Network Security for IP Video Surveillance Guide 2016

Author: Ethan Ace, Published on Feb 03, 2016

Keeping surveillance networks secure can be a daunting task, but there are several methods that can greatly reduce risk, especially when used in conjunction with each other.

In this guide, we look at several security techniques, both physical and logical, used to secure surveillance networks, including:

  • Network Hardening Guides
  • Passwords
  • LDAP / Active Directory Integration
  • VLANs
  • 802.1X Authentication
  • Disabling Switch Ports
  • Disabling Network Ports
  • Disabling Unused Services
  • MAC Address Filtering
  • Locking Plugs
  • Physical Access Control
  • Managing Network Security For Video Surveillance Systems

******* ************ ******** ****** *** ** * ******** ****, *** there *** ******* ******* **** *** ******* ****** ****, ********** when **** ** *********** **** **** *****.

** **** *****, ** **** ** ******* ******** **********, **** physical *** *******, **** ** ****** ************ ********, *********:

  • ******* ********* ******
  • *********
  • **** / ****** ********* ***********
  • *****
  • ***.** **************
  • ********* ****** *****
  • ********* ******* *****
  • ********* ****** ********
  • *** ******* *********
  • ******* *****
  • ******** ****** *******
  • ******** ******* ******** *** ***** ************ *******

[***************]

Network ******** ******** ** ****

**** **** ****, ** ****/** ******* ******** *** ****** * key *****, **** ********* ***************, *****, *** ******* ** *** rise.

** ******** *****, ********* **** *** *** *** *******, **** Hikvision *** **** ******* ****** (***:********* ******* *** ******* ******** *******,*** ********* ******* *******,*** ********* ******* ******* *******, ******* ********* ** *****"**** *******" ********).

*******, ** ****, ***** *************** (*** ***** *******) **** ******** in ***** ***** *************, *********:

*** *********** ** ***** ************ ************* *************** *** *********** **** *********** ** ***** *** ***** ******, ********* *** ones ** **** *****.

******* ** *** ******** ** ***** ********* *** ***** ********** frequency, ** ** ******** **** ***** ********** *** ****** ** cyber ******** *** ************ *******, *** *** ** ******* ******* simple ******* ** *** **** *****.

Network ********* ******

** *** ** ******** ** *****, ******* ********* ****** *** common, ********* *************** (** ** *******, *** ********* ********* *****) ** **** *** ******* **** ******. ****/**** ** ***** recommendations ***** ** ************ ********, ** ****, ********* *********** ******** and ***** *******, ******** *********, ********* *****, ***.

*******, **** *************** *** ** ***** *** ****** **** **** IP ***** *********** *** ******* **, ** **** ** ********* for * ***** ******. ******* ************** ******* **** ** ***.**, LDAP ***********, **** **********, ***., *** ****** *** ***** *** time/cost ** ********* *** **** *******, ***** *** ******* ****.

************ ********* ****** ****

****** **, ************ ******** ********* ****** *** ****, ******** * ******* ** *************** **** *************.

*** ***** *************** ** **** ** ***** ****** ****, *** most *** ******* **** ***** *** ******** ******, ********* ** the *********** ** *** ************.

*** **** *****, *** ********, ****** **** **** **** (*** production ***) ** ****** ****** ********** ********, *** ******* ***** best *********, **** ** ****** *********, ******** ********, *** ********* anonymous ******, ******* **** ******* *********, **** ** ***.** **************, SNMP **********, *** ****** *******.

***** *** ***** ****** *** ************-********, ********* ************ ********* ** the ****** ** ***, **** *************** *** ****** ****** *** manufacturers, *** **** ** **** **** ** ******** **** *********, and *** ********* ********* *****.

Strong *********

****** ********* *** *** **** ***** ******** *******, *** *************, ignored ** **** *****. **** ************ ******* *** ******** ** the ***** **** ******* ********* ** *** *********, ********* *******, switches, *********, *** **** (*** ***** ******* ******* ********* ****). ***** ** *** **** ** ****** *** ***** ** access ******* *** **** **** ** ****** *** ****** ** log **** ***'* ******* (***:****** ****** *** ******* ** *******).

** *** **** *****, *** ************ ******* *******, ****************, *******, *** *******, ****** ** ******* **** *** ******** with ****** *********, ********** ** * ****** ********. **** ******** access ** *** ******* ***** ****** ******** ********, ********* * more ******* ******** *** **** ******* *******.

**** ************* ******* ******** *** ******* ******** **** ********** *** the ***** **** (*** *********** ** *** ****, ***** *** ******* *** *********). ******, ** ************* ******* (*)***** **** ******** ******* ********* *********, ****** *** **** **** is ******* ******* ** ** ****.

LDAP/AD ***********

***** ****/****** ********* (**) ***********, *** *********** *** ******** ** network ***** ******* ** * ******* ****** (**** ****** ****** sign-on). ***** ***** **** ******** ***** ********* ******** ******** *** expiration *****, **** *********** *** ******* ******** **** ***** *** accounts ***** ** *** **** ***** ************. **** ******* ************** overhead, ***** ********** ******** ** *** ** ** ******* *** maintained.

*********, **** *** ** ********** ** ******, ********** *******, ***** many ***** ************* ** *** **** ** **** ****** ***********. Some ***** ** ******* ******* ***** *** ********* ** ****** entities, ********** ********* *** ********* **********, *** *** **** ** these ************* *** ****** ** *** ** *** ***** ******* access *******.

**** / ** ***** ************* ** **** *** ** *******, but, ** ******** ** ***. ***************, ** * ********* ********, is *** ********* ** ****** *** ** ******, ***** ********* run ** *****. ********** ** ****** ******* ** ** **, *** ** *** *** ****** *** ********** ****** *****.

Firewalls/Remote ******

** ******* ************ ****** ******, **** ************ ******* *** *** connected ** *** ******** ** ***, ******* ** * ******* separate ***. **** ******* ****, *** *** **** ******* **** difficult, ** ******* ** ******** *** ********, ******* ****** **********, must ** ****** **** *** ** ***** *****.

***** ******* ***** *** ********* *** ********* ****** * ********, which ****** *******/******** ******* ** **** ******** ** ********* *** ports ***** **** **** **********. ***** ******* ** ********. ******** implemented, **** *** ******* *** **** ******** ** *******.

****** ****** *****

*** ******* ***** ******* ****** ******, ***** *** ******* *** require *** ** **** ***** ** ** ****. *******, **** open **** ******** * ******** *********** *** ** ********. ******* how **** *** ***** ****** ** *** ***. ***** ****** refer ** ************ ************* *** ***** ***** **** ** **** if ****** ****** ** ******** (*** *********** ** ****** *******), and ** **** **** ******** ** ********** ***** *** ** ***** ************ ********.

***/***** ******

*************, **** ************* ***** *** "***** ****" ****** ******, ***** sets ** * ****** ****** *** ** ******** ********** ******* requiring **** *****, ******** *****. **** ******* *** ********* *** cloud *********** *** ****** ******, **** *********** *****,***** *** ***** ***, ********** *****. ************, **** ****** ******* ******** *** ******* **********, **** as *******, **********, *********, ***.

** ******* ***** ******* ** ********* ******* ****** *** ***** ********************.

*****

******* **** (********* ** *****)******* ******** ** ********** ******* **** ******** ******* ********. ** while ***** ********, **** ** ** ***** ************ ********* ** general ****** *** *******, *** ***** ** *** **** ******** switch, *** ********* ******** *** ******** *** ********* ** **** other, *** ***********.

*** *******, ** *** ***** *****, *** ****** *** *** on **** * *** *** ** ******* ** *** ****** PC ** * ******** ****, *** ***** * **** ** the *** (**** *)"***" ******* ** *** ** **** (**** 2).

***** *** **** ******** *** ** ********.** *******, ***** **** * ****** ** **** ***** ********** **** information. **** ****** ** *********** ** *** ****** *** ******* forwarded **** ** ***** ******* ** *** **** ****.

**** **** ***** ******* *** *** ** *********** ****** *****, bandwidth *********** ***** *****. ******** ***** ***** ******* *** ********** impact **** *** ****** *********** ***********, ***** ***** **** ********* may ****** *** ************ *******. ******* ** ****, ***** *** also **** ***** ******** ** *********** *********** ** ******* (***), ***** *********** ******* *******, ******* ***** ******* ***** ** file *********, *** *******, ** ***** ******* ** *** ********.

*** ******** *** ***************** *** ******* ***********.

Disabling ****** ****** *****

******* **** *** ********* ********** ****** ** ******* ************ ******* from ********* * ****** ** ** ******* *** ****** *****. This **** ********* *** **** ** ******* ****** ** ****** a ******** ****** ** ******** * ***** ***** **** * switch ** ****** ******* ****. *** ****** ** ******* ******** ports ** * ****** ****** ** ******* ********, **** *** cost *** **********:

***** ********* ** ********* *** ****** ** ********* ****** ******, this **** **** *** *********** ******* ************ ****** ** * network, ** ******* ***** *********** ****** * ****** (******, ***********, printer) **** * ********** ********** **** ** **** *** ****** its ****, ****** ******** **** ** *** ********* ** ***.** are ** *****.

Disabling ****** ******* *****

**** ******* **** **** ******** ******* ***** ****** **, **** as ******, ***, ***, ***., ** ** ***** ** ********** ** ******* ****. ***** ***** *** ******** ******* ** ******* (** *********** by ******* ****** *** ****** *************** ***** *********** *******).

* ***** ** ****** **** ** * ******* ** ****** reveals ******** **** ***** ***** **** ***** ******** *** *** access *** ***** ********* (**/***):

***** ***** ****** ** ******** ******** ******** ** ******* ********* attacks.

Disabling ****** ********

*********** ******** ** ******* ************ *** ******* ****** ** ****** off. ***** *** ******* ************-******** ****** *********, ******* ********* ****** services, *** ********, ***. ***** ******** ******** *** *** ** a ******** *** ******* ** *******, ******* ********** ********* *** memory, *** ******** ******* ****.

***** ******** ****** ** ******** ** *** ** ******* **** when ******** *******, ** **** **** ** *******:

OS *** ******** *******

** *********** ********** * ****** ** **** ******, **** **** ***** ********** ***** ********* ******* ******, *** example, ***** ****** ****** **** ***** ******* *** ***** *** software ** ****** ************.

*******, ***** ******* (********** ******* ******) ***** ******* ******* ** newly ********** ******** ***************, **** ** ************* *** *************, ***** ******** ******** ** ********* *********. ******* *** ***** significant ****** ****** ** *********.

*****, **** *******, ******* *** ** ********. ***** ********** ********* about ************* ****** ****** ******* ***** ******/********/*** ************* ** *** their *************** *** ******** ******* ** ***.

MAC ******* *********

*** ******* ********* ****** **** * ******** **** ** ******* to ******* ** *** ******. ***** ******* ******* **** *** switch *** *******, **** ** *** **** ********** *** **** by * ***** ******. *** ********* ** ******** **** ***** managed ********.

** ************ ********, *** ********* ** ********* **** ** **********. Once *** *******, *******, *** ******* *** *********, ** ** enabled, *** ********* *******' **** ***** ** *** *********. ***** these ******* ** * ************ ******* *** ****** ******* ***, little ***** *********** ** ********. ** ***** ******** ***** ******* may ********** ** ***** ** *******, ************** *** **** ********* more ********** ** **********.

**** ***** ***** *** ********* ******* ** * ******* ******* switch *********:

*** ********** ********** *** ***** ************ ******** **** ********** *** * ***** ******** ** *** *********.

***.**

***.** ******** ******* ****** ** ******* ** *** ******* ** have ****** *********** ** ** ******* **. **** ****** ****** devices ** ********* **** **** ******* ** * *******.

***** ***.**, * "**********" (****** **** * ******, **, ***.) attempts ** ******* ** ******* *** * ****** ** *** (called *** "*************"). *** ************* **** ****** *** *********** ** the ********** **** * ******, **** *** ************** ****** (********* using * ******** ************, *** ****** ** ****** ****** ***********.

***** ***.** ******** ****** ********, ******* ** * ******* ** support ** *** ** ********** *** ********. *** **** **** connected ******* (*******, ****, ****** ***, ****, ***.) ******* ***.** integration, *** ******** ****, ** ****. **** ** ***** ******* must ** ************ ********** *** ***.**, ****** ********** ************* **** to *** *******.

******* ** ***** *******, ***** ******** **** *** ************** ********, 802.1X ** ****** **** ** *** *** *** **** ******* enterprise ************ ********, **** ***** ****** *** ******* ******** ******** instead.

Locking *****

******* ***** ** ******** **** ********** ******** ********** ** ********* with ******* ******* ** ************ ******* *** **** ***** *** cable *****. ***** ******* ************ **** * ***** **** * switch, ***** *****, ** **** ****, ** **** ****** ****** ports, *** *** **** ** ******* **** * *********** ****.

***** ***** ***** ** ***** *** ********* ** ******** ****** tampering, **** *** *** ********** ** **************, *** * ********** intruder *** ****** ** **** ** ***** **** *** ** pry **** ***** ***** ****** ****. ** ****, ******* ***** should ** ********** **** ** * **** ******* ******** *******, but *** *** **** *******.

*** * ****** ****, **** ********** **** ******* *****************.

Door ***** *** ******** ******

*******, **** ********* **** *** *********** ****** ** *** **** vulnerable ***** ** * *******, *** *****, *******, ** ***** where ************ ******* *** ******** *** ********* *******. ** ******** the ********* ************ ** ***** *****, **** ***** **** ********** or **** *********** ******* *** ** *******. ** ***** ****** be *******, ********** **** ***** ** ****** ********** ****** **. Most ****** ** ********* ******** ******** ********* ** ******** *******:

** * ******, **** ********** ****** ********** ****** ******* ** server ** ******* ********* *****. *******, **** ***-****** ********** **** and ***** *** ** * ***** *** ** ********** ********* areas **** ******** *******.

Managing ******* ******** *** ***** ************ *******

***** *** *** ***** ***** *** ******* ******** ** ***** own, **** *** **** ********* **** ********** ** **** ** a ******* (*** ********) ******** ******.

** ************, **** ****** ** ** ** *** ********** *******, but ********* ** ***** **** *** ** *** ******:

  • *** ****:**** *** ************ ******* ** **** ** * ****** *********/********** LAN (******* ******* ******** ** *********), *** ***** **** ****** control *** ******** ****** *** *** ******* *******, *** *** force ***** ************ **** *********** (*** ****** ** *****).
  • **********:** ** *** **** **** *** **** * ******** ****** in *****, *** ********** ********** *** ****** ** ****** *** as **** ** ***** *************, ********* ** ** ** ******** in ***** *** *** ******** ** ** ******** *** ***** liability ** **** ** * ******.

Test **** *********

**** ****** ******** *******.

Comments (15)

"** * ******, **** ********** ****** ********** ****** ******* ** server ** ******* ********* *****. *******, **** ***-****** ********** **** and ***** *** ** * ***** *** ** ********** ********* areas **** ******** *******."

** ****** *** ********* ** ****** ******* ** ********** ****** within *** ****** **** ** *** *** *****, ****, *** perhaps ***** ***** ** ***** *** ***!

*** ***** **** *********** ********* ******** **'* * *********** (**** the ******* ***** **** ** ****** ** **********).

*****, ***** ********. *'* *** **** *** *** ***'* ******* software ******** ******* ** *******/*******. **** *********, **'* ** **** that ***** ** **** ****** *** *******'* **** ************ **** the *** ****** ******* *** *** ******* **** ******* **** day ******* *************. ******** ***** ** ******* *** ****** ** security *******, **** *** **** *** ******* **** *** ************* to *** ****'** ******* ** ** ******* *****.

****, **'* **** ** * ***** *******, *** ******** ****** wants ** **** ***** ********** *** ******* ***** ******* **** that **** ** **** ****** *** *** ***** ** *** your ******, *****'* ******-*****.

*** *** ****? * *** ********* ** ******** ****** ** one **** ***** *****:

*** *** * ****** ** *** **** ** ***, *** psw * ****'* ****. ***** *** ** *** ****** ** reset **. **, * ****** ** *********** ** ** *******, told **** ****** ****** ** ***, *** ***** *** ** problem - **** **** ** *** ** *************!

** ***** ***, **** *** '****' ******* ************* ***, ***** every *** ** ********* (****, * *** ***** **** *** list *** *** **** :)).

*** ****'* ********* ** ********.

********.*** **** **** ***** ***** *** ** **** ******?! ********** in ** *****...

*******, ***:***** *** ********* ****** ******** ********.

*********, **** ******* **** *********. * ****** ******* ** *** password ** *** ***. ***** ** ** ********* ***** *** input *** ****** ****** *** *** ******* **** *** ** generates * ********. **** **** ********* **** ** *** ******** and ****** / ******* **** ******** ** ** ** *** same **** / ****** ******.

***** ***, *** ***********.

**,

******* (**** *********) ******** ** * ******* *********** ********.

* ** *** ********** **** **** ** *** ***. **** create * ****** *** *** **** ********** *** ******** ** the ******* ****. **** **** ***** **** ******* **** ***** this ******** ** **** *******.

** ****** **** *** * *** ***** *** *** ******** works *****. *** **** ******* ** **** ** **** ***** its **** ********* **** *** ******** ****** ******.

"*** **** ******* ** **** ** **** ***** *** **** expensive **** *** ******** ****** ******."

*****...

* ******** **** ***** ** ******** ****** **** ** ******** to ****** ******** ** *** ****** (******* ***** ******** **** are *** ****** ** *** ********* *** ***** *****). ** is **** ** * ******* ***********-****, *** ******* ****** *** ******** ** ***** ******** ******* about * ***** ***.

* ***'* **** *** ***** **** ********** **** *** *******, it **** ** ** * ****** ******** * ***.

***.** ** * *** ****. **'* *** ***********, ** ******** expensive ********, **'* ********** ** ********* **** ** *** **** a ***** ***** ******. ** ******** ******* ** **** ***, and ** **** ******* *** ***** **** *** ****** ** the ******, *** *** ** ***.

** ****** ** ***** ** ******* ** ************** ** **** subject, *'** ***** *** **** ** *********. :)

** ***** *** ************* '***-**-***' ******** *** *********?

** ******** **********, *** *** *** ************, * *****-***** ******** enforcement **** **** *** ******** **** ********** ** *** ******. This ******** ** ******* ** ******** ** ******* ** *** edge ** *** ******* ** *********** ******** *** ******* *********. Senstar’s ******** – ***** ******** ******** ****** – *** ************ designed ** *****-****** ******** ******** ********, ***** ***** ******* *** safe-city ************.

** *************:

  • ******* *** ********** ***** ******* *** ******** ** *** *******
  • ****** ****-**** ****** *** *** ******* ** ***** *** ******* to ******* ** ************ ****** ** *** *******
  • ******** ******** *** ******** *******, ** **** *****, ** **** sure **** **** *****, ****, *** ********** *******, **** ********** entities, ** *******
  • ******* ****** *** ****** *****-*******: *** ********, *** ******** ** poisoning, ** ******* ********, ********* *** ***** *********, ********-**** ******** manipulation *** ****** ** ********

*******, *** *************, ** ** ** ********** ******** **** ******** no ********** ******* ** ******* ** *** ************* ****** ** a ******** ****** . ***** ** *******://***.************.***/

**** ******* ******** ***** ******* ******** * **** *** ****** find **** ** ** *******.

**** **** ***** ******* *** *** ** *********** ****** *****, bandwidth *********** ***** *****. ******** ***** ***** ******* *** ********** impact **** *** ****** *********** ***********, ***** ***** **** ********* may ****** *** ************ *******.

**** ** ***-******** ********? ***-******** ******* **** *** ***** *** operate ** **** ********* ******* ********* **** *****.

*****, **** ******** **** ***** **** *** ***-********.

******, **** *** ***-********. **** * ***** ** **** ********* switch ********* ***** * ** **** *********.

** ****-**-****, *.*., * ****** ** * *** ****** ** the **** ******, ** ******** ** ** ** *****. *******, across ***** *****, ***** ***'** ********** ** *** ****** ** the ***, **** ******** ***** ** *****, *** *** (*** probably ****) ***** *** **********. **'** ******* *** ****.

**** * ***** *** ** *** ******* *********. **** **** indeed ******* **** ************** *** *** ******* *****, **'* *** fool ***** ******. *** *** ****** ****** *** *** ******* of **** ** ** ***** *** *** ** * ******* camera *** ******** ***** * **** **** ****

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Chinese 'Attacking Us From Every Direction', Says US FBI on Apr 25, 2017
"Chinese eating our lunch. Attacking us from every direction" said the US FBI's Deputy Director Andrew McCabe at the ASIS 2017 CSO Summit. .@FBI...
IPVM First Dean's List W2017 - Thomas Atkinson, Matt Hurly and Fredrik Lundqvist on Apr 24, 2017
IPVM is happy to congratulate and celebrate our first "Dean's List", the top students in our courses. For the Winter 2017 IP Networking course...
Splicing Alarm Circuits Guide on Apr 23, 2017
Alarm installers commonly connect multiple sensors to a single zone. They do this by splicing the wires together. In this report, we will explain...
IP Networking Course May 2017 on Apr 21, 2017
NOTE: Registration ends this Thursday. This is the only networking course designed specifically for video surveillance professionals plus it...
PureTech Video Analytics Examined on Apr 21, 2017
PureTech's analytics were chosen for a US border protection system (see related post), which the company claims no other analytics vendor was able...
Lenel President Is Out on Apr 20, 2017
Lenel's challenges continue. Now, Lenel's President is out, suddenly. This follows increasing challenges for the company who has broadly upset...
Axis Network Horn Tested on Apr 18, 2017
We bought and tested the Axis network horn C3003-E, examining setup and calibration, event audio, VMS integration, and sound pressure levels...
Hikvision OEM Directory on Apr 17, 2017
Hikvision OEMs for dozens of companies around the world. The following directory includes 50+ companies that OEM some products from Hikvision, with...
Aqueti 100MP Mantis Camera Profile on Apr 14, 2017
One of the original gigapixel camera startups, Aqueti, which we first covered in 2012, is back. This time, they have partnered with NVIDIA,...
Access Control Course Spring 2017 on Apr 14, 2017
IPVM offers the most comprehensive access control course in the industry. Unlike manufacturer training that focuses only on a small part of the...

Most Recent Industry Reports

IPVM First Dean's List W2017 - Thomas Atkinson, Matt Hurly and Fredrik Lundqvist on Apr 24, 2017
IPVM is happy to congratulate and celebrate our first "Dean's List", the top students in our courses. For the Winter 2017 IP Networking course...
Axis Posts Strong Q1 2017 Financial Results on Apr 24, 2017
Axis posted strong numbers for Q1 2017, after having some challenges in 2016 (Q1 2016, Q3 2016). Inventory levels and overall spending show...
Axis Lowest Cost Outdoor IR Camera M2025-LE Tested on Apr 24, 2017
Axis has lagged offering low cost IR cameras while their Asian competitors have made IR standard even in their most entry level cameras. Recently,...
Splicing Alarm Circuits Guide on Apr 23, 2017
Alarm installers commonly connect multiple sensors to a single zone. They do this by splicing the wires together. In this report, we will explain...
IP Networking Course May 2017 on Apr 21, 2017
NOTE: Registration ends this Thursday. This is the only networking course designed specifically for video surveillance professionals plus it...
PureTech Video Analytics Examined on Apr 21, 2017
PureTech's analytics were chosen for a US border protection system (see related post), which the company claims no other analytics vendor was able...
US Border RVSS / Video Analytics System Examined on Apr 21, 2017
US Customs and Border Protection has been rolling out a video analytics-based detection system along the US/Mexico border, with detection ranges...
Beware The "Hit List" Ranking on Apr 21, 2017
The hit list. Kirschenbaum's recent newsletter complained about a 'hit list', bemoaning how a company took aim at ADT. Alas, that's the Google...
Ring Floodlight Cam Tested on Apr 20, 2017
Ring has released their latest entry, the Floodlight Cam, calling it the "Evolution of Outdoor Security", touting motion activated floodlights,...
Lenel President Is Out on Apr 20, 2017
Lenel's challenges continue. Now, Lenel's President is out, suddenly. This follows increasing challenges for the company who has broadly upset...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact