they need to pass the audit themselves.

Security integrators who are smart shoppers that take the time to carefully assess the cybersecurity credentials of their video surveillance partners will help move the video surveillance industry forward, protecting their customers, their own business, and the health of the internet.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Busy South Africa Building Integrates Custom Access Control System

    Nicol Corner, based in Bedfordview, Johannesburg, South Africa, is home to a six-star fitness club, prime office space, and an award-winning rooftop restaurant. This is the first building in South Africa to have its glass façade fully incorporate fritted glazing, saving 35% on energy consumption. Nicol Corner (Pty) LTD has developed a landmark with sophisticated design and unique architecture by collaborating with industry-leading partners and specifying world-class equipment throughout the project. This includes installing a high-spec, bespoke security and access control system. Read Now

  • Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

Featured Cybersecurity

Webinars

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3