Security Business

JUN 2019

Find news and information for the executive corporate security director, CSO, facility manager and assets protection manager on issues of policy, products, incidents, risk management, threat assessments and preparedness.

Issue link: https://sdi.epubxp.com/i/1129378

Contents of this Issue

Navigation

Page 24 of 59

June 2019 / www.SecurityInfoWatch.com / Security Business 25 How is the industry doing at allaying cybersecurity fears for network-connected products such as IP cameras? What else should be happening? Cooke: The first step is getting all parties involved to take cybersecurity requirements into account from the start – not as an afterthought. Some manufacturers are recognizing the importance of cybersecurity, and removing “features” of embedded devices that are not needed for an IP video device, such as SSL or Telnet access. Manufacturers are releasing hardening guides detailing what features are turned on by default and what should be enabled or disabled – such as SNMP and UPnP – and how this will affect the cybersecurity of the device. We see project teams designing with an approach of Defense in Depth, with multiple layers of security. We don’t want to rely on one protective mechanism such as a firewall or password but have vulnerabilities just inside. Speaking of passwords, recent legislation has forced the industry to finally remove default passwords. Hanwha has taken this further by requiring complex passwords and restricting the use of sequential or repeated characters, which are easy to guess. Taking this to the next level, we should be using secure communications (SSL/TLS) to encrypt data from camera to VMS, and VMS to client, as well as data at rest. Cameras and NVRs should be using secure boot, trusted platform modules, and encrypted firmware to ensure they are not compromised. Finally, there should be better transparency regarding OEMs. There are still many white-label products out there with no mention of if or when cybersecurity firmware updates will happen, and whether such updates from unknown third-party suppliers can be trusted. Kaczenski: The industry as a whole needs to do more. We, as the experts, need to be cognizant of the fact that cybersecurity is our responsibility and we need to choose manufacturer partners that take cybersecurity seriously. We need to follow best practices in our installations, and we need to educate our clients on what steps they can take to improve their security. Products are important, but we can’t overlook the human element. Troiani: Cyber-attacks are unfortunately increasing, and remote access to security cameras and security systems are also in greater demand. Having the security system (access control or video surveillance) on a separate VLAN, and behind a firewall is essential. We have a client that does vulnerability scans all the time on their networks and they require us to change passwords and update firmware on a regular basis. In regards to what should be happening all cameras and system manufacturers should be offering some kind of encrypted SSL or it should be mandatory that the connection be encrypted, both when it is stored on disk or when it is in transit. What are some of the most effective use-case examples when integrators pitch the advantages of a unified video management platform to enterprise customers? Kaczenski: Enterprise customers have enterprise problems, and they need an enterprise-level solution. In our view, that means all of the systems – video, access and visitor – need to be working in conjunction to compile and share information in a manner that makes it easier for a client/operator to respond quickly and effectively in the case of an event. What happens far too often – even with customers that you would expect to have an “enterprise” solution – is that each system is acting in its own silo. In these cases, when an event takes place, operators are forced to bounce between multiple systems to get the information they need. This takes more time and effort, and it reduces the effectiveness of a response. Well designed and properly integrated solutions make it far easier for operators to identify threats and respond effectively. Cameras and NVRs should be using secure boot, trusted platform modules, and encrypted firmware to ensure they are not compromised. – Ray Cooke, Hanwha Techwin America What happens far too often – even with customers that you would expect to have an 'enterprise' solution – is that each system is acting in its own silo. – Peter Kaczenski, Macro Digital Technology Corp.

Articles in this issue

Links on this page

Archives of this issue

view archives of Security Business - JUN 2019