IoT (and especially IIoT) devices are special beasts that really don't fit well into the existing network security models. For ones that need cloud access, they

IoT (and especially IIoT) devices are special beasts that really don't fit well into the existing network security models. For ones that need cloud access, they really shouldn't be accessible from the rest of the network, let alone the internet. They also shouldn't be able to talk to each other. This leads to either ACL hell, or VLAN hell (with a L2 wire type firewall or L3 router/firewall). There are some solutions like ForeScout that will do this for you automagically, and software defined networking also holds promise in making this less nightmare inducing, but for now it is a poorly addressed problem AFAIK. This isn't news, but the best way to deal with cameras is to isolate them on a VLAN that has no route out. Just connect one NIC of your DVR solution to that VLAN, and broker all access thru the DVR. Only view cameras via the DVR software. You really shouldn't be putting your security footage into the cloud anyway, IMO. It creates too many unneeded dependencies in this age of cheap LAN/CPU/HD space. Replicating that footage into the cloud is defensible, but that should still all be moderated via the DVR solution. A UPS and Cellular internet connection could make cloud options more resilient. Please correct me if I am unaware of some awesome way of doing this!