Cyber Security For Video Surveillance Study

Author: Brian Karas, Published on Apr 27, 2016

This study provides the foundations for video surveillance professionals to understand the importance of cybersecurity, what is being done to enhance cybersecurity and what providers are viewed as the best and worst at cybersecurity.

100 integrators answered the following 5 open-ended questions on cyber security:

How important is cyber security in your customers' decision making process?
What type of customers are most concerned about cyber security? Why?
What steps do you take to ensure cyber security for your customers video surveillance systems?
Which security manufacturers do you feel are strongest in terms of cyber security? What do they do that makes you feel this way?
Which security manufacturers do you feel are weakest in terms of cyber security? What do they do that makes you feel this way?

They provided detailed color commentary on each point, so you can understand their mindset and approach.

Summary

The key trends revealed in the study:

Overall, cyber security is not very important for customer's decision making process.
The 4 segments showing highest cybersecurity concern were government, banking, education and healthcare
Steps taken to secure systems were generally basic. While various techniques were mentioned, changing default password was the most common.
Western video surveillance manufacturers were viewed as the strongest in cyber security.
Chinese, and specifically Hikvision, was selected as the weakest in cyber security.

Full details, integrator explanations and our analysis is shared inside.

**** ***** ******** *** *********** *** ***** ************ ************* ** understand *** ********** ** *************, **** ** ***** **** ** enhance ************* *** **** ********* *** ****** ** *** **** and ***** ** *************.

*** *********** ******** *** ********* * ****-***** ********* ** ***** security:

*** ********* ** ***** ******** ** **** *********' ******** ****** process?
**** **** ** ********* *** **** ********* ***** ***** ********? Why?
**** ***** ** *** **** ** ****** ***** ******** *** your ********* ***** ************ *******?
***** ******** ************* ** *** **** *** ********* ** ***** of ***** ********? **** ** **** ** **** ***** *** feel **** ***?
***** ******** ************* ** *** **** *** ******* ** ***** of ***** ********? **** ** **** ** **** ***** *** feel **** ***?

**** ******** ******** ***** ********** ** **** *****, ** *** can ********** ***** ******* *** ********.

*******

*** *** ****** ******** ** *** *****:

*******, ***** ******** ** *** **** ********* *** ********'* ******** making *******.
*** * ******** ******* ******* ************* ******* **** **********, *******, ********* *** **********
***** ***** ** ****** ******* **** ********* *****. ***** ******* techniques **** *********, ******** ******* ******** *** *** **** ******.
******* ***** ************ ************* **** ****** ** *** ********* ** cyber ********.
*******, *** ************ *********, *** ******** ** *** ******* ** cyber ********.

**** *******, ********** ************ *** *** ******** ** ****** ******.

[***************]

Low **********

**** ********* **** ***** ******** ** *** ********** ** ***** decision ****** *******. ****** **** ** *** ********* ********* ****:

******** ************ *** ***** ***** ** *** ****** *** *** ********:

"** ** *** ********* ** ***"
"** ********* ****** ******* * ******* **** ************* ** ***** decision ****** *******."
"*** *** ******* **** ***'* **** *** *****"
"* ******** ** *** ********* **** ** **** ********** **** don't ****** **** ***** ***** ******** ******* ** *** ************ systems."
"******** *** ********** ******** ** *** *****, *** **** **** are *** *** ******* ** **** ****** **** **** **** the **** ***** *** ******* **** **** **** **** ****** to ***."

******* *********** ********* **** ******** *** ** **** ********* **** aware ** ***** ******** *****:

"** **** *** ** **** ******* ******* ***** **** ***, but ** *** *** **** ** **** * **** *** why ** ** *******."
"*** **** **** *** ******** ***** **** **** **** ****** be."
"** ** ***** ********** ***** ******* ** ***** *********."
"*'* *** ****** ***********. *** **** **** **** ******** * threat ** **** * ***** *** ***************."
"** **** ****, **** ****** ** *** **** *** ******* still, *** ** *** ********** ******** ** ** ** ***** attention."

**********, *******, *********, ********** - **** ***** ******** *****

***** ********* *** ***** **** ********** ************ **** **** ****** ** have ****** ******** ****** ***** ********.

"******** *** *** ** ***** **** *********. ** ********* **** remote ****** ** *** ********* ** ****** *** ********* ******. Some ****** ** ** *** ***** ********* *** ***** ******."
"****** *********, ********* ** ************* ******* *** **** **** *********"
"******* *** **** **** ********, ******* **** *** ******** *********** & ******* **** ********* ****** ********* ** **** ******* **** be ******** **** ** ************ ****."
"*** *** *********, **** **** *** ***** *** **** **** at ** *** ** **** *********."

*****, ********** ********, ******* *** ********** ************* ******** **** ** IT ********** **** ** *********** *** ******* ********. ***** ************* have **** ********* ** ****, ** ******** *********.

"********* *** ** ********* ** **** *** *** ***** **** often"
"****** ** ***** ********** *** ** ****** ********** ** ** site ** ********** ***** **** ** ************* ** *** *********** to **** ******** *****."
"********** - **** ****** *** ** ******** ********"
"*******, ******* **** **** ******* ********"
"********* ******, *** *****, **********. **** *** ******* ***** ******* taking **** ***** ******* *** ****** ** **** ***** *** video ************ ******, ** ***** *** ***** ************ ****** ** a ******** ** ***** *******."
"********** *** ***** *** **** ********* ***** **** **** ******** data ** **** *** ******** ******** ******* *** **** ******* were *********."
"*********, *******, *********. **** **** **** ******** *** *** ******* FBI ********* ***"
"*** **** ** *** ****** **** ** *********, ** *** concern ** ******* *** ******** ** *** *** ********** ******. It ** ****** ** ***** *****. **** ** *** ************* clients *** **** ** *********, *** **** **** ********* ***** to **** **** **."

**** *** *********, ******* ********* ** *** **** ***** ******** ** a ******* ************* *** *** ****** ************* **. ******* ************* are **** ****** ** ** ****** *******, *** * **** breach ** **** ****** ** ****** ******** ****.

Methods *** ******** ********* ****

******** ******* ********* *** *** **** ****** **** ***** ** enhance ***** ********.

***** **% ** ********* ********* **** **** **** ** ******* ********.

********* ** ********** ******** **** ********** ******:

"********** ****** / ****** ******** ** ** *** ******** (********* ** physically)"
"******** ******* ********"
"** ***** * ******** ******** ******* *** *** ***** ****** or *** *****."
"** ********** ******** *** ***** ************ ******* **** ***** ******** (internet, ********* *** ***.)"
"******* *** ***** ****** ** * ******** ******* ** ****** VLAN ** ********"

********** ** ******* ***** ** **** ****, ****** *** ** consistently ** ***** ** ********:

"*** ** ********** (*** ****** ***********, *** ******** ************."
"** **** *** *******, ** *** *** *** *** ********** between ******'* *** ******."
"********* ******* * ***. ***** ******** *** *********** ********* *** also **** * *** ***** ****** *** *** ******* ****** app **** ***; ** **** * ******* *********** *** ****** encryption *** *** ***, **** **, ** ** *******, *** most ****** ******** ** *****."
"****** ********** *** ********* ** *****."
"****** **********(*****, ***) ** *********** **** *******, ********** ** ***** on **** ******, ***** ************ ** ******* ************ ** *******, etc."
"*** ********* ********* ********** **** ***** ******** ****."

******* ******** *** ******** *******, *** ********* ****-***** ******** **** listed, *** *** ** ********** ** *** ***** *****.

*********** *****, ** ******* ******* *******/************ *** *** ******** *********.

******* ** *** ********* ** ********** ** **** ************** *** cyber ******** *** **** **********:

"** ******* ********* ****** ***** ******** *********. ** **** ***** like ** *** *** ***** ********** ** ** ** ** them."
"*** ****** ********* *** **** **-***** ** ********* ** ******** third ***** ** ********* *** ** ****** ****** **********."
"** **** **** ******* **** ***** ** *********** ** ******* to ***** ***** *** **************."
"***** ** ***** ** *******"
"** ***** ** ** ** ******'* ** *********** *** *** internal *******"
"** ********* *** ****** *** ****** *** *********** ******** ******** on *** ****** *******."
"**** ****** ** *** - **'* ** ********'* ********* ******** and ** ********** **************"

**** ******** ***** *** **** *** * ***** ******** *** has ** ** **********, *** ** *** **** ** ****** organizations ** *** ** **** ** ***** *** ******** ** decide *** ***** ******** ******** ******* *** ***** ** ** remotely ********, *******, ** ********* ** ***** ********.

Manufacturers ****** ** **** ******

****** ************* ******** * *** **** ***** **** *** ********* in ***** ** ********* ********.

**** *** ** *** *** **** *****, **** ****** *** third ** *********:

"****. **** ***** *** ******* ** ********* ***.** *** *** up ***** ******* *** ****** ************* ***** *** **** ******* cybersecurity ****** ** **** ** ***** *********** *** ********* ******."
"****, **** *** * **** ******* ******** ********."
"**** **************. ****'** *** **** ************ ** **** ** *** actually ***** ***** *************"
"**** *** ***** *** ***** ** ***** ******** *** **** specific *********** **** ** ********* ** ****."
"**** *** *** * ***** ******** ***** *** ***** **** dedicated *********. ***** ***** ********* ***** ** ****** *****, ****** if ***'** *** *******, **** *** ***** ** ***********"
"*** ****** *************, **** ****, ***** *** *********** ** ********* any ******* ****** ***** ********, **** ** *** ***. ***** manufacturers, ***'* ***** ** ** ****** ***** ******* ***** *** related *********."
"**** **** ** ** * ****** ** ********."
"**** ***** ** **** ** **** ***'* **** ******* ********* on ***** ********, ****** *** *** *** **** ************."

**** **** *** * ********* ***** **** ******** *************** *** ********* ******** *** **** ********.

* *** *********** ********* ***** ****, **** *** ****** *** **** of ****** ***** ***** **** ** **** ******* *** ******* commenting:

"**** - ******* ** ***** ******* **** .*** ******** *** software (**** ***** ******* ******), ******** ** **** *** ******* (VMD3, ***), ******** ** ******* **** *** ******* ************* ** cameras (******** ***** *******, ***) *** ***% *******-**** *** (*** that ** ***** *** ***** ***). ****, **** ***** ***** passwords *** ***** ***** ***** ******* ******** **** ********* ******** guesses."

********:

"********'* *****-** **** ******** ******, ****** ****** ******** *******, *** easily-visible ****** ** *********/*********** ******* ***** **** **** **** ** my **** ** ****."
"******** **** *** ******** ******** ***** ** **************, ******** ********** (******* cameras & ***, ******* ******* & *******)"
"******** - **** ** **** ** **** ***** *******, *** their *** ******* **** ** **** * ****** ********** ******* their ********."

*****:

"***** - ********** ******** *** ***** ********* ********"
"***** *******, ******** ************ *** ********* ********."
"***** ** ***** ***'* ** *** ***** ** ******* **** the ****** ** * *** ***** *** ****'* **** ** the *** *** ***** ******** ****** *** ********** **** ****** takes ** ** *** **** ***** ** ***** ** **** cyber ******** ** *** ****."

***** **** *** * **** ******** *****.

*******:

"** *** ***** ******* *** ***** ******, **** **** ******** security ********, ****** **********, *** *******. ******** ******* **** ******* Enterprise ******* ********* *** ********** ********* *** **** ****** ************ regarding ** ********."
"******* ** ****** ***** ******* ** ********* ********** *** ** easily ********** ** ******* ******."
"******* - **** *** **** ** ** ** ******* *******"

******* ***** * ********* ***** ********* ** ***** ******* ******

*********:

"********* ** ****** **** - **** **** **** *********** ******** to ****** ******* ***."
"********* - **** **** ** **** ******* ******* *** **** to ***** ** *** ****** ****** ********. ******** - **** do **** ** **** ***** *******, *** ***** *** ******* seem ** **** * ****** ********** ******* ***** ********."
"*********, ****, ***** - **** *** **** **** * **** hard **** ** ***** *** ********** *** ********, ***************, ******* ***** papers on **** ********* *** *** ***** ******** ******* ******."

China / ********* ** ***** ******

*** *** ***** ****** ********, ********* *** *** ************* ********* brand, ***** **** ** **********, *** ******* ****** ********* "******* cameras" ** ******** *******.

"********* - **** ******* ** **** *** **** ********."
"*********, ** ***** **** ******** ******** ****** *** ************** ** their ***. **** ** ** ******."
"*********, * ***** ****** ***** ******* ********** ****** ** ********* via ********* **** *** ******'*."
"********* *** * *** **********, ***** *** *****"
"********* *** *** ***** *************. **** ****** ***'* **** ** don't **** *** ********* ** ****** ***** ******* *** ******."
"********* - ******** ******** ********** *** ******* ********** *********** **** the *******."
"*********. **** ******* ***** ***** ** **** *** ****** *** default ********* *** ********* **** ***** ******* ******** ******** *** I ***** ***'* ******** ***** *** ******** ** *** ********."
"**** ****** ** **** **** **** **** **** ** *****, but ***** ** ** *** *** *****. *********, *******/******/*******, *** others **** **** *** ******** ****** ***. ************, ***** ***** allows ***** ****** ***** ******* ***** *** **** ****** ** disabled. ********* *** *** **** ***** *****, **** ** ***** have **** *****. ******* ******* ******* **** ******* **** * bug **** **** ****** **** *** *** ********* ** *** camera, **** ******* ********** ** ************* ******* **** ***** *** be ****** *** **. *** **** ****** ** ***** *** browser **** ** ***** ** *** ***."
"*********, ** ***** **** **** *** ****** ** ***** ********* up. * ** ****** ***** ****. **** ***** ******* *** don't ***** ****. **'** ******* *** * *** ********* ********."
"*********. ****** **** **** **** ************ ***** ***** ********** *****, they **** *** ** ** ******** ** ******* ********. ***** needs ** ** * ******* ** ******** ** * ******* concern--not ** ************."
"********* *** * ******** ** *** ********* ***** ****** ***** offices."
"*****. **** **** ***** **** **** ********* **** *** **** to **** ** *** ******** ** ** ****** *** **** you ******* *** ****** **** * **** ******** ** *****, anyone **** *** ** ****** ** *** ****** *** *** in."
"*** ***** ******* ******* *** *** *****... *'** ******* **** that **** *** **** ***** ***** **** *** **** ****** as * ******* ** *** ********."

********* **** **** ********* ****** **** ** ***** *******, **** * **** ** ****** ****** and * ***** ******** **** ********* *****.

Comments (3)

Undisclosed Manufacturer #1

04/28/16 12:06am

Hacking a device 101.. Use Chrome web browser, login to your IP device, assume that there is a web browser. Which is most devices now days.

Now press F12 the developer console! ( don't be scared it's not that hard! )

Now locate the option on the ribbon called Network!! press refresh for the page. that's the little almost circle with arrow on it on the top left next to left-right browser navigation icons.

For at most you will discover a lot of things what is going on. the things to look for in weak or complete shit security is transfer of username / passwords in plain easy to read text. The interesting column is the initiator one, this show you all what is passed on the network at http traffic commands!

Now if you consider this someone with the most basic and free tools, like Wireshark, can capture network traffic and find all the passwords they could wish for.

Now one other item to select is select the ribbon item EditthisCookie

This will show you what the device is keeping in the browser. Again look for simple things like passwords, and such.

For the hard nuts, you might want take look at firmware update utilities, as they tend to offer some very dangerous commands, in case of Chinese products, typically, the Linux telnet the most hacked part of an OS uses plain text commands.

End of day security is only a weak as the more cleaver person wants to break in.

We all know nothing is secure, we hope at some basic level we can have some sanity in security devices. Just don't expect this day one from Chinese companies, at least for now.

Undisclosed Manufacturer #2

04/28/16 01:01pm

In contrast to the reports, I heard the Los Angeles Unified School District, one of the largest in the country, has standardized on HIKvision. One rep to another conversation.

Undisclosed Integrator #3

04/28/16 01:18pm

I know of a local install at a county office using Hikvision cameras. I'm waiting till it completes to send some "anonymous" tips to local news agencies about the security issues with Hikvision and see what happens. I'll post the results if it comes to anything.

Login to read this IPVM report.

Why do I need to log in?

IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

ISC East 2018 Mini-Show Final Report on Nov 16, 2018

This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...

French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018

The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...

Magos Radar Company Profile on Nov 12, 2018

Magos America General Manager Yaron Zussman admits when he first came across Magos, he asked himself: "What's innovative about radar?" Be that as...

Video Surveillance Hard Drive Size Statistics 2018 on Nov 08, 2018

What is the most common hard drive size for video surveillance? 150+ integrators answered: What size hard drive do you most commonly use? What...

Axis 2N Intercom Tested on Nov 08, 2018

Axis expanded its video intercom business buying Czech-based 2N in 2016. Despite competing against owner Axis' intercoms, 2N recently registered as...

Dahua Dual Imager Dome Camera Tested (HDBW4231FN-E2-M) on Nov 07, 2018

Dahua has introduced a dual-imager dome model, the HDBW4231FN-E2-M, with two independently positionable sensors including integrated IR, not found...

Avigilon Opens Up Analytics And Cameras on Nov 06, 2018

Avigilon is opening up. The company historically famous for advocating its own end-to-end solutions and making it harder for 3rd parties to...

Favorite Video Surveillance Hard Drive Manufacturer 2018 on Nov 06, 2018

Who is the favorite hard drive for video surveillance use? 150+ integrators answered: What is your preferred brand/model of hard drive for...

Winter 2019 IP Networking Course on Nov 05, 2018

This is the only networking course designed specifically for video surveillance professionals. Lots of network training exists but none of it...

HID: Stop Selling Cracked 125 kHz Credentials on Nov 05, 2018

HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on...

Most Recent Industry Reports

'Sticker' Surveillance Camera Developed (CSEM Witness) on Nov 16, 2018

The Swiss Center for Electronics and Microtechnology (CSEM) has announced what it calls the: world’s first fully autonomous camera that can be...

ISC East 2018 Mini-Show Final Report on Nov 16, 2018

This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...

Facial Detection Tested on Nov 16, 2018

Facial detection and recognition are increasingly offered by video surveillance manufacturers. Facial detection detects faces in an image/video...

Throughtek P2P/Cloud Solution Profile on Nov 15, 2018

Many IoT manufacturers either do not have the capabilities or the interest to develop their own cloud management software for their devices....

ASIS Offering Custom Research For Manufacturers on Nov 15, 2018

Manufacturers often want to know what industry people think about trends and, in particular, the segments and product they offer. ASIS and its...

Hikvision Silent on "Bad Architectural Practices" Cybersecurity Report on Nov 14, 2018

A 'significant vulnerability was found in Hikvision cameras' by VDOO, a startup cybersecurity specialist. Hikvision has fixed the specific...

French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018

The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...

Integrator Credit Card Alternative Divvy on Nov 13, 2018

Most security integrators are small businesses but large enough that they have various employees that need to be able to expense various charges as...

Directory of Video Intercoms on Nov 13, 2018

Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...

Beware Amazon Go Store Hype (Tested) on Nov 13, 2018

IPVM's trip to and testing of Amazon Go's San Francisco store shows a number of significant operational and economic issues that undermine the...