Genetec UL Cybersecurity Certificate (2900-2-3) Examined

By: Dan Gelinas, Published on Dec 19, 2018

Proving a company is cybersecure has become a major concern for security companies. But how trustworthy are these certificates?

Earlier in 2018, a false Hikvision cybersecurity certification announcement caused controversy. And Genetec itself has cast aspersions against its Chinese rivals as being untrustworthy.

Now, Genetec has announced achieving UL's 2900-2-3 Level 3 (L3) certification that Genetec claims "validates its resilience against cyber-attack."

genetec ul 3

However, does it really? What does it consist of? How much validation does it provide?

In this note, based on our discussions with Genetec, JCI, and UL we examine:

  • UL Overview
  • Cybersecurity certification process
  • Process for Genetec
  • Cost
  • Highest of 3 levels
  • Testing performed
  • UL's process
  • Others certificated

******* * ******* ** cybersecure *** ****** * major ******* *** ******** companies. *** *** *********** are ***** ************?

******* ** ****, ****** ********* ************* ************* announcement****** ***********. ********** ****** *** **** aspersions ******* *** ******* rivals** ***** *************.

***,******************* ***********'*****-*-****** * (**) ************* that ******* ****** "********* its ********** ******* *****-******."

genetec ul 3

*******, **** ** ******? What **** ** ******* of? *** **** ********** does ** *******?

** **** ****, ***** on *** *********** **** Genetec, ***, *** ** we *******:

  • ** ********
  • ************* ************* *******
  • ******* *** *******
  • ****
  • ******* ** * ******
  • ******* *********
  • **'* *******
  • ****** ************

[***************]

Executive *******

***** ** ************* *** guarantee * ******* ** 'invulnerable' *** '******** ****', the **** **** **** UL ************* ******** *********** source **** ******* ******** a ************* ****** ********** level **** ******* ************* certifications.

*******, ** ** ****** expensive *** ****-********* ** many ************* *** *** find ** ***** *****.

** ****, **** * video ************ ************* **** done ** (******* *** Tyco *** *********) ***** are **** *** *********. We ** *** **** how **** **** ***** work ** *** *** camera ************* **** ******** models.

UL ********

***** **** ****** *** 124 ******** ** ****** ****** as * ****** ** developing ********* *** ******* products ** **** **** they ******* ****** *** as ********. *******, ************ those ********* **** **** around ********** *** ********** elements, *** *************.

**’* ************* ********* ******* (UL ***),******** ** ****, ***** **-******* ******** against ******** **** ***** **** ****** ** cybersecurity *********. *** **** ****** covers ************* ** ********* levels *** *** ********* verticals ********* ***** ************ (2900-1), ********** ******* (****-*-*), and ********** ******* ******* (2900-2-2). ** ****-*-* ** UL's ******* ** "******* trust" *** *** ********* of ******** *********.

Cybersecurity ************* *******

**********, *** ************* ******** of ******* ** *** product's ****** ********* '********** penetration *******', '****** **** analysis', *** '****** *** bytecode ********', ** *** excerpts **** ***** '******* of *************' ***** *****:

Process *** *******

**** ***** **** ******* Lead ******** *********,******* ************** *** *******, **** it ******** *** **** it ***** *** *******'* customers.

*******'* ********* **** *** process, ***** **** ****** 8 ******, *** *** easy, ********* ** ** "going ** *****." ** said *** ******* **** the ********* ** *** entire ************* **** ** 5:

** *** * ******* process. *** ** ** trial *** **** ****** evidence *** **** **** that ********** ** **** for *** ***** *** then **** ********* ** in ***** ** *** people **** **. *** findings *** ******** ** that ****. ** *** a *** ** ********* information *** ****** **** everything *** ** ** should **. ** ******* lots ** **** *** my ***** ***** ****—** 5 ******.

***********, ********* **** **** UL ***** ********* ***************, they ********* *** ************ to ******* *** ******** explanation ** ******:

***** *** * ** employee *** *** *** advocate *** *** ******** to *** ****. ** presented **** ** ***** to ** *** ** needed ** ****** *** it ** ******* *** it ** **** ** is.

********* **** **** *** end ** ****** ** change **** ******, ********* formalizing ** ******* ********* Genetec *********** **********:

**** **** ********* *** procedure, ** * *** to ********* ** ******* a ********* **** ** already ***, *** ****'* have ** ******* ****. They ****** *** *************. So: '**** *** **** vulnerabilities, *** *** *** going ** ******** **** and *** ****?'

********* ******* *** ******* helped ******* *******, ****** the *********** ** ********* and *** ********* ** new *****:

** ********** *** ****** exam **** ** **** using ****’* ******** **** problems. ********* ***** *** stronger ** ****** ** different ******. ** *** tried ***** ****—******************—******, *** **** *** improved **.

********* **** ****** *********** testing ****'* ****** *** that *** ** ************* means ******* **** ********** accountable:

**** **** *********** *******, you ***’* **** ** fix ********. **** **, we **** ** *** whatever ******** **** **** or ** ***’* *** the *************.

Cost *** *************

******* **** *** ***** certification ******* **** **** $50,000 ** *****, **** notable ********* ***** ** maintain ********** ** ** guidelines. ********* **** ***** that *** ************* ******* only ******* *** ******* version, ** **** ******* was ***** ** **** on ** ***** **** version—they *** ********* ********* version *—**** **** **** to **** *** ************* process *** **** *****.

Highest ** * ******

******* ******** *** ******* of *** * ******, which ******** ********** **** levels * *** * as **** ** ** assessment ** ******** ************ of *** ******* **** knowledge ** ******** ******** controls *** ** ******** practices ** ******* *** lifecycle ** *** *******, as *** ********* ******* from **'* ******* ** Investigation *** *** *************:

Testing *********

******* ******** **** **** documentation ********* ******** *********** analysis ** *** ****, explaining:

**** ********* **** *** software *** *** ** determine ** ******** **** source ********** *** ****. If **** *** **** then ** ***** ** determine *** ******* *** then ***** ** *** if **** ******* *** known ***************.

*****, ** ***** *************** of ***** ******* *** previously *******:

*** ******** ****—***** ****—** *** **** ****** used ** *** ********. Their **** ** *** I **** ***** ***** of *****************. ** ***** ****** that ***** **** ****’* flag. *** ************ ******** of ****** ***** **** false ******** *** * small ****** **** **** positive.

*** ***** ** *** scan ** ********* ** reflected ** *** ******* graphic *****:

**** **'* ***** ********** potential ***************, *** ******* was ******* ** *******'* attention *** **** **** given * ****** ** respond, ** ** **** redacted *******:

Others ************

*** *** ******** ** ******* *** UL ****-*-* ****** **** **** ***** VideoEdge ******** **** ******** Dynamics.

*** **** *** ******* process *** ****-*-* ** was ********:

***** **** ** ******* UL2900-2-3 ***** * ** was * ******** ****** of *******, ******* *** policies. *** ******* **** of *** ******** ** all *** **** ****** to ** ********.

***********, *** **** **** the ************* ******** ** assurance ** ********* **** a ************ ******* *** doing ***** **** ** secure *** **** ********* could ***** **** *** their ********:

**’* ** *********. ** assures **** *** ************ is ***** ***** **** to **** **** ******** are ********* ************ *** mitigates *****. ** *** industry, ** ****** * level ******* ***** *** end ***** *** ******* designers, *** *** *** trust **** * ** CAP ********* ******* ***** the ************ ** ****** cybersecurity *********. ***** ***** cybersecurity ************** *** *********, the ** ****-*-* ********** standard ** ******** ** electronic ******** ******** ********.

*** *** ******* *** currently *** **** ******** companies ** ** ******* 2900-2-3

***** ******** * ***** ****** (outside *** ******** ********) that **** **** **** series ************(*** **** ** ** logged **** ** ******* IQ ** *** *** list ** **** ****** certificated *********) ** **** level ***** **** ****-*-*.

Vote / ****

Comments (14)

Avatar

Dan Gelinas

IPVM | 12/19/18 08:26pm

****** ****: **** ***** *** **** ******* ** ******* *** followint ***** **** ***, ***** *** *** ***** ************ ** achieve *** ******-*-* ** *******.

*** **** *** ******* ******* *** ****-*-* ** *** ********:

***** **** ** ******* ******-*-* ***** * ** *** * thorough ****** ** *******, ******* *** ********. *** ******* **** of *** ******** ** *** *** **** ****** ** ** prepared.

***********, *** **** **** *** ************* ******** ** ********* ** customers **** * ************ ******* *** ***** ***** **** ** secure *** **** ********* ***** ***** **** *** ***** ********:

**’* ** *********. ** ******* **** *** ************ ** ***** their **** ** **** **** ******** *** ********* ************ *** mitigates *****. ** *** ********, ** ****** * ***** ******* field *** *** ***** *** ******* *********, *** *** *** trust **** * ** *** ********* ******* ***** *** ************ of ****** ************* *********. ***** ***** ************* ************** *** *********, the ** ****-*-* ********** ******** ** ******** ** ********** ******** security ********.

Undisclosed #1

12/19/18 11:18pm

* ***** ** ** * **** *****, **** ** ***** someone ** ****** ** ********* * ******** *************** *** ********* for ********** * *******/******** **** *** ** **********. ******* ***** is ** *** ***** ******** **** **** ***** ** ******* attack, ***** ******* ***** ** ** ******, ***** *** ********** not *******. **** ** **** ** **** * ****** ***, once *** *** ** ***** ******* ** *** ********** ***** there ** ** ******* ** * ****** *** **** *************, good ****. *** ***** ***** ** ******** ** *** ****** in ******'* ***** *** *** *** ****/*********** ******* ** ***** up *** ***. **** **** ** * **** ** *** bucket ******* ** **** ***** *********** ** ** ***** ******** is ********* ****** ** *** ******* ****** **** **** ** watch ******* ****, **** **** **** ******* ***** ******. ** far ** ***, * **** *******, ***** ** *** ** is ******* ****, ******* **** ****, *****, ****** *** ******. All *** ***** ******* **** *** ** ******** **** *******, I *** *** *** *** ******** ** *** **** ******* murmuring *** ****, ** ** ***** **** ** *** *** this *************. ****.

** * ******** **** *** **** ***, **** *** *******, more ** **** ***** *** ********** ****** *** ********* **** year **** *** ****** **** ***.

******** ** * ****** ********* ****** ***** *** ***** **** are ****** *** *** ***** **** *** *******. **** ** what ***** ** ****.

***** *****, ***

Avatar

Sean Nelson

Nelly Security | 12/20/18 02:48am

**** ** *****! ** ********* ****** ****, ***** **** ** as ***** ****** ** *******?

Avatar

Daniel Tyrrell

In reply to Sean Nelson | 12/27/18 03:47pm

* **** **** **** ****** *** ***** **-****** ** *** as ** *** **** * *****, *** *********** ******** * believe *** ***** ** *****.

** **** *** *** ***** ** **? ******* *** ************* criteria ***** *** ****** ** ** ***** ** **** ** the ****** ***'** *** *** ********.

*** * ***'* ******* *** ****** ***** ** ******* **** this.

Avatar

Sean Nelson

Nelly Security | In reply to Daniel Tyrrell | 12/27/18 03:51pm

**** ******. ***** ** **** ** *** **** "***". *** could **** ** * ****:

- ********* ** **** ** ***** ****** ** *******
- ******* ** **** ** ***** ****** ** ********* (******** less ******* ********* ** *** **** ** *********, *** **** also **** * **** ****)

John Honovich

IPVM | In reply to Sean Nelson | 12/27/18 03:54pm

- ******* ** **** ** ***** ****** ** ********* (******** less ******* ********* ** *** **** ** *********, *** **** also **** * **** ****)

**, ****, ***'** *** ****!

***** ********* ********* **** ** **** ***** ************* ***********, ****, let **** ** **. ** *****, **** *** ***** **** some **** ** ****** ******* *******.

*** ** *************, ******, **** ***** *** ****** ***** / issues, ** ***** **'* **** *** '****** ******' ** ********* like ** ***, ** ***** ** **** ******** ** **** any ********** ********* **** **** *** ***** *** ***** *****, the ******* **********.

**** ** *** ***** ***** * ************* *** ***** '**** of ************* ********** *******'?

Avatar

Sean Nelson

Nelly Security | In reply to John Honovich | 12/27/18 04:04pm

****** **** *** ******** *** ***** *** **** * ***-*****.

** ******* **** *** *************, **** *** *********, ****** ****, the **** **** ** ***** ********.

** ********* **** *** *************, **** ***** ******** ************* **** super ****** **** ***** *** ***** ** ** *******, **** aim ** ***** *** ****** ** ****** *** *** ** booger ******* *********. *** ** ******* ***** ******* ******** ********* is ******** ***** ** ***** *** ******.

John Honovich

IPVM | In reply to Sean Nelson | 12/27/18 04:11pm

** ******* **** *** *************, **** *** *********, ****** ****, the **** **** ** ***** ********.

***, ** *** **** **** *** ******* ** **** **** here ** ***** *** **** ******* *********?

******** ** **** **********, **** ** **** ** **** ***** Genetec's *************:

***** ** ************* *** ********* * ******* ** '************' *** 'backdoor ****', *** **** **** **** ** ************* ******** *********** source **** ******* ******** * ************* ****** ********** ***** **** generic ************* **************.

**** ***** **** ** *****, ** ****:

** ********* **** *** *************, **** ***** ******** ************* **** super ****** **** ***** *** ***** ** ** *******

** ****** *** **** *** ***** *** ******** ***** **** door ****. ** ******* ****** ** *** ** * ******** that ** ***** *** ****, **** *****. ** ********* ****** to *** ** * ******** **** ** ***** *** ****, they *****.

*** ********** ** - *** ** * ******* ******** ******* who ******** ********* *** *** **** ***** *** *** ***** is ********** ** ** ************* ********** *** ************** ******** ************** and **** ************* *****. *** ***** ** **** ******** *******.

Avatar

Sean Nelson

Nelly Security | In reply to John Honovich | 12/27/18 04:19pm

******* ****** ** *** ** * ******** **** ** ***** not ****, **** *****. ** ********* ****** ** *** ** a ******** **** ** ***** *** ****, **** *****.

* ******* ***** **** *** **** *****-******** ********, ************* ********* and ******* *** *** **** ******** ****.

John Honovich

IPVM | In reply to Sean Nelson | 12/27/18 05:10pm

* ******* ***** **** *** **** *****-******** ********, ************* ********* and ******* *** *** **** ******** ****.

***, **** ** **** **** ********. *** *** ******, **** is ******* *** ** ********.

***'* ** **** **********:

  • *'** ******* ********* ****** **** ** **** *** ** ******* of ******* **** ** *************. ** ** **** **** ******* I **** ****** ****.
  • ** ********* ***** **** *************, ** **** **** * ******** article ***** / ** ********* ** ** ****** ** **** clear ***** ** ************* ****.
  • ** **** *** ********* *** ********* / ******* ******* *** it **** ********* ** ******* ********** ** ******** **** **** year's ******** **** *** ****** *****.
Avatar

Fabian Muyawa

LONTECH SYSTEMS | IPVMU Certified | 12/27/18 08:23am

******* ** ****** ******* **** ************* ** **** ** ******* they **** ********* ** ******* **** *****. **** ** ***********.

Undisclosed Integrator #2

01/02/19 01:41pm

**** *** *********** *** **** ** *********** **** ***** ******** business ******* ** **** ** **** ***** ************ ** *** field *** ***** ** ** ******** ** **** * ***** of ********* ***** ******** ********* ** ** ******** **** ******* customers...............nice ** *** ** ***** ************* ** *** ***** ******** compliance ***********

Undisclosed Manufacturer #3

02/15/19 03:21pm

** **** ***** ** ******* ** *** ************* ** ********... *** ***********?

Avatar

Dan Gelinas

IPVM | In reply to Undisclosed Manufacturer #3 | 02/15/19 03:43pm

*'** ******* *** ** ** ******* ** ** *** **** get **** ** *** ****, **#*.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to emerging into an AI cloud era.  The goal of this history...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 15, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
Axis ARTPEC-7 P1375-E Camera Tested on Jul 12, 2019
Axis claims the new P1375-E box camera with ARTPEC-7 chip delivers "clear, sharp images in any lighting condition." But how well does it do? We...
Network Optix / Hanwha Cloud Access Tested on Jul 02, 2019
Remote cloud access is becoming a bigger differentiator, as cybersecurity issues underscore the problems of port forwarding and many integrators...
FLIR Saros Visible / Thermal Analytic Camera Tested on Jun 26, 2019
FLIR's Saros claims "accurate, actionable alerts" with a combination of 1080p visible and dual thermal sensors along with IR and white light...
Axis Live Privacy Shield Analytics Tested on Jun 25, 2019
Privacy is becoming a bigger factor in video surveillance, driven both by increased public awareness and by GDPR. Now, Axis has released Live...
Directory of 60 Video Surveillance Startups on Jun 25, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...
Genetec Beats Milestone For IHS #1 on Jun 21, 2019
For years, Milestone has touted that they are the #1 VMS. Now, Genetec has beaten them in IHS rankings. But what is this? Even other manufacturers...
Exacq Remote Cloud Access Tested on Jun 20, 2019
Remote cloud access has been missing from most VMSes (including Exacq and Milestone). Now, Exacq, after releasing Cloud Drive Storage earlier in...

Most Recent Industry Reports

History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to emerging into an AI cloud era.  The goal of this history...
Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
New GDPR Guidelines for Video Surveillance Examined on Jul 18, 2019
The highest-level EU data protection authority has issued a new series of provisional video surveillance guidelines. While GDPR has been in...
Wyze AI Analytics Tested - Beats Axis and Hikvision on Jul 17, 2019
$20 camera disruptor Wyze has released free person detection deep learning analytics to all of their users, claiming users will "Only get notified...
Anyvision Aims For 2022 Revenue of $1 Billion on Jul 17, 2019
Only 3 video surveillance manufacturers do a billion dollars or more in annual revenue - Hikvision, Dahua, and Axis. Now, Anyvision plans to join...
HD Analog vs IP Guide on Jul 16, 2019
For years, HD resolution and single cable signal/power were IP camera advantages, with analog cameras limited to much lower resolution and...
How To Troubleshoot Wiegand Reader Problems - Inverted Wiring on Jul 16, 2019
Wiegand is the dominant method of connecting access readers, but problems can arise for installers. In fact, one of the most difficult reader...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Motorola Acquires Watchguard, Adds to Vigilant And Avigilon on Jul 15, 2019
2 years ago, Motorola had no position nor relevancy to video surveillance. Now, they own major video surveillance, LPR and body camera providers...
Hikvision Global News Reports Directory on Jul 15, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact