Your security cameras can see and record everything that happens inside your business. It's omnipresent and always watching. But how sure are you that your camera systems are secure and that you're the only one watching?
Very few people think about how secure the camera systems they're purchasing are. Most people often look at the resolution, picture clarity, convenient features, or even cost. That might be one reason to explain why many manufacturers also don't put that much focus on securing their technology.
"Most manufacturers are not security-focused," said Kyle Ramirez, our Technical Sales Engineer from ITS San Francisco. "They don't put a lot of effort into making sure that your stuff is protected, and often these are systems placed right on the same network as servers and workstations. So that's a deadly combination," he shared.
According to him, a feature of security cameras that could pose a serious threat is also what most consumers are looking for in their surveillance systems; remote access. "What most business owners want from their surveillance is to be able to access [their cameras] remotely, and in order to do that, it needs the Internet. These systems are commonly not secure," Ramirez explained.
But what are the implications of unsecured surveillance systems? Imagine footage inside your workplace leaked or sold to the highest bidder. That could seriously endanger you, your team, and your business. It's also a predicament around 100 firms found themselves in last year, when a foreign hacker breached and leaked footage from 150,000 security cameras made by Verkada Inc. Some of those affected include companies and government agencies.
At ITS, we've helped hundreds of businesses manage and secure their devices. In this article, we'll share the necessary steps you should take before installing a camera system in your workplace. To do that, we'll dive into the following:
- Why is it Important to Find Secure Camera Systems?
- Steps to Take Before Installing a Security Camera
Why is it Important to Secure Your Camera Systems?
As Ramirez pointed out above, many manufacturers do not focus much on securing their systems. That means your surveillance systems could potentially become a vulnerability rather than an asset to your security.
In 2021, researchers at IoT cybersecurity firm Nozomi Networks discovered a security flaw for a product made by Annke, a Hong Kong-based global provider of home and business security solutions. They found that the vulnerability can be exploited to allow hackers to remotely access Annke's N48PBB network video recorder (NVR). A device used to store video captured by cameras.
The implications of the security flaw were dangerous. It had the potential to allow an attacker to access recorded videos, delete footage, and change configurations (e.g., motion detection alarms). It could even give them the ability to shut down certain cameras or the NVR itself to prevent them from recording. What's even more alarming is that cases like these are more common than you would like to believe.
In the same year that Annke's NVR security flaw was discovered, a researcher with the moniker "Watchful IP" found that more than 70 Hikvision cameras and NVR models also had a critical vulnerability. That flaw could allow hackers to remotely control the devices without any user interaction at all.
Both vulnerabilities were found in the same year. That should serve as a reminder that as more of these devices connect to the Internet, the more careful you should be about choosing which ones you're installing inside your workplace.
How to Choose a Secure Surveillance System
Choosing secure surveillance systems should be a no-brainer, but that's not what happens in most cases.
According to Ramirez, it's common practice for business owners to drop by their local Costco and pick up an inexpensive camera system, then just plug it into their networks.
"As IT people, we have to ask: Well, what is that doing? Is it protected? Does it have the right security service? There are lots of different questions you need to consider before you put something like that on your network," he said.
Putting in that extra effort when choosing your surveillance system can mean the difference between securing your workspace or opening up a backdoor for hackers to exploit.
"The manufacturer's attention to security is not something we can control," Ramirez stated. "What we can control, however, is where we place this item on our network and how we choose the brand and the model," he added.
Check out some of his tips on how to choose a secure surveillance system:
Choose a Brand You Trust
There's a reason top security system providers have higher price points. They have their reputations and guarantees to uphold. That doesn't come cheap. For consumers, however, that means they are more likely to offer products that have a meticulous focus on security. No tier-one brand wants to be on the headlines of security magazines over a security flaw.
"If you are looking for a local system, go with a tier-one provider. Choose a brand name that you trust," Ramirez advised. "It's going to be much better than the ones you haven't heard of. At least in this instance, that does ring true."
Find the Right Model
Choosing the right model for your surveillance system is a bit tricky. Getting one that's closed off and has no access to the Internet means a more secure product. However, you won't be able to access it remotely.
"If the model you chose is a standalone product and it's not on your network; the cameras only talk to that box; there's no Internet; then there's really not much of a threat. That's old school, and I think you're good to go," Ramirez said.
He cautioned, however, that if you're looking for remote access for your surveillance systems, the decision will require more thought. That's because you will need to find a way to separate them from your local network. Ramirez suggested a few options to do that.
"There are some models that are purely cloud-based. So you only buy the camera, and it connects to the Internet, then all your data will be stored in the cloud. You don't have to remotely access your equipment, so you're not opening a hole to the Internet," he said.
"Then there are also these models that don't talk to anything else and only need Internet access. So it's really easy to put a gap between them and your local network," Ramirez added.
Do Your Research
Sometimes the way to find a more secure surveillance system is as easy as flipping the device over, finding the model number, and doing a quick Google search.
Look for reviews, articles from security researchers, or even disclaimers from the manufacturers themselves. Researching whether a brand's particular model has any security issues or flaws can help you make better decisions. Thankfully, according to Ramirez, that information is often freely available online.
"There's a back door on every single system. So do a bit of research," he advised. "The nice thing is when security researchers find this information, they do what they're supposed to. They responsibly disclose the information to the manufacturer so they can fix their problem. Sometimes that information is publicly disclosed, they will list the model numbers and so on," he explained.
Seek Help from Experts
Ask IT experts for advice. Whether it's your in-house IT department or your managed service provider (MSP), they'll be able to provide you with invaluable information and guidance.
They can also help you secure your new system, like setting up a DMZ network for your new surveillance system. "A DMZ zone is a common term for technicians. That's a zone that you can get to from the Internet, but it cannot talk to anything else," Ramirez explained.
"That ensures that you can access your cameras, but your cameras cannot talk to the servers or workstations to infect them. So even if it was hacked from the outside, only the camera system would be affected, and they wouldn't be able to crawl out to the rest of your network," he added.
Need Help Securing Your Surveillance System?
Putting in that extra effort to ensure your surveillance systems are secure is vital to keeping your workplace and your employees safe. It can mean the difference between your camera systems becoming a security asset or a liability waiting to happen.
At ITS, we've helped hundreds of businesses find and secure vulnerabilities like unsecured surveillance systems. If you want to learn more about how to fix those hidden security gaps, check out our article on how to fix holes and backdoors in your IT Network.