Cybersecurity for IP Video Surveillance Guide

Author: IPVM Team, Published on May 18, 2018

Keeping surveillance networks secure can be a daunting task, but there are several methods that can greatly reduce risk, especially when used in conjunction with each other.

In this guide, we look at several security techniques, both physical and logical, used to secure surveillance networks, including:

network security2

  • Network Hardening Guides
  • Password Security
  • LDAP / Active Directory Integration
  • VLANs (Virtual LANs)
  • 802.1X Authentication
  • Disabling Switch Ports
  • Disabling Network Ports
  • Disabling Unused Services
  • MAC Address Filtering
  • Locking Plugs
  • Physical Access Control
  • Managing Network Security For Video Surveillance Systems

******* ************ ******** ****** *** ** * ******** ****, *** there *** ******* ******* **** *** ******* ****** ****, ********** when **** ** *********** **** **** *****.

** **** *****, ** **** ** ******* ******** **********, **** physical *** *******, **** ** ****** ************ ********, *********:

network security2

  • ******* ********* ******
  • ******** ********
  • **** / ****** ********* ***********
  • ***** (******* ****)
  • ***.** **************
  • ********* ****** *****
  • ********* ******* *****
  • ********* ****** ********
  • *** ******* *********
  • ******* *****
  • ******** ****** *******
  • ******** ******* ******** *** ***** ************ *******

[***************]

Cybersecurity ********

**** **** ****, ************* *** ****** * *** *****, **** published ***************, *****, *** ******* ** *** ****.

** **** *** **** * *****, ***** *************** (*** ***** effects) **** ******** ** ******** *************, *********:

******* ** *** ******** ** ***** ********* *** ***** ********** frequency, ** ** ******** **** ***** ********** *** ****** ** cyber ******** *** ************ *******, *** *** ** ******* ******* simple ******* ** *** **** *****.

Network ********* ******

** *** ** ******** ** *****, ******* ********* ****** *** common, ********* *************** (** ** *******, *** ********* ********* *****) ** **** *** ******* **** ******. ****/**** ** ***** recommendations ***** ** ************ ********, ** ****, ********* *********** ******** and ***** *******, ******** *********, ********* *****, ***.

*******, **** *************** *** ** ***** *** ****** **** **** IP ***** *********** *** ******* **, ** **** ** ********* for * ***** ******. ******* ************** ******* **** ** ***.**, LDAP ***********, **** **********, ***., *** ****** *** ***** *** time/cost ** ********* *** **** *******, ***** *** ******* ****.

Surveillance ********* ****** ************ ******

****** **, ************ ******** ********* ****** **** ************ **** ****. However, **** ****** *** ******* ** *** **** * *****

*** ***** *************** ** **** ** ***** ****** ****, *** most *** ******* **** ***** *** ******** ******, ********* ** the *********** ** *** ************.

*** **** *****, *** ********, ****** **** **** **** (*** production ***) ** ****** ****** ********** ********, *** ******* ***** best *********, **** ** ****** *********, ******** ********, *** ********* anonymous ******, ******* **** ******* *********, **** ** ***.** **************, SNMP **********, *** ****** *******.

***** ***** ****** *** ************-********, ********* ************ ********* ** *** camera ** ***, **** *************** *** ****** ****** *** *************, and **** ** **** **** ** ******** **** *********, *** the ********* ********* *****.

Strong *********

****** ********* *** *** **** ***** ******** *******, *** *************, ignored ** **** *****. **** ************ ******* *** ******** ** the ***** **** ******* ********* ** *** *********, ********* *******, switches, *********, *** **** (*** ***** ******* ******* ********* ****). ***** ** *** **** ** ****** *** ***** ** access ******* *** **** **** ** ****** *** ****** ** log **** ***'* ******* (***:****** ****** *** ******* ** *******).

** *** **** *****, *** ************ ******* *******, ********* *******, clients, *** *******, ****** ** ******* **** *** ******** **** strong *********, ********** ** * ****** ********. **** ******** ****** to *** ******* ***** ****** ******** ********, ********* * **** skilled ******** *** **** ******* *******.

**** ************* ******* ******** *** ******* ******** **** ********** *** the ***** **** (*** *********** ** *** ****, ***** *** ******* *** *********). ******, ** ************* ******* (*)***** **** ******** ******* ********* *********, ****** *** **** **** is ******* ******* ** ** ****.

LDAP/AD ***********

***** ****/****** ********* (**) ***********, *** *********** *** ******** ** network ***** ******* ** * ******* ****** (**** ****** ****** sign-on). ***** ***** **** ******** ***** ********* ******** ******** *** expiration *****, **** *********** *** ******* ******** **** ***** *** accounts ***** ** *** **** ***** ************. **** ******* ************** overhead, ***** ********** ******** ** *** ** ** ******* *** maintained.

*********, **** *** ** ********** ** ******, ********** *******, ***** many ***** ************* ** *** **** ** **** ****** ***********. Some ***** ** ******* ******* ***** *** ********* ** ****** entities, ********** ********* *** ********* **********, *** *** **** ** these ************* *** ****** ** *** ** *** ***** ******* access *******.

**** / ** ***** ************* ** **** *** ** *******, but, ** ******** ** ***. ***************, ** * ********* ********, is *** ********* ** ****** *** ** ******, ***** ********* run ** *****. ********** ** ****** ******* ** ** **, *** ** *** *** ****** *** ********** ****** *****.

Firewalls/Remote ******

** ******* ************ ****** ******, **** ************ ******* *** *** connected ** *** ******** ** ***, ******* ** * ******* separate ***. **** ******* ****, *** *** **** ******* **** difficult, ** ******* ** ************ ******** *** ********, ******* ****** downloaded, **** ** ****** **** *** ** ***** *****.

***** ******* ***** *** ********* *** ********* ****** * ********, which ****** *******/******** ******* ** **** ******** ** ********* *** ports ***** **** **** **********. ***** ******* ** ********. ******** implemented, **** *** ******* *** **** ******** ** *******. **** cameras *** ***** ************ ********* ** ** ********* ** **** routers ******** ** ** ****. ***** **** **** *** ***** security *************** ******* ** ******** *******. *** ***** ** ************** ** ***** ********, *** *** ***** ** ********** ********** ********* **************** **** ** ********* ******** **** / *** *******.

Remote ****** *****

*** ******* ***** ************* ******, ***** *** ******* *** ******* *** ** **** ***** to ** ****. *******, **** **** **** ******** * ******** opportunity *** ** ********. ******* *** **** *** ***** ****** by *** ***. ***** ****** ***** ** ************ ************* *** which ***** **** ** **** ** ****** ****** ** ******** (for *********** ** ****** *******), *** ** **** **** ******** in ********** ***** *** ** ***** ************ ********.

P2P/Cloud ******

*************, **** ************* ***** *** "***** ****" ****** ******, ***** sets ** * ****** ****** *** ** ******** ********** ******* requiring **** *****, ******** *****. **** ******* *** ********* *** cloud *********** *** ****** ******, **** *********** *****,***** *** ***** ***, ********** *****. ************, **** ****** ******* ******** *** ******* **********, **** as *******, **********, *********, ***.

** ******* ***** ******* ** ********* ******* ****** *** ***** ********************.

*****

******* **** (********* ** *****)******* ******** ** ********** ******* **** ******** ******* ********. ** while ***** ********, **** ** ** ***** ************ ********* ** general ****** *** *******, *** ***** ** *** **** ******** switch, *** ********* ******** *** ******** *** ********* ** **** other, *** ***********.

*** *******, ** *** ***** *****, *** ************ ********* ** VLAN * *** *** ** ******* ** *** ****** ** on **** *, *** ***** * **** ** *** ****** (VLAN *)"***" ******* ** *** **** **** (**** *).

***** *** **** ******** *** ** ********.** *******, ***** **** * ****** ** **** ***** ********** **** information. **** ****** ** *********** ** *** ****** *** ******* forwarded **** ** ***** ******* ** *** **** ****.

**** **** ***** ******* *** *** ** *********** ****** *****, bandwidth *********** ***** *****. ******** ***** ***** ******* *** ********** impact **** *** ****** *********** ***********, ***** ***** **** ********* may ****** *** ************ *******. ******* ** ****, ***** *** also **** ***** ******** ** *********** *********** ** ******* (***), ***** *********** ******* *******, ******* ***** ******* ***** ** file *********, *** *******, ** ***** ******* ** *** ********.

*** ******** *** ***************** *** ******* ***********.

Disabling ****** ****** *****

******* **** *** ********* ********** ****** ** ******* ************ ******* from ********* * ****** ** ** ******* *** ****** *****. This **** ********* *** **** ** ******* ****** ** ****** a ******** ****** ** ******** * ***** ***** **** * switch ** ****** ******* ****. *** ****** ** ******* ******** ports ** * ****** ****** ** ******* ********, **** *** cost *** **********:

***** ********* ** ********* *** ****** ** ********* ****** ******, this **** **** *** *********** ******* ************ ****** ** * network, ** ******* ***** *********** ****** * ****** (******, ***********, printer) **** * ********** ********** **** ** **** *** ****** its ****, ****** ******** **** ** *** ********* ** ***.** are ** *****.

Disabling ****** ******* *****

**** ******* **** **** ******** ******* ***** ****** **, **** as ******, ***, ***, ***., ** ** ***** ** ********** ** ******* ****. ***** ***** *** ******** ******* ** ******* (** *********** by ******* ****** *** ****** *************** ***** *********** *******).

* ***** ** ****** **** ** * ******* ** ****** reveals ******** **** ***** ***** **** ***** ******** *** *** access *** ***** ********* (**/***):

***** ***** ****** ** ******** ******** ******** ** ******* ********* attacks.

Disabling ****** ********

*********** ******** ** ******* ************ *** ******* ****** ** ****** off. ***** *** ******* ************-******** ****** *********, ******* ********* ****** services, *** ********, ***. ***** ******** ******** *** *** ** a ******** *** ******* ** *******, ******* ********** ********* *** memory, *** ******** ******* ****.

***** ******** ****** ** ******** ** *** ** ******* **** when ******** *******, ** **** **** ** *******:

OS *** ******** *******

** *********** ********** * ****** ** **** ******, **** **** ***** ********** ***** ********* ******* ******, *** example, ***** ****** ****** **** ***** ******* *** ***** *** software ** ****** ************.

*******, ***** ******* (********** ******* ******) ***** ******* ******* ** newly ********** ******** ***************, **** ** ************* *** *************, ***** ******** ******** ** ********* *********. ******* *** ***** significant ****** ****** ** *********.

*****, **** *******, ******* *** ** ********. ***** ********** ********* about ************* ****** ****** ******* ***** ******/********/*** ************* ** *** their *************** *** ******** ******* ** ***.

MAC ******* *********

*** ******* ********* ****** **** * ******** **** ** ******* to ******* ** *** ******. ***** ******* ******* **** *** switch *** *******, **** ** *** **** ********** *** **** by * ***** ******. *** ********* ** ******** **** ***** managed ********.

** ************ ********, *** ********* ** ********* **** ** **********. Once *** *******, *******, *** ******* *** *********, ** ** enabled, *** ********* *******' **** ***** ** *** *********. ***** these ******* ** * ************ ******* *** ****** ******* ***, little ***** *********** ** ********. ** ***** ******** ***** ******* may ********** ** ***** ** *******, ************** *** **** ********* more ********** ** **********.

**** ***** ***** *** ********* ******* ** * ******* ******* switch *********:

*** ********** ********** *** ***** ************ ******** **** ********** *** * ***** ******** ** *** *********.

***.**

***.** ******** ******* ****** ** ******* ** *** ******* ** have ****** *********** ** ** ******* **. **** ****** ****** devices ** ********* **** **** ******* ** * *******.

***** ***.**, * "**********" (****** **** * ******, **, ***.) attempts ** ******* ** ******* *** * ****** ** *** (called *** "*************"). *** ************* **** ****** *** *********** ** the ********** **** * ******, **** *** ************** ****** (********* using * ******** ************, *** ****** ** ****** ****** ***********.

***** ***.** ******** ****** ********, ******* ** * ******* ** support ** *** ** ********** *** ********. *** **** **** connected ******* (*******, ****, ****** ***, ****, ***.) ******* ***.** integration, *** ******** ****, ** ****. **** ** ***** ******* must ** ************ ********** *** ***.**, ****** ********** ************* **** to *** *******.

******* ** ***** *******, ***** ******** **** *** ************** ********, 802.1X ** ****** **** ** *** *** *** **** ******* enterprise ************ ********, **** ***** ****** *** ******* ******** ******** instead.

Locking *****

******* ***** ** ******** **** ********** ******** ********** ** ********* with ******* ******* ** ************ ******* *** **** ***** *** cable *****. ***** ******* ************ **** * ***** **** * switch, ***** *****, ** **** ****, ** **** ****** ****** ports, *** *** **** ** ******* **** * *********** ****.

locking plugs

***** ***** ***** ** ***** *** ********* ** ******** ****** tampering, **** *** *** ********** ** **************, *** * ********** intruder *** ****** ** **** ** ***** **** *** ** pry **** ***** ***** ****** ****. ** ****, ******* ***** should ** ********** **** ** * **** ******* ******** *******, but *** *** **** *******.

*** * ****** ****, **** ********** **** ******* *****************.

Door ***** *** ******** ******

*******, **** ********* **** *** *********** ****** ** *** **** vulnerable ***** ** * *******, *** *****, *******, ** ***** where ************ ******* *** ******** *** ********* *******. ** ******** the ********* ************ ** ***** *****, **** ***** **** ********** or **** *********** ******* *** ** *******. ** ***** ****** be *******, ********** **** ***** ** ****** ********** ****** **. Most ****** ** ********* ******** ******** ********* ** ******** *******:

it rack lock

** * ******, **** ********** ****** ********** ****** ******* ** server ** ******* ********* *****. *******, **** ***-****** ********** **** and ***** *** ** * ***** *** ** ********** ********* areas **** ******** *******.

Managing ************* *** ***** ************ *******

***** *** *** ***** ***** *** ******* ******** ** ***** own, **** *** **** ********* **** ********** ** **** ** a ******* (*** ********) ******** ******.

** ************, **** ****** ** ** ** *** ********** *******, but *******,** ** ***** **** *** ** *** ******:

  • *** ****:**** *** ************ ******* ** **** ** * ****** *********/********** LAN (******* ******* ******** ** *********), *** ***** **** ****** control *** ******** ****** *** *** ******* *******, *** *** force ***** ************ **** *********** (*** ****** ** *****).
  • **********:** ** *** **** **** *** **** * ******** ****** in *****, *** ********** ********** *** ****** ** ****** *** as **** ** ***** *************, ********* ** ** ** ******** in ***** *** *** ******** ** ** ******** *** ***** liability ** **** ** * ******.

Test **** *********

**** ****** ******** *******.

[****: **** ***** *** ********** ********* ** **** *** ************* updated ** **** **** ********** ******* *******/************* ***********, ********* ******, image ********, *** ****]

Comments (9)

********* ********. ***** ***.

******* ******** ********* ***** ** ****** *****, **** ***** *** Hanwha ***** **** *** **** ***** *** ******* ******** ********* guide. ***** ******* ****** ******* ***** *** *** *** ***********.

** - ***** ***, **** *** **** *******.

(********* ******** *******)

*** ******* ********* **** ***** **** **'* **** ****.

********* **** ****** ***** ********* ***** *** **** *** ** their ***** ******** *** **** - ****** *** "********* *****" at ***** ******* ****** ** *****://*******.************.***

***.** **** *** ******* ***: *****://***.**/*******

**** ** *** * *** ***** ** ****. **** **** done. ** *** ***** ***** **** **** ** * ************* for ****** ******* *****? **'** ******** ******* * *** ** these ****** **** *** ******** **************.

***** *****:

** *** *** ******* ** ***** ** ****** ***** ** all, *** ********* *** ** *** ********.

*******, *** **** **** ** **** **** ** *** *************** here ***** ** ** ****** ** ****. ********* ****** ****** ports, ******* *********/ ***/ ***, ***** *****, *** ***** ****** (***-*******!) ********* ** **** practice *** ****** ***.

*********, ******!

* ** ********* ** *** **** *** ******* ***** ** by ******* **** ** ***-******** *******.

***..**** *****..

* *** ** ****** ***********, ***** *** ******* **** ********, guys.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Backup Power For Maglocks Guide on Aug 20, 2018
When the main power fails, many believe maglocks must leave doors unlocked. However, battery backed up maglocks are allowed according to IBC /...
Video Analytics Integration Guide on Aug 16, 2018
Video analytics is hot again (at least conceptually) but integrating video analytics with VMSes can be challenging. This is especially significant...
ISS VMS / Video Analytics Company Profile on Aug 16, 2018
Who is ISS? In the past few months, they had one of the craziest ISC West promo items in years. Then, they hired industry veteran and ex-Dahua...
Backboxes for Video Surveillance Tutorial on Aug 15, 2018
Backboxes are a necessity in surveillance, whether for managing cable whips, recessing cameras, adding wireless radios. But it can be confusing to...
Ban of Dahua and Hikvision Is Now US Gov Law on Aug 13, 2018
The US President has signed the 2019 NDAA into law, banning the use of Dahua and Hikvision (and their OEMs) for the US government, for US...
Cut Milestone Licensing Costs 80% By Using Hikvision and Dahua NVRs (Tested) on Aug 13, 2018
Enterprise VMS licensing can be quite expensive, with $200 or more per channel common, meaning a 100 camera system can cost $20,000 in VMS...
Uniview Intrusion Analytics and VMD Tested on Aug 13, 2018
IPVM's IP Camera Analytics Shootout featuring Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision created some ill will with a Uniview distributor who...
Camera Focusing Tutorial on Aug 09, 2018
A camera's focus is fundamental to quality imaging. Mistakes can cause important problems. In this guide, we explain focus issues and proper...
Hikvision PanoVu Mini Tested (Multi-imager + PTZ For ~$500) on Aug 07, 2018
Hikvision has released their first PanoVu Mini multi imager, the PanoVu DS-2PT3326IZ-DE3, with four 1080p imagers, including a PTZ and integrated...
Bluebox Video UK Startup Profile on Aug 06, 2018
One UK startup, Bluebox Video has designed, developed and is manufacturing their own streaming video wall appliances. To the right is a picture of...

Most Recent Industry Reports

Backup Power For Maglocks Guide on Aug 20, 2018
When the main power fails, many believe maglocks must leave doors unlocked. However, battery backed up maglocks are allowed according to IBC /...
Axis Strong Q2 2018 Results on Aug 20, 2018
Axis reported strong Q2 2018 financial results and, for the first time in many years, Axis grew faster than Hikvision. However, the company's...
2Gig Gun Lock / Motion Detector Tested on Aug 17, 2018
Safer guns for families and an opportunity for security dealers to sell more services? That is the aim of Nortek's 2GIG 'Gun Motion Detector'...
Video Analytics Integration Guide on Aug 16, 2018
Video analytics is hot again (at least conceptually) but integrating video analytics with VMSes can be challenging. This is especially significant...
Hikvision IP Camera Critical Vulnerability 2018 Disclosed on Aug 16, 2018
The same day that the US government passed a prohibition on Hikvision cameras, Hikvision disclosed a critical vulnerability for its IP...
ISS VMS / Video Analytics Company Profile on Aug 16, 2018
Who is ISS? In the past few months, they had one of the craziest ISC West promo items in years. Then, they hired industry veteran and ex-Dahua...
Chinese OEM Avycon Gets ADI Push on Aug 15, 2018
Who is Avycon? An American company? A Korean company? A couple of guys relabelling Chinese products? The latter is the best explanation. While...
Backboxes for Video Surveillance Tutorial on Aug 15, 2018
Backboxes are a necessity in surveillance, whether for managing cable whips, recessing cameras, adding wireless radios. But it can be confusing to...
Genetec Stratocast / Comcast 'Motion Insights' Examined on Aug 15, 2018
Comcast recently announced "SmartOffice Motion Insights", an extension to their Genetec OEMed cloud video service (covered by IPVM here). This...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact