IP CCTV managers warned: neglect cyber security at your peril

The BSIA CCTV section has urged operators of IP-connected surveillance systems to do more to safeguard their systems against cyber attack, including changing the manufacturer’s default credentials.

The advice has been issued in the wake of a Times article that reported concerns from MI6 about the threat to national security from IP-connected CCTV systems.

Unsecured cameras can serve as a weak link through which hackers can gain access to an organisation’s wider compute network, warns the BSIA.

The consequences of a successful attack include the disruption of operations through sabotage, the theft of personal data and resultant brand damage, stolen intellectual property or trade secrets, ransom demands, and regulatory action or negligence claims.

But the association also said cyber security was the responsibility of other parts of the supply chain. Manufacturers, it advises, should ensure that accidental design or implementation errors are minimised and regularly scan systems for vulnerabilities. Secure coding and testing procedures should be the norm, while products should support the following:

End to End Encryption with SHA-2 & TLS

Encrypted database communication

System auditing, alerting and management

Denial of service protection

Restriction of ports, protocols and services

Highly customisable user access and permissions

Archive, failover and high availability

“Responsible installers and integrators will conduct a risk-based approach to any system design, taking into account the origin of the hardware in the design and whether this presents potential risk to the customer,” said Simon Adcock, chairman of the BSIA’s CCTV section.

“Anyone who is designing a system or making decisions on behalf of an end user should be considering the security of the hardware they are installing, ensuring that it is robust and manufactured responsibly. Responsible installers will also ensure that the system they have installed is protected from cyber attacks by changing manufacturer’s default system credentials.

“Ultimately, an end user must take responsibility for the security of their network. When procuring an IP connected surveillance system, end users must use the services of a reputable installer /integrator that is fully committed to best practice. They should also ensure that they have comprehensive cyber security and information security policies in place.”

Free Download: The Video Surveillance Report 2020

Discover the latest developments in the rapidly-evolving video surveillance sector, directly from the people at its heart. We surveyed hundreds of professionals working in the field to bring you the 2020 Video Surveillance Report. Responses come from installers and integrators to consultants and heads of security, as we explore the latest trends in the sector including video analytics; cloud-based storage solutions; VSaaS; cyber security; the impact of COVID-19 and more!

Download for FREE to discover top industry insight around the latest innovations in network cameras and video surveillance systems.

Download The Video Surveillance Report