Integration News
Security all the way to the edge

Genetec’s systems were built on an open-architecture, and because of this, we were positioned to expand and integrate new sensor devices or “things,” like smart phones used as mobile surveillance cameras, intercom systems, and body-worn-cameras.

As the IoT became more mainstream for broader markets and the consumer public, as we expected, vulnerabilities have to come into sharp focus.

The IoT is a network of physical objects, devices, vehicles, buildings and other items that have embedded electronics, software, and network connectivity. A wide variety of sectors and applications, including environmental monitoring, infrastructure management, medical and health-care systems, and transportation are adopting the benefits of the IoT — and especially the consumer market.

By allowing things — or sensors, as we refer to them in IP-physical security — to be used and controlled remotely across an existing IP network infrastructure, the IoT creates opportunities for more direct integration between the physical world and computer-based systems. The benefits are improved efficiency, accuracy and economic benefit. We are also aware that any system is only as secure as its most vulnerable point. When working with extended IP-based and federated physical security systems, multiple access points will naturally result in increased opportunities for cyber-attacks. We know that even one improperly secured or protected edge devices, like a camera, can be the gateway to put an entire system at risk.

Cyber attacks hit close to home
A recent story in the press reported of a hacker that accessed an unprotected baby monitor and had been speaking directly to the child in the room. With this disturbing violation, consumers are finally becoming more aware of the vulnerability of their default or easy-to-guess passwords for the sensors and devices in their homes.

Similar sensor device technology is attached to large corporations, municipal infrastructures, law enforcement, and citywide surveillance. These edge devices are connected to vast security system networks and storage locations, containing highly sensitive data which can affect both public safety and human life.

So, while the idea of a stranger connecting with a child over an audio or video monitor is both shocking and upsetting, the consequences of a security breach from edge devices within  larger security systems, has the potential to cause damage on an even greater and more devastating scale.

How can we protect our data?
A poorly or improperly secured sensor device could allow hackers to gain access to a video management system, which could be subsequently connected to an access control system, data storage, communications systems, or the Cloud. By leveraging the vulnerability of a single camera, a hacker could gain access to read, disrupt, alter, cut the video feed or lock an organization’s sensitive, private, and critical data.

Camera manufacturers have become increasingly involved in the security of their edge devices and are aware of the impact vulnerabilities can have on an entire network. Some already publish recommendations on how to keep their cameras secure, but, if end-users do not follow these guidelines, then they are of little help.

The task now is for the physical IP-security industry to put new measures in place to help mitigate these risks.

Ensuring better security at the edge
At Genetec, we collaborate with an ecosystem of over 200 manufacturing partners, who collectively produce 2,700+ cameras and other sensor devices. We work closely with camera manufacturers to reduce and secure any vulnerabilities that exist between edge devices and the archiver — that part of our security platform that manages, saves, and archives video data. The key is to ensure that the front-end is as secure as the back-end when video data is being managed, moved, and stored; either on-premises or in the Cloud.
 
One of our strategies for 2016 is to work with and influence camera manufacturers to implement better standards to follow more rigorous security practices.  At a very basic level, this includes having camera manufacturers require users to set a unique password whenever they install a new camera.

Camera manufacturers often set default passwords, like 123456 or admin, which many end-users never change when they install the devices. This means that if a hacker knows the make, model or even the manufacturer of a camera, they can easily gain access via these default passwords. By requiring that users setup their own, unique passwords at installation, we can make it that much more difficult for hackers to gain access.

Increasingly, and particularly when it comes to edge devices, we err on the side of security instead of ease-of-use and compatibility. While this may lead to more effort on the part of manufacturers, developers, installers and the IT department, we must take these steps to assure physical security systems are secure by default.

Multiple layers of defence
Beyond being deterred by a secured sensor device at the edge, we know that hackers will quickly move on and attempt to break into the database via sniffing networks or by grabbing unencrypted data in transit. They will even make attempts by installing malware to grab data before it gets encrypted.

Staying ahead of hackers and other unwelcome entities trying to exploit the increased number of network gateways into physical IP security systems, we are taking the Security-of-Security very seriously, and to new levels. This strategy incorporates multiple and varied lines of defense, including encryption, multi-layer authentication and authorization.

Encryption and authentication
Encryption is the process through which data is encoded so that it is scrambled and rendered useless, if intercepted, to unauthorized users.  While encryption can effectively hide contents or ensure the confidentiality of data, additional security measures are required to protect the integrity and authenticity of data.  Even if a hacker is unable to get access to video data, simple encryption cannot keep that data from being spoofed, nor does it prove the authenticity of the data transmitter.

The process of authentication allows a user, client, or server to determine whether an entity is who they claim to be. For example, through authentication, an operator can be certain that they are connected to their security system when logging on to a video surveillance server so that they don’t fall prey to a man-in-the-middle attack. There are several methods of authentication including; basic (username/password combinations), certificates, claims-based, multi-factor and biometrics.

Today, we are using one of the latest protocols that can be employed to better protect physical security systems. TLS provides protection by using digital certificates to first authenticate the counterpart in the communication and then negotiate a symmetric session key that is used to encrypt data during the conversation.

This process provides greater security for communication over a network because it protects communication channels between servers and client applications, as well as between the servers themselves. TLS is just one example of a multilayered approach to protecting physical security systems that is a vital component of our approach to the security-of-security.

Maintaining privacy
In addition to protecting sensitive data from hackers and other outside entities, it is also important to be able to manage who, within your organization can see your data and what they can do with it.

Increasingly, public and private companies, various levels of government and law enforcement are federating and sharing data and video footage. In essence, they are taking advantage of the IoT to share video footage with each other. This greatly increases their ability to quickly respond to and mitigate criminal activity. Sharing video data across IP networks requires that security professionals must have the means to guarantee that their sensitive data stays private, viewable and accessible only to authorized users, even in the event of theft or interception.  
Comprehensive, finely grained privileges allow security personnel to define all the access rights for private data, computing resources and applications within their system. Only authorized entities are allowed to review sensitive data and video exports out of system storage must be explicitly authorized — quite often by multiple parties.  

Partnership with Bosch
At Genetec, we share the initiative for the security-of-security with many of our technology partners. One such partner is Bosch Security Systems. According to Konrad Simon, a Product Manager in the company’s IP Video division, Bosch takes a 360 degree view of data security.  
Because video and related data are often highly critical and sensitive, Bosch has a systematic four-step approach to maximizing security by considering physical safety and cyber security simultaneously.

The first step is to create trust. Based on certificates, Bosch ensures trusted communications between cameras and network components by assigning each element an authentication key that serves to verify all components from Bosch cameras to a video management system or viewing clients.

Once trusted communication between the components has been established, the next step is to secure the data. When it comes to safeguarding surveillance data, the safe storage of the encryption keys used to secure the data is paramount. Bosch implements encryption at the hardware level. All Bosch IP-cameras and recoding solutions are factory-loaded with a trusted platform module (TPM) that safely stores all encryption keys used to protect all streamed and recorded data.  Even in the event of a data breach, the information is useless to anyone without the certificates’ private keys.

The third step is to manage user access rights. Video surveillance data can range from merely sensitive to top secret, and even networks with trusted devices and secure data transfer can fall victim to human error. To mitigate the risks associated with human error, the video cameras made by Bosch offer management options for individual user access rights and support existing industry standards, including Microsoft’s Active Directory.

Finally, all of Bosch’s video surveillance solutions comply with leading industry standards in public key infrastructure (PKI) for the management of digital encryption certificates.

Working together
Ultimately, a comprehensive approach to the security-of-security requires that the sensors at the edge can capture data and move it to a unified security system for management, analysis and storage with strong encryption that is accessible only to authenticated and authorized end-users.  Bosch-integrated data security systems bring peace of mind by protecting both valuable data and privacy while ensuring that video information cannot be tampered with. As the challenge of safeguarding data continues, Bosch experts are actively contributing by transferring well-established IT standards and authentication methods to the security industry.

By understanding the complexities our connected world, and through collaborative efforts, Genetec and its technology partners, like Bosch, are working together to assure that video data is protected at the sensor, during transit and analysis, all the way to storage and long-term archiving.  

Andrew Elvish is the vice-president of product management and marketing at Genetec (www.genetec.com). Konrad Simon, product manager, IP Video, Bosch Security (www.boschsecurity.us) also contributed to this report.