Page 12 - Security Today, September 2017

Hacked Off 7 ways to protect security cameras from hackers
BTy Tom Galvin
he digital writing is on the wall for the physical security indus- try. We’ve recently witnessed some of the biggest distrib- uted denial of service (DDoS)
attacks in history, facilitated by devices such as network security cameras. Yet while our industry is fairly good at anticipating and re- acting to new physical security threats, we’ve been very slow to react to the clear and pres- ent danger from cybersecurity attacks.
There are myriad reasons for this, includ- ing lack of knowledge about how to properly secure cameras. So far, the camera attacks have been focused on disrupting the business of those other than the camera owner. With code floating around the Internet that breaks into poorly protected cameras, how long will it be before hackers modify that code to at- tack the camera’s owner?
What has become obvious in the last year is that simple devices such as security cam- eras must be installed and administered with cybersecurity in mind. Fortunately, while the risks are real, it doesn’t take a CCNA certifi- cation to apply cybersecurity defenses. Here are seven simple measures to take to protect your cameras, your network, your revenues, and your reputations.
Change Your Passwords
Many installed cameras are still using the manufacturer’s default passwords. Many others have weak passwords that are easy to guess. Hackers can easily exploit this by writ- ing programs that try a list of default and common weak passwords very quickly, hop- ing to stumble on one that works.
Isolate Your Cameras
If criminals can’t talk to your cameras, they can’t attack them either. Do not put them on the corporate network with all of the other PCs and Workstations. Isolate them with a Virtual LAN (VLAN). Only the Video Man- agement System (VMS) should be able to talk to them.
Lock Down the Network
Hackers can gain access to any camera on your network by unplugging any camera and replacing it with a laptop. Thwart this by configuring the network so that the only devices allowed to communicate over those ports are the cameras you installed. Each camera has a unique identifier called a MAC address. A network can be configured to only
allow a certain MAC address on each port (a feature called MAC Binding). With this in place, all communications from other devices get thrown away, and the hacker gets a dead connection.
Use Two Logins for Each Camera
IT departments discovered a long time ago that computers should use at least two logins: a user with a minimal amount of privileges and an administration login with full privileges. This separation of users minimizes the chances of a frequently used login falling into the wrong hands. Cameras should be set up the same way: one login used by the VMS that allows for streaming video only, and an admin login that is only used on rare occasions, such as needing to update firmware.
Monitor for Unusual Events
Hacking often leaves signs. If a hacker un- plugs a camera for nefarious purposes it will, of course, go offline. That said, the hacker may try to plug the camera back in, so you should regard even a short outage with sus- picion. If a new set of firmware is uploaded, the camera will reboot.
Viruses often place a load on the cam- era and reduce performance. You might get lucky and notice one of these during your normal use of the system, but good security takes more than luck. The best practice is to set up the system to monitor for events like
these with immediate notification.
Purchase Cameras from Reputable Companies
There is much concern over the security of certain brands of cameras. Most certainly, checking the “cyber reputation” of any sys- tem component vendor should be on your checklist prior to a major purchase. Look for vendors that have a public reputation for at- tention to proper cyber aware design. They should respond rapidly to any issues.
If you already have a significant invest- ment in cameras from a less than trustworthy vendor, following these best-practice recom- mendations will significantly lower the risk.
Apply Automation
Automated cyber protection mechanisms can make the administration of these best practices scalable and automated. On the front end, automation tools can configure best practices such as enabling a protected VLAN for the security system and changing a camera’s default login credentials. Once the system is installed, automated cyber protec- tions can also monitor network flows, detect abnormalities, and respond immediately to suspected attacks.
Don’t wait to be at- tacked to take proactive cybersecurity measures.
Tom Galvin is the found- er and CEO of Razberi Technologies.
10
0917 | SECURITY TODAY
CYBER SECURITY
Gorodenkoff/Shutterstock.com