Network Security for IP Video Surveillance Guide 2016

Author: Ethan Ace, Published on Feb 03, 2016

Keeping surveillance networks secure can be a daunting task, but there are several methods that can greatly reduce risk, especially when used in conjunction with each other.

In this guide, we look at several security techniques, both physical and logical, used to secure surveillance networks, including:

  • Network Hardening Guides
  • Passwords
  • LDAP / Active Directory Integration
  • VLANs
  • 802.1X Authentication
  • Disabling Switch Ports
  • Disabling Network Ports
  • Disabling Unused Services
  • MAC Address Filtering
  • Locking Plugs
  • Physical Access Control
  • Practical Issues - Hikvision, Foscam and More
  • Managing Network Security For Video Surveillance Systems

******* ************ ******** ****** *** ** * ******** ****, *** there *** ******* ******* **** *** ******* ****** ****, ********** when **** ** *********** **** **** *****.

** **** *****, ** **** ** ******* ******** **********, **** physical *** *******, **** ** ****** ************ ********, *********:

  • ******* ********* ******
  • *********
  • **** / ****** ********* ***********
  • *****
  • ***.** **************
  • ********* ****** *****
  • ********* ******* *****
  • ********* ****** ********
  • *** ******* *********
  • ******* *****
  • ******** ****** *******
  • ********* ****** - *********, ****** *** ****
  • ******** ******* ******** *** ***** ************ *******

[***************]

Network ********* ******

** *** ** ******** ** *****, ******* ********* ****** *** common, ********* *************** (** ** *******, *** ********* ********* *****) ** **** *** ******* **** ******. ****/**** ** ***** recommendations ***** ** ************ ********, ** ****, ********* *********** ******** and ***** *******, ******** *********, ********* *****, ***.

*******, **** *************** *** ** ***** *** ****** **** **** IP ***** *********** *** ******* **, ** **** ** ********* for * ***** ******. ******* ************** ******* **** ** ***.**, LDAP ***********, **** **********, ***., *** ****** *** ***** *** time/cost ** ********* *** **** *******, ***** *** ******* ****.

************ ********* ****** ****

****** **, ************ ******** ********* ****** *** ****. *** ** few, **** ******** ***** *** ***** ** ****, ********* **** practices *** ******** ***** ******* (*** *** ********:**** ************* ********* ***** ********). ***** *************** *** ******* **** ******** ******, ********* ** the ******** ************, ******* **** **** **** (*** ********** ***) to ****** ****** ********** ********, *** ******* ***** **** *********, such ** ****** *********, ******** ********, *** ********* ********* ******, through **** ******* *********, **** ** ***.** **************, **** **********, and ****** *******.

***** *** **** ***** ******** ************ ******** ** ***** *******, many ** *** *************** *** ****** ****** *** *************, *** fall ** **** **** ** ******** **** *********, *** *** practices ********* *****.

Strong *********

****** ********* *** *** **** ***** ******** *******, *** *************, ignored ** **** *****. **** ************ ******* *** ******** ** the ***** **** ******* ********* ** *** *********, ********* *******, switches, *********, *** **** (*** ***** ******* ******* ********* *********). ***** ** *** **** ** ****** *** ***** ** access ******* *** **** **** ** ****** *** ****** ** log **** ***'* ******* (***:****** ****** *** ******* ** *******).

** *** **** *****, *** ************ ******* *******, ****************, *******, *** *******, ****** ** ******* **** *** ******** with ****** *********, ********** ** * ****** ********. **** ******** access ** *** ******* ***** ****** ******** ********, ********* * more ******* ******** *** **** ******* *******.

**** ************* ******* ******** *** ******* ******** **** ********** *** the ***** **** (*** *********** ** *** ****, ***** *** ******* *** *********). ******, ** ************* ******* (*)***** **** ******** ******* ********* *********, ****** *** **** **** is ******* ******* ** ** ****.

LDAP/Active ********* ***********

***** ****/****** ********* ***********, *** *********** *** ******** ** ******* users ******* ** * ******* ****** (**** ****** ****** ****-**). Since ***** **** ******** ***** ********* ******** ******** *** ********** rules, **** *********** *** ******* ******** **** ***** *** ******** which ** *** **** ***** ************. **** ******* ************** ********, since ********** ******** ** *** ** ** ******* *** **********.

*********, **** *** ** ********** ** ******, ********** *******, ***** many ***** ************* ** *** **** ** **** ****** ***********. Some ***** ** ******* ******* ***** *** ********* ** ****** entities, ********** ********* *** ********* **********, *** *** **** ** these ************* *** ****** ** *** ** *** ***** ******* access *******.

**** / ****** ********* ***** ************* ** **** *** ** cameras, ***, ** ******** ** ***. ****** *********, ** * Microsoft ********, ** *** ********* ** ****** *** ** ******, which ********* *** ** *****. ********** ** ****** ******* ** ** **, *** ** *** *** ****** *** ********** ****** *****.

Firewalls/Remote ******

** ******* ************ ****** ******, **** ************ ******* *** *** connected ** *** ******** ** ***, ******* ** * ******* separate ***. **** ******* ****, *** *** **** ******* **** difficult, ** ******* ** ******** *** ********, ******* ****** **********, must ** ****** **** *** ** ***** *****.

***** ******* ***** *** ********* *** ********* ****** * ********, which ****** *******/******** ******* ** **** ******** ** ********* *** ports ***** **** **** **********. ***** ******* ** ********. ******** implemented, **** *** ******* *** **** ******** ** *******.

****** ****** *****

*** ******* ***** ******* ****** ******, ***** *** ******* *** require *** ** **** ***** ** ** ****. *******, **** open **** ******** * ******** *********** *** ** ********. ******* how **** *** ***** ****** ** *** ***. ***** ****** refer ** ************ ************* *** ***** ***** **** ** **** if ****** ****** ** ******** (*** *********** ** ****** *******), and ** **** **** ******** ** ********** ***** *** ** ***** ************ ********.

*************, **** ************* ***** *** "***** ****" ****** ******, ***** sets ** * ****** ****** *** ** ******** ********** ******* requiring **** *****, ******** *****. **** ******* *** ********* *** cloud *********** *** ****** ******, **** *********** *****,***** *** ***** ***, ********** *****. ************, **** ****** ******* ******** *** ******* **********, **** as *******, **********, *********, ***.

** ******* ***** ******* ** ********* ******* ****** *** ***** ********************.

*****

******* **** (********* ** *****)******* ******** ** ********** ******* **** ******** ******* ********. ** while ***** ********, **** ** ** ***** ************ ********* ** general ****** *** *******, *** ***** ** *** **** ******** switch, *** ********* ******** *** ******** *** ********* ** **** other, *** ***********.

*** *******, ** *** ***** *****, *** ****** *** *** on **** * *** *** ** ******* ** *** ****** PC ** * ******** ****, *** ***** * **** ** the *** (**** *)"***" ******* ** *** ** **** (**** 2).

***** *** **** ******** *** ** ********.** *******, ***** **** * ****** ** **** ***** ********** **** information. **** ****** ** *********** ** *** ****** *** ******* forwarded **** ** ***** ******* ** *** **** ****.

**** **** ***** ******* *** *** ** *********** ****** *****, bandwidth *********** ***** *****. ******** ***** ***** ******* *** ********** impact **** *** ****** *********** ***********, ***** ***** **** ********* may ****** *** ************ *******. ******* ** ****, ***** *** also **** ***** ******** ** *********** *********** ** ******* (***), ***** *********** ******* *******, ******* ***** ******* ***** ** file *********, *** *******, ** ***** ******* ** *** ********.

*** ******** *** ***************** *** ******* ***********.

Disabling ****** ****** *****

******* **** *** ********* ********** ****** ** ******* ************ ******* from ********* * ****** ** ** ******* *** ****** *****. This **** ********* *** **** ** ******* ****** ** ****** a ******** ****** ** ******** * ***** ***** **** * switch ** ****** ******* ****. *** ****** ** ******* ******** ports ** * ****** ****** ** ******* ********, **** *** cost *** **********:

***** ********* ** ********* *** ****** ** ********* ****** ******, this **** **** *** *********** ******* ************ ****** ** * network, ** ******* ***** *********** ****** * ****** (******, ***********, printer) **** * ********** ********** **** ** **** *** ****** its ****, ****** ******** **** ** *** ********* ** ***.** are ** *****.

Disabling ****** ******* *****

**** ******* **** **** ******** ******* ***** ****** **, **** as ******, ***, ***, ***., ** ** ***** ** ********** ** ******* ****. ***** ***** *** ******** ******* ** ******* (** *********** by ******* ****** *** ****** *************** ***** *********** *******).

* ***** ** ****** **** ** * ******* ** ****** reveals ******** **** ***** ***** **** ***** ******** *** *** access *** ***** ********* (**/***):

***** ***** ****** ** ******** ******** ******** ** ******* ********* attacks.

Disabling ****** ********

*********** ******** ** ******* ************ *** ******* ****** ** ****** off. ***** *** ******* ************-******** ****** *********, ******* ********* ****** services, *** ********, ***. ***** ******** ******** *** *** ** a ******** *** ******* ** *******, ******* ********** ********* *** memory, *** ******** ******* ****.

***** ******** ****** ** ******** ** *** ** ******* **** when ******** *******, ** **** **** ** *******:

OS *** ******** *******

** *********** ********** * ****** ** **** ******, **** **** ***** ********** ***** ********* ******* ******, *** example, ***** ****** ****** **** ***** ******* *** ***** *** software ** ****** ************.

*******, ***** ******* (********** ******* ******) ***** ******* ******* ** newly ********** ******** ***************, **** ** ************* *** *************, ***** ******** ******** ** ********* *********. ******* *** ***** significant ****** ****** ** *********.

*****, **** *******, ******* *** ** ********. ***** ********** ********* about ************* ****** ****** ******* ***** ******/********/*** ************* ** *** their *************** *** ******** ******* ** ***.

MAC ******* *********

*** ******* ********* ****** **** * ******** **** ** ******* to ******* ** *** ******. ***** ******* ******* **** *** switch *** *******, **** ** *** **** ********** *** **** by * ***** ******. *** ********* ** ******** **** ***** managed ********.

** ************ ********, *** ********* ** ********* **** ** **********. Once *** *******, *******, *** ******* *** *********, ** ** enabled, *** ********* *******' **** ***** ** *** *********. ***** these ******* ** * ************ ******* *** ****** ******* ***, little ***** *********** ** ********. ** ***** ******** ***** ******* may ********** ** ***** ** *******, ************* *** **** ********* more ********** ** **********.

**** ***** ***** *** ********* ******* ** * ******* ******* switch *********:

*** ********** ********** *** ***** ************ ******** **** ********** *** * ***** ******** ** *** *********.

***.**

***.** ******** ******* ****** ** ******* ** *** ******* ** have ****** *********** ** ** ******* **. **** ****** ****** devices ** ********* **** **** ******* ** * *******.

***** ***.**, * "**********" (****** **** * ******, **, ***.) attempts ** ******* ** ******* *** * ****** ** *** (called *** "*************"). *** ************* **** ****** *** *********** ** the ********** **** * ******, **** *** ************** ****** (********* using * ******** ************, *** ****** ** ****** ****** ***********.

***** ***.** ******** ****** ********, ******* ** * ******* ** support ** *** ** ********** *** ********. *** **** **** connected ******* (*******, ****, ****** ***, ****, ***.) ******* ***.** integration, *** ******** ****, ** ****. **** ** ***** ******* must ** ************ ********** *** ***.**, ****** ********** ************* **** to *** *******.

******* ** ***** *******, ***** ******** **** *** ************** ********, 802.1X ** ****** **** ** *** *** *** **** ******* enterprise ************ ********, **** ***** ****** *** ******* ******** ******** instead.

Locking *****

******* ***** ** ******** **** ********** ******** ********** ** ********* with ******* ******* ** ************ ******* *** **** ***** *** cable *****. ***** ******* ************ **** * ***** **** * switch, ***** *****, ** **** ****, ** **** ****** ****** ports, *** *** **** ** ******* **** * *********** ****.

***** ***** ***** ** ***** *** ********* ** ******** ****** tampering, **** *** *** ********** ** **************, *** * ********** intruder *** ****** ** **** ** ***** **** *** ** pry **** ***** ***** ****** ****. ** ****, ******* ***** should ** ********** **** ** * **** ******* ******** *******, but *** *** **** *******.

*** * ****** ****, **** ********** **** ******* *****************.

Door ***** *** ******** ******

*******, **** ********* **** *** *********** ****** ** *** **** vulnerable ***** ** * *******, *** *****, *******, ** ***** where ************ ******* *** ******** *** ********* *******. ** ******** the ********* ************ ** ***** *****, **** ***** **** ********** or **** *********** ******* *** ** *******. ** ***** ****** be *******, ********** **** ***** ** ****** ********** ****** **. Most ****** ** ********* ******** ******** ********* ** ******** *******:

** * ******, **** ********** ****** ********** ****** ******* ** server ** ******* ********* *****. *******, **** ***-****** ********** **** and ***** *** ** * ***** *** ** ********** ********* areas **** ******** *******.

Practical ****** - *********, ****** *** ****

**** **** ******* ******** ** ******** * ******* ******* ** society, ****** ****** ***** ************ **** ********* ** *** **** few *****. ********* *** **** ******* *** **** ******* ****** in *** ********, **** ******** ******** ********:********* ******* *** ******* ******** *******,*** ********* ******* *******,*** ********* ******* ******* *******, ******* ********* ** *****"**** *******" ***************.

*******, ********/*** ****** *** ******* ** ****** ** ****, **** as ************ ****** ******* ** **** ** ***** ** ***** *** homes, ** **** ***** ****** ****** *** ******* ** ******* (******).

***** ****** *** **** **** ********** ** *** ******* ** our ****** ******, *********** ********* *** ** **** **** ******** ***** ******** ** the *****, **** **** **** **% ** *********** ****** **** *** not **** ***** ***** ****** ** *** *****.

Managing ******* ******** *** ***** ************ *******

***** *** *** ***** ***** *** ******* ******** ** ***** own, **** *** **** ********* **** ********** ** **** ** a ******* (*** ********) ******** ******.

** ************, **** ****** ** ** ** *** ********** *******, but ********* ** ***** **** *** ** *** ******:

  • *** ****:**** *** ************ ******* ** **** ** * ****** *********/********** LAN (******* ******* ******** ** *********), *** ***** **** ****** control *** ******** ****** *** *** ******* *******, *** *** force ***** ************ **** *********** (*** ****** ** *****).
  • **********:** ** *** **** **** *** **** * ******** ****** in *****, *** ********** ********** *** ****** ** ****** *** as **** ** ***** *************, ********* ** ** ** ******** in ***** *** *** ******** ** ** ******** *** ***** liability ** **** ** * ******.

Test **** *********

**** ****** ******** *******.

Comments (15)

"** * ******, **** ********** ****** ********** ****** ******* ** server ** ******* ********* *****. *******, **** ***-****** ********** **** and ***** *** ** * ***** *** ** ********** ********* areas **** ******** *******."

** ****** *** ********* ** ****** ******* ** ********** ****** within *** ****** **** ** *** *** *****, ****, *** perhaps ***** ***** ** ***** *** ***!

*** ***** **** *********** ********* ******** **'* * *********** (**** the ******* ***** **** ** ****** ** **********).

*****, ***** ********. *'* *** **** *** *** ***'* ******* software ******** ******* ** *******/*******. **** *********, **'* ** **** that ***** ** **** ****** *** *******'* **** ************ **** the *** ****** ******* *** *** ******* **** ******* **** day ******* *************. ******** ***** ** ******* *** ****** ** security *******, **** *** **** *** ******* **** *** ************* to *** ****'** ******* ** ** ******* *****.

****, **'* **** ** * ***** *******, *** ******** ****** wants ** **** ***** ********** *** ******* ***** ******* **** that **** ** **** ****** *** *** ***** ** *** your ******, *****'* ******-*****.

*** *** ****? * *** ********* ** ******** ****** ** one **** ***** *****:

*** *** * ****** ** *** **** ** ***, *** psw * ****'* ****. ***** *** ** *** ****** ** reset **. **, * ****** ** *********** ** ** *******, told **** ****** ****** ** ***, *** ***** *** ** problem - **** **** ** *** ** *************!

** ***** ***, **** *** '****' ******* ************* ***, ***** every *** ** ********* (****, * *** ***** **** *** list *** *** **** :)).

*** ****'* ********* ** ********.

********.*** **** **** ***** ***** *** ** **** ******?! ********** in ** *****...

*******, ***:***** *** ********* ****** ******** ********.

*********, **** ******* **** *********. * ****** ******* ** *** password ** *** ***. ***** ** ** ********* ***** *** input *** ****** ****** *** *** ******* **** *** ** generates * ********. **** **** ********* **** ** *** ******** and ****** / ******* **** ******** ** ** ** *** same **** / ****** ******.

***** ***, *** ***********.

**,

******* (**** *********) ******** ** * ******* *********** ********.

* ** *** ********** **** **** ** *** ***. **** create * ****** *** *** **** ********** *** ******** ** the ******* ****. **** **** ***** **** ******* **** ***** this ******** ** **** *******.

** ****** **** *** * *** ***** *** *** ******** works *****. *** **** ******* ** **** ** **** ***** its **** ********* **** *** ******** ****** ******.

"*** **** ******* ** **** ** **** ***** *** **** expensive **** *** ******** ****** ******."

*****...

* ******** **** ***** ** ******** ****** **** ** ******** to ****** ******** ** *** ****** (******* ***** ******** **** are *** ****** ** *** ********* *** ***** *****). ** is **** ** * ******* ***********-****, *** ******* ****** *** ******** ** ***** ******** ******* about * ***** ***.

* ***'* **** *** ***** **** ********** **** *** *******, it **** ** ** * ****** ******** * ***.

***.** ** * *** ****. **'* *** ***********, ** ******** expensive ********, **'* ********** ** ********* **** ** *** **** a ***** ***** ******. ** ******** ******* ** **** ***, and ** **** ******* *** ***** **** *** ****** ** the ******, *** *** ** ***.

** ****** ** ***** ** ******* ** ************** ** **** subject, *'** ***** *** **** ** *********. :)

** ***** *** ************* '***-**-***' ******** *** *********?

** ******** **********, *** *** *** ************, * *****-***** ******** enforcement **** **** *** ******** **** ********** ** *** ******. This ******** ** ******* ** ******** ** ******* ** *** edge ** *** ******* ** *********** ******** *** ******* *********. Senstar’s ******** – ***** ******** ******** ****** – *** ************ designed ** *****-****** ******** ******** ********, ***** ***** ******* *** safe-city ************.

** *************:

  • ******* *** ********** ***** ******* *** ******** ** *** *******
  • ****** ****-**** ****** *** *** ******* ** ***** *** ******* to ******* ** ************ ****** ** *** *******
  • ******** ******** *** ******** *******, ** **** *****, ** **** sure **** **** *****, ****, *** ********** *******, **** ********** entities, ** *******
  • ******* ****** *** ****** *****-*******: *** ********, *** ******** ** poisoning, ** ******* ********, ********* *** ***** *********, ********-**** ******** manipulation *** ****** ** ********

*******, *** *************, ** ** ** ********** ******** **** ******** no ********** ******* ** ******* ** *** ************* ****** ** a ******** ****** . ***** ** *******://***.************.***/

**** ******* ******** ***** ******* ******** * **** *** ****** find **** ** ** *******.

**** **** ***** ******* *** *** ** *********** ****** *****, bandwidth *********** ***** *****. ******** ***** ***** ******* *** ********** impact **** *** ****** *********** ***********, ***** ***** **** ********* may ****** *** ************ *******.

**** ** ***-******** ********? ***-******** ******* **** *** ***** *** operate ** **** ********* ******* ********* **** *****.

*****, **** ******** **** ***** **** *** ***-********.

******, **** *** ***-********. **** * ***** ** **** ********* switch ********* ***** * ** **** *********.

** ****-**-****, *.*., * ****** ** * *** ****** ** the **** ******, ** ******** ** ** ** *****. *******, across ***** *****, ***** ***'** ********** ** *** ****** ** the ***, **** ******** ***** ** *****, *** *** (*** probably ****) ***** *** **********. **'** ******* *** ****.

**** * ***** *** ** *** ******* *********. **** **** indeed ******* **** ************** *** *** ******* *****, **'* *** fool ***** ******. *** *** ****** ****** *** *** ******* of **** ** ** ***** *** *** ** * ******* camera *** ******** ***** * **** **** ****

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Sony IP Camera Backdoor Uncovered on Dec 06, 2016
A backdoor has been uncovered in ~80 Sony IP camera models, attackers can remotely enable telnet on the camera, and then potentially login as root,...
Power Drill Selection Guide on Dec 06, 2016
Boring holes is a basic part of running cables for most security system projects. To do so, you will need to choose the right drills for various...
Milestone Favorability Results on Dec 06, 2016
In our second installment of manufacturer favorability results (first was Pelco), we turn to Milestone. 100+ integrators rated and explained what...
XiongMai Master Password List Emailed By Chinese Spammer on Dec 05, 2016
XiongMai created an international uproar as their devices drove massive botnet attacks of major Internet sites. After pledging to recall cameras...
Hikvision Cloud Security Vulnerability Uncovered on Dec 05, 2016
A security researcher uncovered a critical vulnerability in Hikvision's global cloud servers. This vulnerability allowed an attacker to remotely...
Door Operators Access Control Tutorial on Dec 05, 2016
Doors equipped with door operators, specialty devices that automate opening and closing, tend to be quite complex. The mechanisms needed to...
Pelco Favorability Results on Dec 02, 2016
This is the first in a series of studies of manufacturer favorability. 100+ integrators rated and explained their views of each manufacturer. We...
CODEC Guide 2016 on Nov 30, 2016
CODECs are core to surveillance, with names like H.264, H.265, and MJPEG commonly cited. How do they work? Why should you use them? What issues may...
Free Online NFPA, IBC, and ADA Codes and Standards on Nov 29, 2016
Finding applicable codes for security work can be a costly task, with printed books and pdf downloads costing hundreds or thousands. However, a...
Selecting Wood Drill Bits For Installers on Nov 29, 2016
Running cables through studs is common for roughing in residential and some older commercial installs. To do this, you will need to drill holes in...

Most Recent Industry Reports

Sony IP Camera Backdoor Uncovered on Dec 06, 2016
A backdoor has been uncovered in ~80 Sony IP camera models, attackers can remotely enable telnet on the camera, and then potentially login as root,...
Milestone Favorability Results on Dec 06, 2016
In our second installment of manufacturer favorability results (first was Pelco), we turn to Milestone. 100+ integrators rated and explained what...
XiongMai Master Password List Emailed By Chinese Spammer on Dec 05, 2016
XiongMai created an international uproar as their devices drove massive botnet attacks of major Internet sites. After pledging to recall cameras...
Hikvision Cloud Security Vulnerability Uncovered on Dec 05, 2016
A security researcher uncovered a critical vulnerability in Hikvision's global cloud servers. This vulnerability allowed an attacker to remotely...
Door Operators Access Control Tutorial on Dec 05, 2016
Doors equipped with door operators, specialty devices that automate opening and closing, tend to be quite complex. The mechanisms needed to...
Pelco Favorability Results on Dec 02, 2016
This is the first in a series of studies of manufacturer favorability. 100+ integrators rated and explained their views of each manufacturer. We...
Hikvision CEO Declares 'We Do Not Cut Rates" on Dec 02, 2016
Hikvision has led another press trip to China, and this time Hikvision's CEO is sharing insights into their competitive strategy, including...
Network Security Audit App (March Networks) Examined on Dec 01, 2016
Verifying one's video surveillance devices are locked down against common cybersecurity vulnerabilities is increasing important, as hacks using...
FLIR Acquires Drone Manufacturer For $134M on Dec 01, 2016
FLIR has acquired Prox Dynamics, a Norwegian maker of small military-grade drones, for $134M.  FLIR president Andy Teich provided additional...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact