Protect Windows XP PRO CCTV System Being Hacked?

At a bare minimum make sure you are on whatever the latest service pack of Windows XP.

If you have the capabilities, you could disable incoming traffic on any ports that aren't specifically being used for the VMS software. Anti-virus is another option, but doesn't necessarily stop the server from being hacked. Ultimately there is no way to make an OS hack-proof, and unfortunately they are running one of the hardest to even get in the ballpark at this point.

If you've implremented a firewall, password protection, an antivirus maybe and maybe even gone as far as disabling File and Print services from the network adapter, and maybe even diabling the Server service in services.msc, you've done really all you can do from an outside in perspective. And really, that's a lot and I think more than enough.

The greatest vulnerability to a computer is how it's used and the caution of the person using it. This is supposed to be a VMS server. Not someone's workstation. They're not supposed to do web browsing that doesn't have anything to do with the function of the surveillance on it. They're not supposed to be using it for email.

There's always something more you can do; for dollar cost on top of dollar cost. If you've done what you said, along with what I suggested, I think that's plenty.

Keep in mind that the support for Windows XP ends on the 8th of april 2014.

After that it won't be getting any more security updates.

Single biggest thing I'd recommend, if there isn't one already, would be to add a router between the DVR and the Internet - even a basic cheap consumer unit will provide a level of physical security and give the unit an IP that's not directly accessible. Forward only the necessary ports to it, and make sure all the others are closed on the router's firewall.

BTW, with an older machine like this, upgrading to Windows 7 is probably not an option anyway: besides driver support for the PC itself, there has to be driver support for the DVR card.

Sadly, my customer CCTV system got hacked or maybe got DDOS attack...yet again, the whole VMS is down. So, I would like post this question to everyone, has anyone implement VPN solution for remote viewing, is it possible? Can my customer use a VPN windows client and log into his private network at his office to do remote viewing and playback using Internet Explorer?

The problem is most corporations can afford to have their own fix IP addresses. While the small business enterprise uses dynamic IP addresses as a cheaper solution. While having dynamic IP address is not a great hassle since Dynamic DNS service is available freely, however, in respect of security, in my opinion, having DDNS windows client installed in Windows CCTV system and do updates every hour or every few hours, may invite hacker to pry /snoop on the hourly update traffic to find out the current dynamic IP address. Once the hacker get hold the IP address, then the whole CCTV system is vulnerable to cyber attack. Can someone confirm am I right? Thanks