Cyber Security For Video Surveillance Study

Author: Brian Karas, Published on Apr 27, 2016

This study provides the foundations for video surveillance professionals to understand the importance of cybersecurity, what is being done to enhance cybersecurity and what providers are viewed as the best and worst at cybersecurity.

100 integrators answered the following 5 open-ended questions on cyber security:

How important is cyber security in your customers' decision making process?
What type of customers are most concerned about cyber security? Why?
What steps do you take to ensure cyber security for your customers video surveillance systems?
Which security manufacturers do you feel are strongest in terms of cyber security? What do they do that makes you feel this way?
Which security manufacturers do you feel are weakest in terms of cyber security? What do they do that makes you feel this way?

They provided detailed color commentary on each point, so you can understand their mindset and approach.

Summary

The key trends revealed in the study:

Overall, cyber security is not very important for customer's decision making process.
The 4 segments showing highest cybersecurity concern were government, banking, education and healthcare
Steps taken to secure systems were generally basic. While various techniques were mentioned, changing default password was the most common.
Western video surveillance manufacturers were viewed as the strongest in cyber security.
Chinese, and specifically Hikvision, was selected as the weakest in cyber security.

Full details, integrator explanations and our analysis is shared inside.

**** ***** ******** *** *********** *** ***** ************ ************* ** understand *** ********** ** *************, **** ** ***** **** ** enhance ************* *** **** ********* *** ****** ** *** **** and ***** ** *************.

*** *********** ******** *** ********* * ****-***** ********* ** ***** security:

*** ********* ** ***** ******** ** **** *********' ******** ****** process?
**** **** ** ********* *** **** ********* ***** ***** ********? Why?
**** ***** ** *** **** ** ****** ***** ******** *** your ********* ***** ************ *******?
***** ******** ************* ** *** **** *** ********* ** ***** of ***** ********? **** ** **** ** **** ***** *** feel **** ***?
***** ******** ************* ** *** **** *** ******* ** ***** of ***** ********? **** ** **** ** **** ***** *** feel **** ***?

**** ******** ******** ***** ********** ** **** *****, ** *** can ********** ***** ******* *** ********.

*******

*** *** ****** ******** ** *** *****:

*******, ***** ******** ** *** **** ********* *** ********'* ******** making *******.
*** * ******** ******* ******* ************* ******* **** **********, *******, ********* *** **********
***** ***** ** ****** ******* **** ********* *****. ***** ******* techniques **** *********, ******** ******* ******** *** *** **** ******.
******* ***** ************ ************* **** ****** ** *** ********* ** cyber ********.
*******, *** ************ *********, *** ******** ** *** ******* ** cyber ********.

**** *******, ********** ************ *** *** ******** ** ****** ******.

[***************]

Low **********

**** ********* **** ***** ******** ** *** ********** ** ***** decision ****** *******. ****** **** ** *** ********* ********* ****:

******** ************ *** ***** ***** ** *** ****** *** *** ********:

"** ** *** ********* ** ***"
"** ********* ****** ******* * ******* **** ************* ** ***** decision ****** *******."
"*** *** ******* **** ***'* **** *** *****"
"* ******** ** *** ********* **** ** **** ********** **** don't ****** **** ***** ***** ******** ******* ** *** ************ systems."
"******** *** ********** ******** ** *** *****, *** **** **** are *** *** ******* ** **** ****** **** **** **** the **** ***** *** ******* **** **** **** **** ****** to ***."

******* *********** ********* **** ******** *** ** **** ********* **** aware ** ***** ******** *****:

"** **** *** ** **** ******* ******* ***** **** ***, but ** *** *** **** ** **** * **** *** why ** ** *******."
"*** **** **** *** ******** ***** **** **** **** ****** be."
"** ** ***** ********** ***** ******* ** ***** *********."
"*'* *** ****** ***********. *** **** **** **** ******** * threat ** **** * ***** *** ***************."
"** **** ****, **** ****** ** *** **** *** ******* still, *** ** *** ********** ******** ** ** ** ***** attention."

**********, *******, *********, ********** - **** ***** ******** *****

***** ********* *** ***** **** ********** ************ **** **** ****** ** have ****** ******** ****** ***** ********.

"******** *** *** ** ***** **** *********. ** ********* **** remote ****** ** *** ********* ** ****** *** ********* ******. Some ****** ** ** *** ***** ********* *** ***** ******."
"****** *********, ********* ** ************* ******* *** **** **** *********"
"******* *** **** **** ********, ******* **** *** ******** *********** & ******* **** ********* ****** ********* ** **** ******* **** be ******** **** ** ************ ****."
"*** *** *********, **** **** *** ***** *** **** **** at ** *** ** **** *********."

*****, ********** ********, ******* *** ********** ************* ******** **** ** IT ********** **** ** *********** *** ******* ********. ***** ************* have **** ********* ** ****, ** ******** *********.

"********* *** ** ********* ** **** *** *** ***** **** often"
"****** ** ***** ********** *** ** ****** ********** ** ** site ** ********** ***** **** ** ************* ** *** *********** to **** ******** *****."
"********** - **** ****** *** ** ******** ********"
"*******, ******* **** **** ******* ********"
"********* ******, *** *****, **********. **** *** ******* ***** ******* taking **** ***** ******* *** ****** ** **** ***** *** video ************ ******, ** ***** *** ***** ************ ****** ** a ******** ** ***** *******."
"********** *** ***** *** **** ********* ***** **** **** ******** data ** **** *** ******** ******** ******* *** **** ******* were *********."
"*********, *******, *********. **** **** **** ******** *** *** ******* FBI ********* ***"
"*** **** ** *** ****** **** ** *********, ** *** concern ** ******* *** ******** ** *** *** ********** ******. It ** ****** ** ***** *****. **** ** *** ************* clients *** **** ** *********, *** **** **** ********* ***** to **** **** **."

**** *** *********, ******* ********* ** *** **** ***** ******** ** a ******* ************* *** *** ****** ************* **. ******* ************* are **** ****** ** ** ****** *******, *** * **** breach ** **** ****** ** ****** ******** ****.

Methods *** ******** ********* ****

******** ******* ********* *** *** **** ****** **** ***** ** enhance ***** ********.

***** **% ** ********* ********* **** **** **** ** ******* ********.

********* ** ********** ******** **** ********** ******:

"********** ****** / ****** ******** ** ** *** ******** (********* ** physically)"
"******** ******* ********"
"** ***** * ******** ******** ******* *** *** ***** ****** or *** *****."
"** ********** ******** *** ***** ************ ******* **** ***** ******** (internet, ********* *** ***.)"
"******* *** ***** ****** ** * ******** ******* ** ****** VLAN ** ********"

********** ** ******* ***** ** **** ****, ****** *** ** consistently ** ***** ** ********:

"*** ** ********** (*** ****** ***********, *** ******** ************."
"** **** *** *******, ** *** *** *** *** ********** between ******'* *** ******."
"********* ******* * ***. ***** ******** *** *********** ********* *** also **** * *** ***** ****** *** *** ******* ****** app **** ***; ** **** * ******* *********** *** ****** encryption *** *** ***, **** **, ** ** *******, *** most ****** ******** ** *****."
"****** ********** *** ********* ** *****."
"****** **********(*****, ***) ** *********** **** *******, ********** ** ***** on **** ******, ***** ************ ** ******* ************ ** *******, etc."
"*** ********* ********* ********** **** ***** ******** ****."

******* ******** *** ******** *******, *** ********* ****-***** ******** **** listed, *** *** ** ********** ** *** ***** *****.

*********** *****, ** ******* ******* *******/************ *** *** ******** *********.

******* ** *** ********* ** ********** ** **** ************** *** cyber ******** *** **** **********:

"** ******* ********* ****** ***** ******** *********. ** **** ***** like ** *** *** ***** ********** ** ** ** ** them."
"*** ****** ********* *** **** **-***** ** ********* ** ******** third ***** ** ********* *** ** ****** ****** **********."
"** **** **** ******* **** ***** ** *********** ** ******* to ***** ***** *** **************."
"***** ** ***** ** *******"
"** ***** ** ** ** ******'* ** *********** *** *** internal *******"
"** ********* *** ****** *** ****** *** *********** ******** ******** on *** ****** *******."
"**** ****** ** *** - **'* ** ********'* ********* ******** and ** ********** **************"

**** ******** ***** *** **** *** * ***** ******** *** has ** ** **********, *** ** *** **** ** ****** organizations ** *** ** **** ** ***** *** ******** ** decide *** ***** ******** ******** ******* *** ***** ** ** remotely ********, *******, ** ********* ** ***** ********.

Manufacturers ****** ** **** ******

****** ************* ******** * *** **** ***** **** *** ********* in ***** ** ********* ********.

**** *** ** *** *** **** *****, **** ****** *** third ** *********:

"****. **** ***** *** ******* ** ********* ***.** *** *** up ***** ******* *** ****** ************* ***** *** **** ******* cybersecurity ****** ** **** ** ***** *********** *** ********* ******."
"****, **** *** * **** ******* ******** ********."
"**** **************. ****'** *** **** ************ ** **** ** *** actually ***** ***** *************"
"**** *** ***** *** ***** ** ***** ******** *** **** specific *********** **** ** ********* ** ****."
"**** *** *** * ***** ******** ***** *** ***** **** dedicated *********. ***** ***** ********* ***** ** ****** *****, ****** if ***'** *** *******, **** *** ***** ** ***********"
"*** ****** *************, **** ****, ***** *** *********** ** ********* any ******* ****** ***** ********, **** ** *** ***. ***** manufacturers, ***'* ***** ** ** ****** ***** ******* ***** *** related *********."
"**** **** ** ** * ****** ** ********."
"**** ***** ** **** ** **** ***'* **** ******* ********* on ***** ********, ****** *** *** *** **** ************."

**** **** *** * ********* ***** **** ******** *************** *** ********* ******** *** **** ********.

* *** *********** ********* ***** ****, **** *** ****** *** **** of ****** ***** ***** **** ** **** ******* *** ******* commenting:

"**** - ******* ** ***** ******* **** .*** ******** *** software (**** ***** ******* ******), ******** ** **** *** ******* (VMD3, ***), ******** ** ******* **** *** ******* ************* ** cameras (******** ***** *******, ***) *** ***% *******-**** *** (*** that ** ***** *** ***** ***). ****, **** ***** ***** passwords *** ***** ***** ***** ******* ******** **** ********* ******** guesses."

********:

"********'* *****-** **** ******** ******, ****** ****** ******** *******, *** easily-visible ****** ** *********/*********** ******* ***** **** **** **** ** my **** ** ****."
"******** **** *** ******** ******** ***** ** **************, ******** ********** (******* cameras & ***, ******* ******* & *******)"
"******** - **** ** **** ** **** ***** *******, *** their *** ******* **** ** **** * ****** ********** ******* their ********."

*****:

"***** - ********** ******** *** ***** ********* ********"
"***** *******, ******** ************ *** ********* ********."
"***** ** ***** ***'* ** *** ***** ** ******* **** the ****** ** * *** ***** *** ****'* **** ** the *** *** ***** ******** ****** *** ********** **** ****** takes ** ** *** **** ***** ** ***** ** **** cyber ******** ** *** ****."

***** **** *** * **** ******** *****.

*******:

"** *** ***** ******* *** ***** ******, **** **** ******** security ********, ****** **********, *** *******. ******** ******* **** ******* Enterprise ******* ********* *** ********** ********* *** **** ****** ************ regarding ** ********."
"******* ** ****** ***** ******* ** ********* ********** *** ** easily ********** ** ******* ******."
"******* - **** *** **** ** ** ** ******* *******"

******* ***** * ********* ***** ********* ** ***** ******* ******

*********:

"********* ** ****** **** - **** **** **** *********** ******** to ****** ******* ***."
"********* - **** **** ** **** ******* ******* *** **** to ***** ** *** ****** ****** ********. ******** - **** do **** ** **** ***** *******, *** ***** *** ******* seem ** **** * ****** ********** ******* ***** ********."
"*********, ****, ***** - **** *** **** **** * **** hard **** ** ***** *** ********** *** ********, ***************, ******* ***** papers on **** ********* *** *** ***** ******** ******* ******."

China / ********* ** ***** ******

*** *** ***** ****** ********, ********* *** *** ************* ********* brand, ***** **** ** **********, *** ******* ****** ********* "******* cameras" ** ******** *******.

"********* - **** ******* ** **** *** **** ********."
"*********, ** ***** **** ******** ******** ****** *** ************** ** their ***. **** ** ** ******."
"*********, * ***** ****** ***** ******* ********** ****** ** ********* via ********* **** *** ******'*."
"********* *** * *** **********, ***** *** *****"
"********* *** *** ***** *************. **** ****** ***'* **** ** don't **** *** ********* ** ****** ***** ******* *** ******."
"********* - ******** ******** ********** *** ******* ********** *********** **** the *******."
"*********. **** ******* ***** ***** ** **** *** ****** *** default ********* *** ********* **** ***** ******* ******** ******** *** I ***** ***'* ******** ***** *** ******** ** *** ********."
"**** ****** ** **** **** **** **** **** ** *****, but ***** ** ** *** *** *****. *********, *******/******/*******, *** others **** **** *** ******** ****** ***. ************, ***** ***** allows ***** ****** ***** ******* ***** *** **** ****** ** disabled. ********* *** *** **** ***** *****, **** ** ***** have **** *****. ******* ******* ******* **** ******* **** * bug **** **** ****** **** *** *** ********* ** *** camera, **** ******* ********** ** ************* ******* **** ***** *** be ****** *** **. *** **** ****** ** ***** *** browser **** ** ***** ** *** ***."
"*********, ** ***** **** **** *** ****** ** ***** ********* up. * ** ****** ***** ****. **** ***** ******* *** don't ***** ****. **'** ******* *** * *** ********* ********."
"*********. ****** **** **** **** ************ ***** ***** ********** *****, they **** *** ** ** ******** ** ******* ********. ***** needs ** ** * ******* ** ******** ** * ******* concern--not ** ************."
"********* *** * ******** ** *** ********* ***** ****** ***** offices."
"*****. **** **** ***** **** **** ********* **** *** **** to **** ** *** ******** ** ** ****** *** **** you ******* *** ****** **** * **** ******** ** *****, anyone **** *** ** ****** ** *** ****** *** *** in."
"*** ***** ******* ******* *** *** *****... *'** ******* **** that **** *** **** ***** ***** **** *** **** ****** as * ******* ** *** ********."

********* **** **** ********* ****** **** ** ***** *******, **** * **** ** ****** ****** and * ***** ******** **** ********* *****.

Comments (3)

Undisclosed Manufacturer #1

04/28/16 12:06am

******* * ****** ***.. *** ****** *** *******, ***** ** your ** ******, ****** **** ***** ** * *** *******. Which ** **** ******* *** ****.

*** ***** *** *** ********* *******! ( ***'* ** ****** it's *** **** ****! )

*** ****** *** ****** ** *** ****** ****** *******!! ***** refresh *** *** ****. ****'* *** ****** ****** ****** **** arrow ** ** ** *** *** **** **** ** ****-***** browser ********** *****.

*** ** **** *** **** ******** * *** ** ****** what ** ***** **. *** ****** ** **** *** ** weak ** ******** **** ******** ** ******** ** ******** / passwords ** ***** **** ** **** ****. *** *********** ****** is *** ********* ***, **** **** *** *** **** ** passed ** *** ******* ** **** ******* ********!

*** ** *** ******** **** ******* **** *** **** ***** and **** *****, **** *********, *** ******* ******* ******* *** find *** *** ********* **** ***** **** ***.

*** *** ***** **** ** ****** ** ****** *** ****** item **************

**** **** **** *** **** *** ****** ** ******* ** the *******. ***** **** *** ****** ****** **** *********, *** such.

*** *** **** ****, *** ***** **** **** **** ** firmware ****** *********, ** **** **** ** ***** **** **** dangerous ********, ** **** ** ******* ********, *********, *** ***** telnet *** **** ****** **** ** ** ** **** ***** text ********.

*** ** *** ******** ** **** * **** ** *** more ******* ****** ***** ** ***** **.

** *** **** ******* ** ******, ** **** ** **** basic ***** ** *** **** **** ****** ** ******** *******. Just ***'* ****** **** *** *** **** ******* *********, ** least *** ***.

Undisclosed Manufacturer #2

04/28/16 01:01pm

** ******** ** *** *******, * ***** *** *** ******* Unified ****** ********, *** ** *** ******* ** *** *******, has ************ ** *********. *** *** ** ******* ************.

Undisclosed Integrator #3

04/28/16 01:18pm

* **** ** * ***** ******* ** * ****** ****** using ********* *******. *'* ******* **** ** ********* ** **** some "*********" **** ** ***** **** ******** ***** *** ******** issues **** ********* *** *** **** *******. *'** **** *** results ** ** ***** ** ********.

Login to read this IPVM report.

Why do I need to log in?

IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Avigilon 'Blue' Cloud Entry Examined on Sep 19, 2017

Avigilon is moving to the cloud. The company announced their Avigilon Blue platform, designed to be a web-managed surveillance system, utilizing...

Hikvision Backdoor Exploit on Sep 18, 2017

Full disclosure to the Hikvision backdoor has been released, allowing easy exploit of vulnerable Hikvision IP cameras. As the researcher, Monte...

Forgotten Password Problem Importance on Sep 15, 2017

Forgotten passwords has become a major industry topic. For example, Hikvision has been emailing admin passwords in plain text until IPVM's...

September IP Networking Course on Sep 14, 2017

LAST Chance - Registration is ending. Register now. This is the only networking course designed specifically for video surveillance professionals...

Genetec Launches Community Connect Examined on Sep 14, 2017

Genetec has done best in large-scale, enterprise systems and relatively worse in smaller systems such as SMB. Now, Genetec is launching...

Dedicated Vs Converged IP Video Networks Statistics on Sep 12, 2017

'Convergence' has been a major industry theme for many years. All organizations have IP networks today with laptops, tablets, phones and more...

Geovision Doorstation Tested (CS1320) on Sep 12, 2017

Geovision has released the GV-CS1320 door station, priced at a fraction of others, with additional bells and whistles like a built in card reader,...

Favorite Integrator Tablets 2017 on Sep 11, 2017

What percentage of integrators use tablets? Which tablets do they prefer? Apple? Android? Windows? Tablets have become popular integrator tools...

Axis vs Sony Super Size Shootout (Q1659 vs SNC-VB770) on Sep 11, 2017

Super low light, super sized sensor cameras are a growing trend. In the past year, 2 of the most notable entrants for these IP cameras have been...

October Camera Course on Sep 07, 2017

Learn video surveillance and get certified. IPVM provides live online classes, recorded videos, personal help, cutting edge education and...

Most Recent Industry Reports

Avigilon Touting 'Made In America' on Sep 18, 2017

Canadian manufacturer Avigilon, who completed a US manufacturing facility in 2015, is now running a marketing campaign touting 'Made In America',...

Cloud Guy Prints Book, Misses Irony on Sep 15, 2017

On-premise security systems are dead. But $75 print books are alive and well. Such are the lessons from Brivo's CEO new book "The Five...

Forgotten Password Problem Importance on Sep 15, 2017

Forgotten passwords has become a major industry topic. For example, Hikvision has been emailing admin passwords in plain text until IPVM's...

September IP Networking Course on Sep 14, 2017

LAST Chance - Registration is ending. Register now. This is the only networking course designed specifically for video surveillance professionals...

Hikvision Launching Ezviz Pro on Sep 14, 2017

Hikvision is launching Ezviz Pro. In 2015, Hikvision expanded Ezviz, a direct to consumer offering, to North America. Now, Ezviz 'Pro' is...

Genetec Launches Community Connect Examined on Sep 14, 2017

Genetec has done best in large-scale, enterprise systems and relatively worse in smaller systems such as SMB. Now, Genetec is launching...

Master Keying Tutorial on Sep 14, 2017

Mechanical keys are the most fundamental, albeit unsophisticated, form of access control. Like access control, Master Keying allows large scale use...

Startup Turing Video Segway-Based Security Robot Profile on Sep 13, 2017

If security robots can not replace guards, perhaps the next best thing is a robot the guard can actually ride. Turing Video has raised $5...

Fail Safe vs. Fail Secure Tutorial on Sep 13, 2017

Few terms carry greater importance in access control than 'fail safe' and 'fail secure'. Access control professionals must know how these concepts...