Cyber Security For Video Surveillance Study

Author: Brian Karas, Published on Apr 27, 2016

This study provides the foundations for video surveillance professionals to understand the importance of cybersecurity, what is being done to enhance cybersecurity and what providers are viewed as the best and worst at cybersecurity.

100 integrators answered the following 5 open-ended questions on cyber security:

  • How important is cyber security in your customers' decision making process?
  • What type of customers are most concerned about cyber security? Why?
  • What steps do you take to ensure cyber security for your customers video surveillance systems?
  • Which security manufacturers do you feel are strongest in terms of cyber security? What do they do that makes you feel this way?
  • Which security manufacturers do you feel are weakest in terms of cyber security? What do they do that makes you feel this way?

They provided detailed color commentary on each point, so you can understand their mindset and approach.

Summary

The key trends revealed in the study:

  • Overall, cyber security is not very important for customer's decision making process.
  • The 4 segments showing highest cybersecurity concern were government, banking, education and healthcare
  • Steps taken to secure systems were generally basic. While various techniques were mentioned, changing default password was the most common.
  • Western video surveillance manufacturers were viewed as the strongest in cyber security.
  • Chinese, and specifically Hikvision, was selected as the weakest in cyber security.

Full details, integrator explanations and our analysis is shared inside.

**** ***** ******** *** *********** *** ***** ************ ************* ** understand *** ********** ** *************, **** ** ***** **** ** enhance ************* *** **** ********* *** ****** ** *** **** and ***** ** *************.

*** *********** ******** *** ********* * ****-***** ********* ** ***** security:

  • *** ********* ** ***** ******** ** **** *********' ******** ****** process?
  • **** **** ** ********* *** **** ********* ***** ***** ********? Why?
  • **** ***** ** *** **** ** ****** ***** ******** *** your ********* ***** ************ *******?
  • ***** ******** ************* ** *** **** *** ********* ** ***** of ***** ********? **** ** **** ** **** ***** *** feel **** ***?
  • ***** ******** ************* ** *** **** *** ******* ** ***** of ***** ********? **** ** **** ** **** ***** *** feel **** ***?

**** ******** ******** ***** ********** ** **** *****, ** *** can ********** ***** ******* *** ********.

*******

*** *** ****** ******** ** *** *****:

  • *******, ***** ******** ** *** **** ********* *** ********'* ******** making *******.
  • *** * ******** ******* ******* ************* ******* **** **********, *******, ********* *** **********
  • ***** ***** ** ****** ******* **** ********* *****. ***** ******* techniques **** *********, ******** ******* ******** *** *** **** ******.
  • ******* ***** ************ ************* **** ****** ** *** ********* ** cyber ********.
  • *******, *** ************ *********, *** ******** ** *** ******* ** cyber ********.

**** *******, ********** ************ *** *** ******** ** ****** ******.

[***************]

Low **********

**** ********* **** ***** ******** ** *** ********** ** ***** decision ****** *******. ****** **** ** *** ********* ********* ****:

******** ************ *** ***** ***** ** *** ****** *** *** priority:

  • "** ** *** ********* ** ***"
  • "** ********* ****** ******* * ******* **** ************* ** ***** decision ****** *******."
  • "*** *** ******* **** ***'* **** *** *****"
  • "* ******** ** *** ********* **** ** **** ********** **** don't ****** **** ***** ***** ******** ******* ** *** ************ systems."
  • "******** *** ********** ******** ** *** *****, *** **** **** are *** *** ******* ** **** ****** **** **** **** the **** ***** *** ******* **** **** **** **** ****** to ***."

******* *********** ********* **** ******** *** ** **** ********* **** aware ** ***** ******** *****:

  • "** **** *** ** **** ******* ******* ***** **** ***, but ** *** *** **** ** **** * **** *** why ** ** *******."
  • "*** **** **** *** ******** ***** **** **** **** ****** be."
  • "** ** ***** ********** ***** ******* ** ***** *********."
  • "*'* *** ****** ***********. *** **** **** **** ******** * threat ** **** * ***** *** ***************."
  • "** **** ****, **** ****** ** *** **** *** ******* still, *** ** *** ********** ******** ** ** ** ***** attention."

**********, *******, *********, ********** - **** ***** ******** *****

***** ********* *** ***** **** ********** ************ **** **** ****** to **** ****** ******** ****** ***** ********.

  • "******** *** *** ** ***** **** *********. ** ********* **** remote ****** ** *** ********* ** ****** *** ********* ******. Some ****** ** ** *** ***** ********* *** ***** ******."
  • "****** *********, ********* ** ************* ******* *** **** **** *********"
  • "******* *** **** **** ********, ******* **** *** ******** *********** & ******* **** ********* ****** ********* ** **** ******* **** be ******** **** ** ************ ****."
  • "*** *** *********, **** **** *** ***** *** **** **** at ** *** ** **** *********."

*****, ********** ********, ******* *** ********** ************* ******** **** ** IT ********** **** ** *********** *** ******* ********. ***** ************* have **** ********* ** ****, ** ******** *********.

  • "********* *** ** ********* ** **** *** *** ***** **** often"
  • "****** ** ***** ********** *** ** ****** ********** ** ** site ** ********** ***** **** ** ************* ** *** *********** to **** ******** *****."
  • "********** - **** ****** *** ** ******** ********"
  • "*******, ******* **** **** ******* ********"
  • "********* ******, *** *****, **********. **** *** ******* ***** ******* taking **** ***** ******* *** ****** ** **** ***** *** video ************ ******, ** ***** *** ***** ************ ****** ** a ******** ** ***** *******."
  • "********** *** ***** *** **** ********* ***** **** **** ******** data ** **** *** ******** ******** ******* *** **** ******* were *********."
  • "*********, *******, *********. **** **** **** ******** *** *** ******* FBI ********* ***"
  • "*** **** ** *** ****** **** ** *********, ** *** concern ** ******* *** ******** ** *** *** ********** ******. It ** ****** ** ***** *****. **** ** *** ************* clients *** **** ** *********, *** **** **** ********* ***** to **** **** **."

**** *** *********, ******* ********* ** *** **** ***** ******** as * ******* ************* *** *** ****** ************* **. ******* organizations *** **** ****** ** ** ****** *******, *** * data ****** ** **** ****** ** ****** ******** ****.

Methods *** ******** ********* ****

******** ******* ********* *** *** **** ****** **** ***** ** enhance ***** ********.

***** **% ** ********* ********* **** **** **** ** ******* security.

********* ** ********** ******** **** ********** ******:

  • "********** ****** / ****** ******** ** ** *** ******** (********* or **********)"
  • "******** ******* ********"
  • "** ***** * ******** ******** ******* *** *** ***** ****** or *** *****."
  • "** ********** ******** *** ***** ************ ******* **** ***** ******** (internet, ********* *** ***.)"
  • "******* *** ***** ****** ** * ******** ******* ** ****** VLAN ** ********"

********** ** ******* ***** ** **** ****, ****** *** ** consistently ** ***** ** ********:

  • "*** ** ********** (*** ****** ***********, *** ******** ************."
  • "** **** *** *******, ** *** *** *** *** ********** between ******'* *** ******."
  • "********* ******* * ***. ***** ******** *** *********** ********* *** also **** * *** ***** ****** *** *** ******* ****** app **** ***; ** **** * ******* *********** *** ****** encryption *** *** ***, **** **, ** ** *******, *** most ****** ******** ** *****."
  • "****** ********** *** ********* ** *****."
  • "****** **********(*****, ***) ** *********** **** *******, ********** ** ***** on **** ******, ***** ************ ** ******* ************ ** *******, etc."
  • "*** ********* ********* ********** **** ***** ******** ****."

******* ******** *** ******** *******, *** ********* ****-***** ******** **** listed, *** *** ** ********** ** *** ***** *****.

*********** *****, ** ******* ******* *******/************ *** *** ******** *********.

******* ** *** ********* ** ********** ** **** ************** *** cyber ******** *** **** **********:

  • "** ******* ********* ****** ***** ******** *********. ** **** ***** like ** *** *** ***** ********** ** ** ** ** them."
  • "*** ****** ********* *** **** **-***** ** ********* ** ******** third ***** ** ********* *** ** ****** ****** **********."
  • "** **** **** ******* **** ***** ** *********** ** ******* to ***** ***** *** **************."
  • "***** ** ***** ** *******"
  • "** ***** ** ** ** ******'* ** *********** *** *** internal *******"
  • "** ********* *** ****** *** ****** *** *********** ******** ******** on *** ****** *******."
  • "**** ****** ** *** - **'* ** ********'* ********* ******** and ** ********** **************"

**** ******** ***** *** **** *** * ***** ******** *** has ** ** **********, *** ** *** **** ** ****** organizations ** *** ** **** ** ***** *** ******** ** decide *** ***** ******** ******** ******* *** ***** ** ** remotely ********, *******, ** ********* ** ***** ********.

Manufacturers ****** ** **** ******

****** ************* ******** * *** **** ***** **** *** ********* in ***** ** ********* ********.

**** *** ** *** *** **** *****, **** ****** *** third ** *********:

  • "****. **** ***** *** ******* ** ********* ***.** *** *** up ***** ******* *** ****** ************* ***** *** **** ******* cybersecurity ****** ** **** ** ***** *********** *** ********* ******."
  • "****, **** *** * **** ******* ******** ********."
  • "**** **************. ****'** *** **** ************ ** **** ** *** actually ***** ***** *************"
  • "**** *** ***** *** ***** ** ***** ******** *** **** specific *********** **** ** ********* ** ****."
  • "**** *** *** * ***** ******** ***** *** ***** **** dedicated *********. ***** ***** ********* ***** ** ****** *****, ****** if ***'** *** *******, **** *** ***** ** ***********"
  • "*** ****** *************, **** ****, ***** *** *********** ** ********* any ******* ****** ***** ********, **** ** *** ***. ***** manufacturers, ***'* ***** ** ** ****** ***** ******* ***** *** related *********."
  • "**** **** ** ** * ****** ** ********."
  • "**** ***** ** **** ** **** ***'* **** ******* ********* on ***** ********, ****** *** *** *** **** ************."

**** **** *** ********** ********* ******** *************** *** ********* ******** *** **** ********.

* *** *********** ********* ***** ****, **** *** ****** *** risk ** ****** ***** ***** **** ** **** ******* *** another **********:

"**** - ******* ** ***** ******* **** .*** ******** *** software (**** ***** ******* ******), ******** ** **** *** ******* (VMD3, ***), ******** ** ******* **** *** ******* ************* ** cameras (******** ***** *******, ***) *** ***% *******-**** *** (*** that ** ***** *** ***** ***). ****, **** ***** ***** passwords *** ***** ***** ***** ******* ******** **** ********* ******** guesses."

********:

  • "********'* *****-** **** ******** ******, ****** ****** ******** *******, *** easily-visible ****** ** *********/*********** ******* ***** **** **** **** ** my **** ** ****."
  • "******** **** *** ******** ******** ***** ** **************, ******** ********** (between ******* & ***, ******* ******* & *******)"
  • "******** - **** ** **** ** **** ***** *******, *** their *** ******* **** ** **** * ****** ********** ******* their ********."

*****:

  • "***** - ********** ******** *** ***** ********* ********"
  • "***** *******, ******** ************ *** ********* ********."
  • "***** ** ***** ***'* ** *** ***** ** ******* **** the ****** ** * *** ***** *** ****'* **** ** the *** *** ***** ******** ****** *** ********** **** ****** takes ** ** *** **** ***** ** ***** ** **** cyber ******** ** *** ****."

***** **** *** ***** ******** *****.

*******:

  • "** *** ***** ******* *** ***** ******, **** **** ******** security ********, ****** **********, *** *******. ******** ******* **** ******* Enterprise ******* ********* *** ********** ********* *** **** ****** ************ regarding ** ********."
  • "******* ** ****** ***** ******* ** ********* ********** *** ** easily ********** ** ******* ******."
  • "******* - **** *** **** ** ** ** ******* *******"

******* ***** ********** ************** ** ***** ******* ******

*********:

  • "********* ** ****** **** - **** **** **** *********** ******** to ****** ******* ***."
  • "********* - **** **** ** **** ******* ******* *** **** to ***** ** *** ****** ****** ********. ******** - **** do **** ** **** ***** *******, *** ***** *** ******* seem ** **** * ****** ********** ******* ***** ********."
  • "*********, ****, ***** - **** *** **** **** * **** hard **** ** ***** *** ********** *** ********, ***************, ******* white ****** ** **** ********* *** *** ***** ******** ******* audits."

China / ********* ** ***** ******

*** *** ***** ****** ********, ********* *** *** ************* ********* brand, ***** **** ** **********, *** ******* ****** ********* "******* cameras" ** ******** *******.

  • "********* - **** ******* ** **** *** **** ********."
  • "*********, ** ***** **** ******** ******** ****** *** ************** ** their ***. **** ** ** ******."
  • "*********, * ***** ****** ***** ******* ********** ****** ** ********* via ********* **** *** ******'*."
  • "********* *** * *** **********, ***** *** *****"
  • "********* *** *** ***** *************. **** ****** ***'* **** ** don't **** *** ********* ** ****** ***** ******* *** ******."
  • "********* - ******** ******** ********** *** ******* ********** *********** **** the *******."
  • "*********. **** ******* ***** ***** ** **** *** ****** *** default ********* *** ********* **** ***** ******* ******** ******** *** I ***** ***'* ******** ***** *** ******** ** *** ********."
  • "**** ****** ** **** **** **** **** **** ** *****, but ***** ** ** *** *** *****. *********, *******/******/*******, *** others **** **** *** ******** ****** ***. ************, ***** ***** allows ***** ****** ***** ******* ***** *** **** ****** ** disabled. ********* *** *** **** ***** *****, **** ** ***** have **** *****. ******* ******* ******* **** ******* **** * bug **** **** ****** **** *** *** ********* ** *** camera, **** ******* ********** ** ************* ******* **** ***** *** be ****** *** **. *** **** ****** ** ***** *** browser **** ** ***** ** *** ***."
  • "*********, ** ***** **** **** *** ****** ** ***** ********* up. * ** ****** ***** ****. **** ***** ******* *** don't ***** ****. **'** ******* *** * *** ********* ********."
  • "*********. ****** **** **** **** ************ ***** ***** ********** *****, they **** *** ** ** ******** ** ******* ********. ***** needs ** ** * ******* ** ******** ** * ******* concern--not ** ************."
  • "********* *** * ******** ** *** ********* ***** ****** ***** offices."
  • "*****. **** **** ***** **** **** ********* **** *** **** to **** ** *** ******** ** ** ****** *** **** you ******* *** ****** **** * **** ******** ** *****, anyone **** *** ** ****** ** *** ****** *** *** in."
  • "*** ***** ******* ******* *** *** *****... *'** ******* **** that **** *** **** ***** ***** **** *** **** ****** as * ******* ** *** ********."

********* **** **** ********* ********** ** ***** *******, **** * **** ** ****** ****** and ****** ******** **** ********* *****.

Comments (3)

Undisclosed Manufacturer #1

04/28/16 12:06am

Hacking a device 101.. Use Chrome web browser, login to your IP device, assume that there is a web browser. Which is most devices now days.

Now press F12 the developer console! ( don't be scared it's not that hard! )

Now locate the option on the ribbon called Network!! press refresh for the page. that's the little almost circle with arrow on it on the top left next to left-right browser navigation icons.

For at most you will discover a lot of things what is going on. the things to look for in weak or complete shit security is transfer of username / passwords in plain easy to read text. The interesting column is the initiator one, this show you all what is passed on the network at http traffic commands!

Now if you consider this someone with the most basic and free tools, like Wireshark, can capture network traffic and find all the passwords they could wish for.

Now one other item to select is select the ribbon item EditthisCookie

This will show you what the device is keeping in the browser. Again look for simple things like passwords, and such.

For the hard nuts, you might want take look at firmware update utilities, as they tend to offer some very dangerous commands, in case of Chinese products, typically, the Linux telnet the most hacked part of an OS uses plain text commands.

End of day security is only a weak as the more cleaver person wants to break in.

We all know nothing is secure, we hope at some basic level we can have some sanity in security devices. Just don't expect this day one from Chinese companies, at least for now.

Undisclosed Manufacturer #2

04/28/16 01:01pm

In contrast to the reports, I heard the Los Angeles Unified School District, one of the largest in the country, has standardized on HIKvision. One rep to another conversation.

Undisclosed Integrator #3

04/28/16 01:18pm

I know of a local install at a county office using Hikvision cameras. I'm waiting till it completes to send some "anonymous" tips to local news agencies about the security issues with Hikvision and see what happens. I'll post the results if it comes to anything.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

IBM / Genetec Surveillance System Investigated Over Philippines Human Rights Abuses on Mar 22, 2019
A lengthy investigation into an IBM video surveillance project in the Philippines, raising concerns IBM helped local police conduct a bloody...
Eagle Eye Favorability Results 2019 on Mar 21, 2019
Eagle Eye has been the biggest spender in the cloud VMS market including (via their owner) acquiring Brivo for $50 million and CameraManager from...
Large Hospital Security End User Interview on Mar 21, 2019
This large single-state healthcare system consists of many hospitals, and hundreds of health parks, private practices, urgent care facilities, and...
Silicon Valley Cybersecurity Insurance Startup Coalition Profile on Mar 20, 2019
Many industry people believe cybersecurity insurance is not worth it, as the voting and debate in our Cybersecurity Insurance For Security...
Covert IP Camera Shootout - Axis, Hanwha, Hikvision, March, Vivotek on Mar 20, 2019
Covert cameras were one of the last holdout areas for analog cameras. However, in the past few years, IP / HD covert cameras have become...
Top Metrics For Ensuring Integrator Profitability - Statistics on Mar 20, 2019
How do integrators ensure the profitability of their projects? As part of our profitability study, 100+ integrators answered the following...
Genetec Security Center 5.8 Tested on Mar 19, 2019
Genetec has released Version 5.8. This comes after a wait of more than a year that caused frustrations for many Genetec partners. Our previous...
Large US University End-User Video Surveillance Interview on Mar 18, 2019
Schools have become targets in modern days of active shooters and terrorist fears. The need for video and access security is high. Universities...
Hikvision Favorability Results 2019 on Mar 18, 2019
Hikvision favorability results declined significantly in IPVM's 2019 study of 200+ integrators. While in 2017 Hikvision's favorability was...
ONVIF Favorability Results 2019 on Mar 15, 2019
In the past decade, ONVIF has grown from a reaction to the outside Cisco-lead PSIA challenge, to being the de facto video surveillance standard...

Most Recent Industry Reports

IBM / Genetec Surveillance System Investigated Over Philippines Human Rights Abuses on Mar 22, 2019
A lengthy investigation into an IBM video surveillance project in the Philippines, raising concerns IBM helped local police conduct a bloody...
Eagle Eye Favorability Results 2019 on Mar 21, 2019
Eagle Eye has been the biggest spender in the cloud VMS market including (via their owner) acquiring Brivo for $50 million and CameraManager from...
Large Hospital Security End User Interview on Mar 21, 2019
This large single-state healthcare system consists of many hospitals, and hundreds of health parks, private practices, urgent care facilities, and...
Silicon Valley Cybersecurity Insurance Startup Coalition Profile on Mar 20, 2019
Many industry people believe cybersecurity insurance is not worth it, as the voting and debate in our Cybersecurity Insurance For Security...
Covert IP Camera Shootout - Axis, Hanwha, Hikvision, March, Vivotek on Mar 20, 2019
Covert cameras were one of the last holdout areas for analog cameras. However, in the past few years, IP / HD covert cameras have become...
Top Metrics For Ensuring Integrator Profitability - Statistics on Mar 20, 2019
How do integrators ensure the profitability of their projects? As part of our profitability study, 100+ integrators answered the following...
Avigilon Launches 'Renewed Products Program' on Mar 19, 2019
There are lots of 'pre-owned' cars but pre-owned IP cameras? While such programs are common in other industries, in video surveillance, they are...
Genetec Security Center 5.8 Tested on Mar 19, 2019
Genetec has released Version 5.8. This comes after a wait of more than a year that caused frustrations for many Genetec partners. Our previous...
Retired Mercury President Returns As Open Options President on Mar 18, 2019
Open Options experienced major changes in 2018, including being acquired by ACRE and losing its President and General Manager, John Berman who...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact