Genetec UL Cybersecurity Certificate (2900-2-3) Examined

By: Dan Gelinas, Published on Dec 19, 2018

Proving a company is cybersecure has become a major concern for security companies. But how trustworthy are these certificates?

Earlier in 2018, a false Hikvision cybersecurity certification announcement caused controversy. And Genetec itself has cast aspersions against its Chinese rivals as being untrustworthy.

Now, Genetec has announced achieving UL's 2900-2-3 [link no longer available] Level 3 (L3) certification that Genetec claims "validates its resilience against cyber-attack."

genetec ul 3

However, does it really? What does it consist of? How much validation does it provide?

In this note, based on our discussions with Genetec, JCI, and UL we examine:

UL Overview
Cybersecurity certification process
Process for Genetec
Cost
Highest of 3 levels
Testing performed
UL's process
Others certificated

Executive *******

***** ** ************* *** guarantee * ******* ** 'invulnerable' *** '******** ****', the **** **** **** UL ************* ******** *********** source **** ******* ******** a ************* ****** ********** level **** ******* ************* certifications.

*******, ** ** ****** expensive *** ****-********* ** many ************* *** *** find ** ***** *****.

** ****, **** * video ************ ************* **** done ** (******* *** Tyco *** *********) ***** are **** *** *********. We ** *** **** how **** **** ***** work ** *** *** camera ************* **** ******** models.

UL ********

***** **** ****** *** 124 ******** ** ****** ****** as * ****** ** developing ********* *** ******* products ** **** **** they ******* ****** *** as ********. *******, ************ those ********* **** **** around ********** *** ********** elements, *** *************.

**’* ************* ********* ******* (UL ***),******** ** ****, ***** **-******* ******** against ******** **** ***** **** ****** ** cybersecurity *********. *** **** ****** ****** cybersecurity ** ********* ****** and *** ********* ********* including ***** ************ (****-*), healthcare ******* (****-*-*), *** industrial ******* ******* (****-*-*). UL ****-*-* ** **'* attempt ** "******* *****" for *** ********* ** security *********.

Cybersecurity ************* *******

**********, *** ************* ******** of ******* ** *** product's ****** ********* '********** penetration *******', '****** **** analysis', *** '****** *** bytecode ********', ** *** excerpts **** ***** '******* of *************' ***** *****:

Process *** *******

**** ***** **** ******* Lead ******** *********, ******* Chevalier [**** ** ****** available] ***** *** *******, what ** ******** *** what ** ***** *** Genetec's *********.

*******'* ********* **** *** process, ***** **** ****** 8 ******, *** *** easy, comparing ** ** "***** on *****." ** **** the ******* **** *** attention ** *** ****** cybersecurity **** ** *:

** *** * ******* process. *** ** ** trial *** **** ****** evidence *** **** **** that ********** ** **** for *** ***** *** then **** ********* ** in ***** ** *** people **** **. *** findings *** ******** ** that ****. ** *** a *** ** ********* information *** ****** **** everything *** ** ** should **. ** ******* lots ** **** *** my ***** ***** ****—** 5 ******.

***********, ********* **** **** UL ***** ********* ***************, they ********* *** ************ to Genetec for ******** *********** ** repair:

***** *** * ** employee *** *** *** advocate *** *** ******** to *** ****. ** presented **** ** ***** to ** *** ** needed ** ****** *** it ** ******* *** it ** **** ** is.

********* **** **** *** *** up ****** ** ****** some ******, ********* *********** in ******* ********* ******* operational **********:

**** **** ********* *** procedure, ** * *** to ********* ** ******* a ********* **** ** already ***, *** ****'* have ** ******* ****. They ****** *** *************. So: '**** *** **** vulnerabilities, *** *** *** going ** ******** **** and *** ****?'

********* ******* *** ******* helped ******* *******, ****** the *********** ** ********* and *** ********* ** new *****:

** ********** *** ****** exam **** ** **** using ****’* ******** **** problems. ********* ***** *** stronger ** ****** ** different ******. ** *** tried ***** ****—******************—******, *** **** *** improved **.

********* **** ****** *********** testing ****'* ****** *** that *** ** ************* means ******* **** ********** accountable:

**** **** *********** *******, you ***’* **** ** fix ********. **** **, we **** ** *** whatever ******** **** **** or ** ***’* *** the *************.

Cost *** *************

******* **** *** ***** certification ******* **** **** $50,000 ** *****, **** notable ********* ***** ** maintain ********** ** ** guidelines. ********* **** ***** that *** ************* ******* only ******* *** ******* version, ** **** ******* was ***** ** **** on ** ***** **** version—they *** ********* ********* version 6—they **** **** ** redo *** ************* ******* all **** *****.

Highest ** * ******

******* ******** *** ******* of *** * ******, which ******** ********** **** levels * *** * as **** ** ** assessment ** ******** ************ of *** ******* **** knowledge ** ******** ******** controls *** ** ******** practices ** ******* *** lifecycle ** *** *******, as *** ********* ******* from **'* ******* ** Investigation *** *** *************:

Testing *********

******* ******** **** **** documentation ********* ******** *********** analysis ** *** ****, explaining:

**** ********* **** *** software *** *** ** determine ** ******** **** source ********** *** ****. If **** *** **** then ** ***** ** determine *** ******* *** then ***** ** *** if **** ******* *** known ***************.

*****, ** ***** *************** of ***** ******* *** previously *******:

*** ******** ****—***** ****—** *** **** ****** used ** *** ********. Their **** ** *** I **** ***** ***** of *****************. ** ***** ****** that ***** **** ****’* flag. *** ************ ******** of ****** ***** **** false ******** *** * small ****** **** **** positive.

*** ***** ** *** scan ** ********* ** reflected ** *** ******* graphic *****:

**** **'* ***** ********** potential ***************, *** ******* was ******* ** *******'* attention *** **** **** given * ****** ** respond, ** ** **** redacted *******:

Others ************

*** *** ******** ** ******* *** UL ****-*-* ****** **** **** ***** VideoEdge ******** **** ******** Dynamics.

*** **** *** ******* process *** ****-*-* ** was ********:

***** **** ** ******* UL2900-2-3 ***** * ** was * ******** ****** of *******, ******* *** policies. *** ******* **** of *** ******** ** all *** **** ****** to ** ********.

***********, *** **** **** the ************* ******** ** assurance ** ********* **** a ************ ******* *** doing ***** **** ** secure *** **** ********* could ***** **** *** their ********:

**’* ** *********. ** assures **** *** ************ is ***** ***** **** to **** **** ******** are ********* ************ *** mitigates *****. ** *** industry, ** ****** * level ******* ***** *** end ***** *** ******* designers, *** *** *** trust **** * ** CAP ********* ******* ***** the ************ ** ****** cybersecurity *********. ***** ***** cybersecurity ************** *** *********, the ** ****-*-* ********** standard ** ******** ** electronic ******** ******** ********.

*** *** ******* *** currently *** **** ******** companies ** ** ******* 2900-2-3

***** ******** * ***** ****** (outside *** ******** ********) that have **** **** ****** certificated (*** **** ** ** logged **** ** ******* IQ ** *** *** list ** **** ****** certificated *********) ** **** level ***** **** ****-*-*.

Vote / ****

Comments (14)

Dan Gelinas

IPVM | 12/19/18 08:26pm

****** ****: **** ***** has **** ******* ** include *** ********* ***** from ***, ***** *** the ***** ************ ** achieve *** ******-*-* ** listing.

*** **** *** ******* process *** ****-*-* ** was ********:

***** **** ** ******* UL2900-2-3 ***** * ** was * ******** ****** of *******, ******* *** policies. *** ******* **** of *** ******** ** all *** **** ****** to ** ********.

***********, *** **** **** the ************* ******** ** assurance ** ********* **** a ************ ******* *** doing ***** **** ** secure *** **** ********* could ***** **** *** their ********:

**’* ** *********. ** assures **** *** ************ is ***** ***** **** to **** **** ******** are ********* ************ *** mitigates *****. ** *** industry, ** ****** * level ******* ***** *** end ***** *** ******* designers, *** *** *** trust **** * ** CAP ********* ******* ***** the ************ ** ****** cybersecurity *********. ***** ***** cybersecurity ************** *** *********, the ** ****-*-* ********** standard ** ******** ** electronic ******** ******** ********.

Undisclosed #1

12/19/18 11:18pm

* ***** ** ** a **** *****, **** at ***** ******* ** trying ** ********* * baseline *************** *** ********* for ********** * *******/******** from *** ** **********. However ***** ** ** pre ***** ******** **** will ***** ** ******* attack, ***** ******* ***** it ** ******, ***** and ********** *** *******. This ** **** ** only * ****** ***, once *** *** ** there ******* ** *** atmosphere ***** ***** ** no ******* ** * static *** **** *************, good ****. *** ***** sense ** ******** ** not ****** ** ******'* terms *** *** *** user/corporation ******* ** ***** up *** ***. **** cert ** * **** in *** ****** ******* if **** ***** *********** as ** ***** ******** is ********* ****** ** the ******* ****** **** love ** ***** ******* fail, **** **** **** another ***** ******. ** far ** ***, * just *******, ***** ** all ** ** ******* Suse, ******* **** ****, mongo, ****** *** ******. All *** ***** ******* know *** ** ******** *nix *******, * *** see *** *** ******** in *** **** ******* murmuring *** ****, ** we ***** **** ** can *** **** *************. Ezpz.

** * ******** **** pay **** ***, **** ipc *******, **** ** cert ***** *** ********** inform *** ********* **** year **** *** ****** they ***.

******** ** * ****** breathing ****** ***** *** white **** *** ****** and *** ***** **** are *******. **** ** what ***** ** ****.

***** *****, ***

Sean Nelson

Nelly's Security
12/20/18 02:48am

**** ** *****! ** hikvision ****** ****, ***** they ** ** ***** secure ** *******?

Daniel Tyrrell

In reply to Sean Nelson | 12/27/18 03:47pm

* **** **** **** people *** ***** **-****** to *** ** ** you **** * *****, but *********** ******** * believe *** ***** ** right.

** **** *** *** point ** **? ******* the ************* ******** ***** you ****** ** ** least ** **** ** the ****** ***'** *** the ********.

*** * ***'* ******* HIK ****** ***** ** through **** ****.

Sean Nelson

Nelly's Security
In reply to Daniel Tyrrell | 12/27/18 03:51pm

**** ******. ***** ** slap ** *** **** "ish". *** ***** **** it * ****:

- ********* ** **** as ***** ****** ** Genetec
- ******* ** **** as ***** ****** ** Hikvision (******** **** ******* Hikvision ** *** **** UL *********, *** **** also **** * **** show)

John Honovich

IPVM | In reply to Sean Nelson | 12/27/18 03:54pm

- ******* ** **** as ***** ****** ** Hikvision (******** **** ******* Hikvision ** *** **** UL *********, *** **** also **** * **** show)

**, ****, ***'** *** best!

***** ********* ********* **** to **** ***** ************* certificate, ****, *** **** do **. ** *****, this *** ***** **** some **** ** ****** product *******.

*** ** *************, ******, only ***** *** ****** flaws / ******, ** while **'* **** *** 'coding ******' ** ********* like ** ***, ** would ** **** ******** to **** *** ********** backdoors **** **** *** place *** ***** *****, the ******* **********.

**** ** *** ***** about * ************* *** being '**** ** ************* government *******'?

Sean Nelson

Nelly's Security
In reply to John Honovich | 12/27/18 04:04pm

****** **** *** ******** one ***** *** **** a ***-*****.

** ******* **** *** certification, **** *** *********, locked ****, *** **** knox ** ***** ********.

** ********* **** *** certification, **** ***** ******** theoretically **** ***** ****** back ***** *** ***** by ** *******, **** aim ** ***** *** rights ** ****** *** spy ** ****** ******* americans. *** ** ******* their ******* ******** ********* is ******** ***** ** spawn *** ******.

John Honovich

IPVM | In reply to Sean Nelson | 12/27/18 04:11pm

** ******* **** *** certification, **** *** *********, locked ****, *** **** knox ** ***** ********.

***, ** *** **** read *** ******* ** just **** **** ** troll *** **** ******* Hikvision?

******** ** **** **********, here ** **** ** said ***** *******'* *************:

***** ** ************* *** guarantee * ******* ** 'invulnerable' *** '******** ****', the **** **** **** UL ************* ******** *********** source **** ******* ******** a ************* ****** ********** level **** ******* ************* certifications.

**** ***** **** ** silly, ** ****:

** ********* **** *** certification, **** ***** ******** theoretically **** ***** ****** back ***** *** ***** by ** *******

** ****** *** **** not ***** *** ******** being **** **** ****. If ******* ****** ** put ** * ******** that ** ***** *** find, **** *****. ** ********* wanted ** *** ** a ******** **** ** could *** ****, **** could.

*** ********** ** - one ** * ******* Canadian ******* *** ******** democracy *** *** **** world *** *** ***** is ********** ** ** authoritarian ********** *** ************** conducts ************** *** **** concentration *****. *** ***** is **** ******** *******.

Sean Nelson

Nelly's Security
In reply to John Honovich | 12/27/18 04:19pm

******* ****** ** *** in * ******** **** UL ***** *** ****, they *****. ** ********* wanted ** *** ** a ******** **** ** could *** ****, **** could.

* ******* ***** **** you **** *****-******** ********, theoretically ********* *** ******* are *** **** ******** wise.

John Honovich

IPVM | In reply to Sean Nelson | 12/27/18 05:10pm

* ******* ***** **** you **** *****-******** ********, theoretically ********* *** ******* are *** **** ******** wise.

***, **** ** **** fine ********. *** *** record, **** ** ******* not ** ********.

***'* ** **** **********:

*'** ******* ********* ****** them ** **** *** in ******* ** ******* this ** *************. ** or **** **** ******* I **** ****** ****.
** ********* ***** **** certification, ** **** **** a ******** ******* ***** / ** ********* ** it ****** ** **** clear ***** ** ************* work.
** **** *** ********* the ********* / ******* problem *** ** **** certainly ** ******* ********** in ******** **** **** year's ******** **** *** happen *****.

Fabian Muyawa

LONTECH SYSTEMS
IPVMU Certified | 12/27/18 01:23pm

******* ** ****** ******* with ************* ** **** in ******* **** **** undergone ** ******* **** level. **** ** ***********.

Undisclosed Integrator #2

01/02/19 01:41pm

**** *** *********** *** even ** *********** **** thier ******** ******** ******* as **** ** **** thier ************ ** *** field *** ***** ** be ******** ** **** a ***** ** ********* cyber ******** ********* ** do ******** **** ******* customers...............nice ** *** ** bring ************* ** *** cyber ******** ********** ***********

Undisclosed Manufacturer #3

02/15/19 03:21pm

** **** ***** ** contact ** *** ************* ** ********... *** suggestions?

Dan Gelinas

IPVM | In reply to Undisclosed Manufacturer #3 | 02/15/19 03:43pm

*'** ******* *** ** my ******* ** ** and **** *** **** to *** ****, **#*.

Read this IPVM report for free.

This article is part of IPVM's 6,538 reports, 881 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.