News Camera Corner Opinion
The cybersecurity of security

The video surveillance industry has suffered from several high-profile data breaches in the last few years.

While the data that was exposed through these breaches is of particular concern, learning from these events and understanding them can be key to preventing future occurrences. Cybersecurity is a complicated field and cannot be over simplified, but the following are three key threats facing the video surveillance industry today and some simple measure to prevent them.

Malware

Malware and viruses are the most well recognized threat to any computer system, and video surveillance products are no different. Anti-virus software can clash with video management software, making Windows-based recorders vulnerable when not configured properly. As such, some integrators avoid anti-virus altogether. To reduce the risk of malware attacks and viruses, integrators can leverage several common network practices to restrict the recorder’s exposure to external threats. Integrators can also focus on deploying Linux-based appliances, which are less vulnerable to viruses.

Finally, if integrators are installing Windows-based recorders, they can follow the VMS provider’s instructions on how to configure an anti-virus software as to not negatively impact the VMS functionality.

DDoS attacks

Distributed Denial of Service (DDoS) attacks are less about data loss and more about bringing down a business or website. In DDoS attacks, hackers use thousands of unsecured devices to connect to a single network simultaneously. This overwhelms the target network and can bring down servers, websites or entire businesses.

DDoS attacks are typically used as a form of protest against a company or organization. Video surveillance systems are rarely on the receiving end of these attacks, but instead are leveraged to create the required army of attacking devices. Hackers typically take control of thousands of IP cameras which they discover on the internet and access using default or otherwise simple passwords.

Once hackers have a large enough number of cameras under their control, they direct the cameras to send nonstop digital requests to the target’s website or server — ultimately overloading the target until they are able to block the requests. The easiest way for integrators to prevent their products from becoming participants in a DDoS attack is simply to remove any default credentials from the camera and ensure any new credentials use strong passwords.

Stolen credentials

Stolen credentials are by far the most common type of breach affecting the industry today. User credentials are stolen from a compromised device or other service, after which they are used to allow hackers access to user accounts. Depending on the level of access the credential reaches, hackers could potentially gain access to company-wide databases that store confidential employee or customer data.

While it sounds complicated to steal credentials, it is surprising how many times a breach begins with an employee or user openly sharing their credentials on non-secure or otherwise publicly accessible forums.

The biggest challenge with preventing stolen credential attacks is that it requires educating employees and customers about how to protect their own information. Probably the most effective method of preventing a stolen credentials breach is by using multi-factor authentication (sometimes called 2FA).

Multi-factor authentication requires users to provide a second layer of information after entering their initial password.

This is usually a random code that is sent in real-time over SMS or through an authentication app to the user’s phone after they enter the initial password. Unfortunately, very few video surveillance products support multi-factor authentication, but it is likely something we will see more of soon.

The video surveillance industry is growing and the products it provides are gaining more mainstream attention. As this happens, these same products become more popular targets for malicious attacks. Cybersecurity is almost impossible to perfect, and no matter how secure your platform is, even a simple user or employee error could result in a significant breach. No company is immune to cyberattacks, but taking some simple measures can significantly reduce exposure to them and ultimately better protect the industry’s customers and its reputation.

Colin Bodbyl is the chief technology officer of Stealth Monitoring (www.stealthmonitoring.com).