Cyber Security For Video Surveillance Study

By: Brian Karas, Published on Apr 27, 2016

This study provides the foundations for video surveillance professionals to understand the importance of cybersecurity, what is being done to enhance cybersecurity and what providers are viewed as the best and worst at cybersecurity.

100 integrators answered the following 5 open-ended questions on cyber security:

  • How important is cyber security in your customers' decision making process?
  • What type of customers are most concerned about cyber security? Why?
  • What steps do you take to ensure cyber security for your customers video surveillance systems?
  • Which security manufacturers do you feel are strongest in terms of cyber security? What do they do that makes you feel this way?
  • Which security manufacturers do you feel are weakest in terms of cyber security? What do they do that makes you feel this way?

They provided detailed color commentary on each point, so you can understand their mindset and approach.

Summary

The key trends revealed in the study:

  • Overall, cyber security is not very important for customer's decision making process.
  • The 4 segments showing highest cybersecurity concern were government, banking, education and healthcare
  • Steps taken to secure systems were generally basic. While various techniques were mentioned, changing default password was the most common.
  • Western video surveillance manufacturers were viewed as the strongest in cyber security.
  • Chinese, and specifically Hikvision, was selected as the weakest in cyber security.

Full details, integrator explanations and our analysis is shared inside.

**** ***** ******** *** foundations *** ***** ************ professionals ** ********** *** importance ** *************, **** is ***** **** ** enhance ************* *** **** providers *** ****** ** the **** *** ***** at *************.

*** *********** ******** *** following * ****-***** ********* on ***** ********:

  • *** ********* ** ***** security ** **** *********' decision ****** *******?
  • **** **** ** ********* are **** ********* ***** cyber ********? ***?
  • **** ***** ** *** take ** ****** ***** security *** **** ********* video ************ *******?
  • ***** ******** ************* ** you **** *** ********* in ***** ** ***** security? **** ** **** do **** ***** *** feel **** ***?
  • ***** ******** ************* ** you **** *** ******* in ***** ** ***** security? **** ** **** do **** ***** *** feel **** ***?

**** ******** ******** ***** commentary ** **** *****, so *** *** ********** their ******* *** ********.

*******

*** *** ****** ******** in *** *****:

  • *******, ***** ******** ** not **** ********* *** customer's ******** ****** *******.
  • *** * ******** ******* highest ************* ******* **** g*********, *******, ********* *** healthcare
  • ***** ***** ** ****** systems **** ********* *****. While ******* ********** **** mentioned, ******** ******* ******** was *** **** ******.
  • ******* ***** ************ ************* were ****** ** *** strongest ** ***** ********.
  • *******, *** ************ *********, was ******** ** *** weakest ** ***** ********.

**** *******, ********** ************ and *** ******** ** shared ******.

[***************]

Low **********

**** ********* **** ***** security ** *** ********** in ***** ******** ****** process. ****** **** ** all ********* ********* ****:

******** ************ *** ***** noted ** *** ****** for *** ********:

  • "** ** *** ********* at ***"
  • "** ********* ****** ******* a ******* **** ************* in ***** ******** ****** process."
  • "*** *** ******* **** don't **** *** *****"
  • "* ******** ** *** customers **** ** **** interacted **** ***'* ****** care ***** ***** ******** related ** *** ************ systems."
  • "******** *** ********** ******** of *** *****, *** when **** *** *** the ******* ** **** drives **** **** **** the **** ***** *** shadows **** **** **** they ****** ** ***."

******* *********** ********* **** actively *** ** **** customers **** ***** ** cyber ******** *****:

  • "** **** *** ** find ******* ******* ***** this ***, *** ** try *** **** ** make * **** *** why ** ** *******."
  • "*** **** **** *** thinking ***** **** **** they ****** **."
  • "** ** ***** ********** until ******* ** ***** attention."
  • "*'* *** ****** ***********. The **** **** **** perceive * ****** ** when * ***** *** vulnerabilities."
  • "** **** ****, **** client ** *** **** too ******* *****, *** we *** ********** ******** it ** ** ***** attention."

**********, *******, *********, ********** - **** ***** ******** Aware

***** ********* *** ***** with ********** ************ **** most ****** ** **** higher ******** ****** ***** security.

  • "******** *** *** ** large **** *********. ** resources **** ****** ****** to *** ********* ** points *** ********* ******. Some ****** ** ** and ***** ********* *** Group ******."
  • "****** *********, ********* ** institutional ******* *** **** more *********"
  • "******* *** **** **** breached, ******* **** *** business *********** & ******* with ********* ****** ********* to **** ******* **** be ******** **** ** confidential ****."
  • "*** *** *********, **** know *** ***** *** they **** ** ** and ** **** *********."

*****, ********** ********, ******* and ********** ************* ******** have ** ** ********** that ** *********** *** network ********. ***** ************* have **** ********* ** risk, ** ******** *********.

  • "********* *** ** ********* as **** *** *** risks **** *****"
  • "****** ** ***** ********** due ** ****** ********** or ** **** ** management ***** **** ** understanding ** *** *********** to **** ******** *****."
  • "********** - **** ****** due ** ******** ********"
  • "*******, ******* **** **** maximum ********"
  • "********* ******, *** *****, Government. **** *** ******* about ******* ****** **** their ******* *** ****** on **** ***** *** video ************ ******, ** using *** ***** ************ system ** * ******** to ***** *******."
  • "********** *** ***** *** most ********* ***** **** have ******** **** ** case *** ******** ******** network *** **** ******* were *********."
  • "*********, *******, *********. **** have **** ******** *** are ******* *** ********* etc"
  • "*** **** ** *** client **** ** *********, so *** ******* ** obvious *** ******** ** law *** ********** ******. It ** ****** ** those *****. **** ** our ************* ******* *** just ** *********, *** they **** ********* ***** to **** **** **."

**** *** *********, ******* customers ** *** **** cyber ******** ** * primary ************* *** *** larger ************* **. ******* organizations *** **** ****** to ** ****** *******, and * **** ****** is **** ****** ** become ******** ****.

Methods *** ******** ********* ****

******** ******* ********* *** the **** ****** **** taken ** ******* ***** security.

***** **% ** ********* indicated **** **** **** to ******* ********.

********* ** ********** ******** were ********** ******:

  • "********** ****** / ****** networks ** ** *** possible (********* ** **********)"
  • "******** ******* ********"
  • "** ***** * ******** physical ******* *** *** video ****** ** *** VLANs."
  • "** ********** ******** *** video ************ ******* **** other ******** (********, ********* LAN ***.)"
  • "******* *** ***** ****** on * ******** ******* or ****** **** ** possible"

********** ** ******* ***** is **** ****, ****** not ** ************ ** might ** ********:

  • "*** ** ********** (*** remote ***********, *** ******** connectivity."
  • "** **** *** *******, we *** *** *** SSL ********** ******* ******'* and ******."
  • "********* ******* * ***. Small ******** *** *********** customers *** **** **** a *** ***** ****** use *** ******* ****** app **** ***; ** uses * ******* *********** and ****** ********** *** the ***, **** **, in ** *******, *** most ****** ******** ** offer."
  • "****** ********** *** ********* in *****."
  • "****** **********(*****, ***) ** communicate **** *******, ********** of ***** ** **** drives, ***** ************ ** confirm ************ ** *******, etc."
  • "*** ********* ********* ********** when ***** ******** ****."

******* ******** *** ******** updated, *** ********* ****-***** software **** ******, *** not ** ********** ** the ***** *****.

*********** *****, ** ******* outside *******/************ *** *** commonly *********.

******* ** *** ********* IT ********** ** **** responsibility *** ***** ******** was **** **********:

  • "** ******* ********* ****** their ******** *********. ** they ***** **** ** add *** ***** ********** it ** ** ** them."
  • "*** ****** ********* *** have **-***** ** ********* or ******** ***** ***** IT ********* *** ** remote ****** **********."
  • "** **** **** ******* with ***** ** *********** to ******* ** ***** rules *** **************."
  • "***** ** ***** ** support"
  • "** ***** ** ** to ******'* ** *********** for *** ******** *******"
  • "** ********* *** ****** the ****** *** *********** security ******** ** *** system *******."
  • "**** ****** ** *** - **'* ** ********'* corporate ******** *** ** department **************"

**** ******** ***** *** work *** * ***** customer *** *** ** IT **********, *** ** the **** ** ****** organizations ** *** ** wise ** ***** *** customer ** ****** *** their ******** ******** ******* are ***** ** ** remotely ********, *******, ** connected ** ***** ********.

Manufacturers ****** ** **** ******

****** ************* ******** * lot **** ***** **** VMS ********* ** ***** of ********* ********.

**** *** ** *** the **** *****, **** nearly *** ***** ** responses:

  • "****. **** ***** *** ability ** ********* ***.** and *** ** ***** through *** ****** ************* pages *** **** ******* cybersecurity ****** ** **** of ***** *********** *** technical ******."
  • "****, **** *** * true ******* ******** ********."
  • "**** **************. ****'** *** only ************ ** **** to *** ******** ***** about *************"
  • "**** *** ***** *** aware ** ***** ******** and **** ******** *********** that ** ********* ** this."
  • "**** *** *** * cyber ******** ***** *** years **** ********* *********. Their ***** ********* ***** is ****** *****, ****** if ***'** *** *******, they *** ***** ** compromised"
  • "*** ****** *************, **** AXIS, ***** *** *********** to ********* *** ******* within ***** ********, **** we *** ***. ***** manufacturers, ***'* ***** ** to ****** ***** ******* users *** ******* *********."
  • "**** **** ** ** 5 ****** ** ********."
  • "**** ***** ** **** as **** ***'* **** default ********* ** ***** products, ****** *** *** one **** ************."

**** **** *** ********** ********* ******** *************** *** enhancing ******** *** **** products.

* *** *********** ********* about ****, **** *** noting *** **** ** adding ***** ***** **** to **** ******* *** another **********:

"**** - ******* ** their ******* **** .*** platform *** ******** (**** Media ******* ******), ******** on **** *** ******* (VMD3, ***), ******** ** Windows **** *** ******* functionality ** ******* (******** audio *******, ***) *** 100% *******-**** *** (*** that ** ***** *** their ***). ****, **** allow ***** ********* *** allow ***** ***** ******* attempts **** ********* ******** guesses."

********:

  • "********'* *****-** **** ******** update, ****** ****** ******** updates, *** ******-******* ****** of *********/*********** ******* ***** puts **** **** ** my **** ** ****."
  • "******** **** *** ******** multiple ***** ** **************, adopting ********** (******* ******* & ***, ******* ******* & *******)"
  • "******** - **** ** talk ** **** ***** devices, *** ***** *** cameras **** ** **** a ****** ********** ******* their ********."

*****:

  • "***** - ********** ******** and ***** ********* ********"
  • "***** *******, ******** ************ for ********* ********."
  • "***** ** ***** ***'* in *** ***** ** cameras **** *** ****** of * *** ***** COA ****'* **** ** the *** *** ***** agencies ****** *** ********** that ****** ***** ** to *** **** ***** in ***** ** **** cyber ******** ** *** edge."

***** **** *** ***** ******** *****.

*******:

  • "** *** ***** ******* and ***** ******, **** have ******** ******** ********, stream **********, *** *******. Probably ******* **** ******* Enterprise ******* ********* *** enterprise ********* *** **** bigger ************ ********* ** security."
  • "******* ** ****** ***** strides ** ********* ********** and ** ****** ********** to ******* ******."
  • "******* - **** *** more ** ** ** related *******"

******* ***** ********** ************** ** ***** ******* portal

*********:

  • "********* ** ****** **** - **** **** **** interaction ******** ** ****** devices ***."
  • "********* - **** **** up **** ******* ******* and **** ** ***** to *** ****** ****** software. ******** - **** do **** ** **** ONVIF *******, *** ***** own ******* **** ** have * ****** ********** between ***** ********."
  • "*********, ****, ***** - They *** **** **** a **** **** **** at ***** *** ********** and ********, ***************, ******* white ****** ** **** practices *** *** ***** products ******* ******."

China / ********* ** ***** ******

*** *** ***** ****** products, ********* *** *** predominantly ********* *****, ***** came ** **********, *** several ****** ********* "******* cameras" ** ******** *******.

  • "********* - **** ******* of **** *** **** reported."
  • "*********, ** ***** **** security ******** ****** *** implementation ** ***** ***. easy ** ** ******."
  • "*********, * ***** ****** about ******* ********** ****** on ********* *** ********* DVRs *** ******'*."
  • "********* *** * *** reputation, ***** *** *****"
  • "********* *** *** ***** manufacturers. **** ****** ***'* care ** ***'* **** the ********* ** ****** their ******* *** ******."
  • "********* - ******** ******** discovered *** ******* ********** involvement **** *** *******."
  • "*********. **** ******* ***** login ** **** *** change *** ******* ********* and ********* **** ***** updated ******** ******** *** I ***** ***'* ******** trust *** ******** ** the ********."
  • "**** ****** ** **** used **** **** **** of *****, *** ***** is ** *** *** worst. *********, *******/******/*******, *** others **** **** *** security ****** ***. ************, Dahua ***** ****** ***** access ***** ******* ***** and **** ****** ** disabled. ********* *** *** many ***** *****, **** of ***** **** **** fixed. ******* ******* ******* were ******* **** * bug **** **** ****** into *** *** ********* of *** ******, **** browser ********** ** ************* session **** ***** *** be ****** *** **. You **** ****** ** clear *** ******* **** in ***** ** *** out."
  • "*********, ** ***** **** they *** ****** ** cover ********* **. * no ****** ***** ****. Love ***** ******* *** don't ***** ****. **'** looking *** * *** recording ********."
  • "*********. ****** **** **** some ************ ***** ***** thoroughly *****, **** **** did ** ** ******** to ******* ********. ***** needs ** ** * culture ** ******** ** a ******* *******--*** ** afterthought."
  • "********* *** * ******** of *** ********* ***** inside ***** *******."
  • "*****. **** **** ***** back **** ********* **** are **** ** **** on *** ******** ** no ****** *** **** you ******* *** ****** with * **** ******** or *****, ****** **** has ** ****** ** the ****** *** *** in."
  • "*** ***** ******* ******* are *** *****... *'** scanned **** **** **** had **** ***** ***** were *** **** ****** as * ******* ** the ********."

********* **** **** ********* ********** ** ***** *******, with * **** ** report ****** *** ****** ******** **** ********* video.

Comments (3)

Hacking a device 101.. Use Chrome web browser, login to your IP device, assume that there is a web browser. Which is most devices now days.

Now press F12 the developer console! ( don't be scared it's not that hard! )

Now locate the option on the ribbon called Network!! press refresh for the page. that's the little almost circle with arrow on it on the top left next to left-right browser navigation icons.

For at most you will discover a lot of things what is going on. the things to look for in weak or complete shit security is transfer of username / passwords in plain easy to read text. The interesting column is the initiator one, this show you all what is passed on the network at http traffic commands!

Now if you consider this someone with the most basic and free tools, like Wireshark, can capture network traffic and find all the passwords they could wish for.

Now one other item to select is select the ribbon item EditthisCookie

This will show you what the device is keeping in the browser. Again look for simple things like passwords, and such.

For the hard nuts, you might want take look at firmware update utilities, as they tend to offer some very dangerous commands, in case of Chinese products, typically, the Linux telnet the most hacked part of an OS uses plain text commands.

End of day security is only a weak as the more cleaver person wants to break in.

We all know nothing is secure, we hope at some basic level we can have some sanity in security devices. Just don't expect this day one from Chinese companies, at least for now.

In contrast to the reports, I heard the Los Angeles Unified School District, one of the largest in the country, has standardized on HIKvision. One rep to another conversation.

I know of a local install at a county office using Hikvision cameras. I'm waiting till it completes to send some "anonymous" tips to local news agencies about the security issues with Hikvision and see what happens. I'll post the results if it comes to anything.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to emerging into an AI cloud era.  The goal of this history...
Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
New GDPR Guidelines for Video Surveillance Examined on Jul 18, 2019
The highest-level EU data protection authority has issued a new series of provisional video surveillance guidelines. While GDPR has been in...
HD Analog vs IP Guide on Jul 16, 2019
For years, HD resolution and single cable signal/power were IP camera advantages, with analog cameras limited to much lower resolution and...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 15, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
Axis ARTPEC-7 P1375-E Camera Tested on Jul 12, 2019
Axis claims the new P1375-E box camera with ARTPEC-7 chip delivers "clear, sharp images in any lighting condition." But how well does it do? We...
Last Chance - Camera Course Summer 2019 on Jul 11, 2019
Last day to register is Thursday, July 11, 2019. This is the only independent surveillance camera course, based on in-depth product and technology...
Lens Focal Length Tutorial on Jul 10, 2019
3mm, 6mm, 2.8 - 9mm, 5 - 50mm, etc. Camera specifications often list lens lengths but what do they mean? These metrics are important in...
Poor OSDP Usage Statistics 2019 on Jul 09, 2019
OSDP certainly offers advantages over decades-old Wiegand (see our OSDP Access Control Guide) but new IPVM statistics show that usage of OSDP, even...

Most Recent Industry Reports

History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to emerging into an AI cloud era.  The goal of this history...
Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
New GDPR Guidelines for Video Surveillance Examined on Jul 18, 2019
The highest-level EU data protection authority has issued a new series of provisional video surveillance guidelines. While GDPR has been in...
Anyvision Aims For 2022 Revenue of $1 Billion on Jul 17, 2019
Only 3 video surveillance manufacturers do a billion dollars or more in annual revenue - Hikvision, Dahua, and Axis. Now, Anyvision plans to join...
HD Analog vs IP Guide on Jul 16, 2019
For years, HD resolution and single cable signal/power were IP camera advantages, with analog cameras limited to much lower resolution and...
How To Troubleshoot Wiegand Reader Problems - Inverted Wiring on Jul 16, 2019
Wiegand is the dominant method of connecting access readers, but problems can arise for installers. In fact, one of the most difficult reader...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Motorola Acquires Watchguard, Adds to Vigilant And Avigilon on Jul 15, 2019
2 years ago, Motorola had no position nor relevancy to video surveillance. Now, they own major video surveillance, LPR and body camera providers...
Hikvision Global News Reports Directory on Jul 15, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact