CCTV cyber security: how installers can harden every system they fit

An IP camera is a small networked computer, often mounted out of reach and forgotten for years. Security cameras have repeatedly been targeted by malware and exposed online through weak passwords and unpatched firmware. When that happens, customers do not usually blame the manufacturer. They ask who installed the system.

The good news is that most of the risk can be removed with routine steps at installation, and very few of them cost anything but a little time. This guide sets them out in the order you would normally do them.

Why this matters to an installer

• Your customer's privacy. Live views of homes, shops and offices are sensitive.
• Their network. A poorly protected camera could offer a route into a business network.
• Attacks on others. Compromised devices have been used in botnets to attack third parties.
• Your reputation and liability. Your contract, and the law where you operate, may affect what you are responsible for. It is much easier to defend good practices you can show than poor ones you can't.
• A sales advantage. Many installers skip these steps. Being able to explain how you protect a system helps you win business from careful customers.

Choose equipment with security in mind

Security begins before installation.

• Prefer manufacturers that publish security advisories and supply regular firmware updates.
• Find out how long the product will be supported.
• Avoid devices with hard-coded passwords, or those that won't let you disable risky services.
• Buy through authorised channels. Grey-market devices may have odd firmware or no update path.
• Check for any legal requirements on the product where you work.

Review the model's security record, not only its picture quality.

Set passwords and accounts properly

Default credentials remain one of the easiest ways in.

Passwords

• Change all default passwords on cameras, recorders, switches and routers.
• Use long, unique passwords for each site. Never use a company-wide standard password. If one leaks, every customer is exposed.
• Keep credentials in a company-approved password manager, not a notebook, a spreadsheet or a WhatsApp chat.
• Change shared credentials when staff leave.

Users

• Give the customer's admin an individual account.
• Create regular user accounts with only the permissions needed, such as view-only for guards.
• Remove or disable any demo and unused accounts.
• Record who holds administrator access, in writing.

Your own access

If your company keeps access for support, use named accounts where the system allows it. Agree on this with the customer, and remove the access when the contract ends. Don't keep admin access without telling the customer.

Update firmware

• Check for the latest firmware before installation. Doing this on the bench is much easier than on a ladder.
• Read the release notes, and check compatibility with your recorder.
• Update from the manufacturer's official source. Never use firmware from forums or file-sharing sites.
• Record the versions at handover.
• Schedule reviews under your maintenance contract.

On a live system, plan the update. Back up the configuration, tell the customer and have a way back in case something goes wrong. Updates also change compliance details in some regimes, so check your documents.

Separate the network

Keep cameras away from everything else where you can. It limits what an attacker can reach, and it keeps video traffic from affecting other business systems.

Common approaches

• Physically separate network. Cameras go on their own switches, connected to the recorder only. Simple and very effective for small sites.
• Recorder's built-in PoE ports. Cameras sit on a private network behind the recorder. Convenient, though the recorder itself still needs protection.
• VLANs on managed switches. Cameras sit in their own VLAN, with firewall rules controlling what can reach them. This suits businesses with IT support.

Simple rules to apply

• Cameras should not need to reach the internet directly in most designs. Block it if you can.
• Only the recorder or video management system needs to talk to cameras.
• Limit which devices can reach admin pages.
• Disable unused switch ports where practical, particularly any in public areas.
• Consider MAC filtering or 802.1X on higher-risk sites. An outdoor camera's cable can be an exposed network port, so someone could unplug a camera and plug in a laptop.

Secure remote access

This is where many systems get into trouble. Customers want to view on their phones, and quick fixes can leave a system exposed.

Practical points:

• Turn on two-factor authentication wherever it's available.
• Disable UPnP on the router and devices, so that they can't open ports automatically.
• Use HTTPS, not plain HTTP. Replace or manage certificates as appropriate.
• Turn off any cloud service you are not using.
• Check the system from outside after installation. Confirm that no unintended ports are open.

Ask the customer's IT team, if they have one, before making any change to their firewall.

Turn off what you don't use

Every running service is one more thing that could be attacked.

• UPnP
• Telnet and SSH, unless needed and secured
• FTP and email alerts, if not configured securely
• Older ONVIF or RTSP access without authentication, if you can avoid it
• Multicast features you do not use
• Unused cloud or P2P features

Set ONVIF and RTSP access to require authentication. Use encrypted connections between devices if the system supports them.

Protect the physical layer

Network security can be undone by someone with a screwdriver.

• Put the recorder and switches in a locked room or cabinet.
• Use tamper-resistant mounting where people can reach cameras.
• Protect exposed cable, using conduit where needed.
• Disable or cover unused USB ports on recorders in public areas.
• Enable alerts for tampering or video loss if useful.

Protect the footage

• Limit who can export footage, and keep a record where possible.
• Encourage clear rules on who may view it, and why.
• Use encrypted storage or export where the risk warrants it.
• Replace drives securely, and make sure old drives are wiped or destroyed. A failed drive can still hold readable footage.
• Do not keep customer footage on technicians' phones or laptops after a job.

Keep your own company secure

Your company may hold the keys to many sites, which makes you an attractive target.

• Use a business password manager with individual logins.
• Turn on two-factor authentication for email, cloud portals and your manufacturer accounts.
• Encrypt laptops and lock phones.
• Remove access the same day someone leaves.
• Limit who can view customer credentials.
• Teach your team about phishing and phone scams. Be careful about anyone who calls asking for a password while claiming to be the customer.
• Have a plan: if your password store leaks, who do you tell, and what do you change first?

Hardening checklist for every job

• Firmware updated to a current, official version
• Default passwords replaced with unique passwords
• Individual user accounts created with least privilege
• Unused services and accounts disabled
• UPnP off on the recorder, cameras and router, as agreed
• Cameras on a separate network or VLAN
• Remote access via a secure method, tested from outside
• Two-factor authentication on where available
• Time synchronised
• Recorder and network gear physically secured
• Configuration backed up
• Credentials handed over securely, and who holds them recorded
• Customer told how to add, change and remove users

Add this list to your commissioning and handover checklist to make it routine.

How to explain it to customers

Most customers don't want a technical lecture, so keep it simple:

"We set unique passwords, keep the cameras on their own network and use a secure way of viewing on your phone. We will show you how to manage users, and we can check for updates under a maintenance plan."

Explain what they need to do: change passwords when people leave, avoid sharing logins, and tell you if they see anything strange. Don't promise that a system is "hack-proof". No honest supplier can say that.

Older systems

You will often meet older systems with no firmware support and weak security. Options include:

• isolating them completely from the internet and other networks
• replacing the most exposed devices first
• moving remote access behind a VPN
• planning a phased replacement

Explain the risk in writing and let the customer decide. If they decline an upgrade, keep a record.

Responding to an incident

If you suspect a compromise:

1. Tell the customer promptly, and bring in their IT or legal adviser as needed.
2. Keep evidence, such as logs and settings, before you make changes.
3. Isolate the affected devices from the internet.
4. Change all passwords, and check for unknown user accounts.
5. Update or replace vulnerable devices.
6. Work out how it happened, and whether others could be affected.
7. Consider legal duties to report, which vary by place and by the data involved.

Writing a simple one-page plan in advance means that you won't have to invent one in a panic.

Making it a standard

Security fails when it depends on a technician remembering it on a busy day. Write it into your standard process, and include it in training and quality checks. Spot-check finished jobs from time to time. Once it becomes routine, it adds only a few minutes per site, and protects your customers and your company's name for years.