4 ms·

Seriously folks... put all those cameras behind firewalls, and only grant access to them over a VPN.

by m-p-3 8y ago

dchest 8y ago
Next: "Zero-Day Bug in VPN Software Allows Hackers to Access CCTV Surveillance Cameras"
- mmt 8y ago
  That would only be a headline if the VPN software were somehow camera-specific, which seems unlikely. That fact alone is a benefit to using general-purpose security tools: more eyes on it, making a zero-day that much less likely (and a fix that much faster). Another benefit is that updating a single instance of firewall or VPN software is much easier than updating dozens of cameras. Of course, if there are more VPN clients than cameras, that ceases to be true. Adding such a layer is also just a kind of defense-in-depth. With the instant example, both the cameras and the VPN software (or firewall) would have to have vulnerabilities, at the same time.
markovbot 8y ago
Put the cameras behind firewalls, only allow access to them from the NVR, and only on the port(s) the NVR needs. No reason the entire internal network should have direct access to them.
xoa 8y ago
It’s not a bad idea to stick them on their own VLAN as well, with access exclusively to the NVR and/or specific management devices. Their only purpose is to feed video back to specific systems, why let anything else touch them at all?
- bonestamp2 8y ago
  Agreed, all my IoT stuff has its own separate network with its own access point.
  - xoa 8y ago
    If you've got more mid-range network gear you might consider setting up a simple RADIUS system and switching to 802.1x auth (with just a basic guest portal or something for visitors) and per-port VLAN control as necessary. Makes it very convenient to segment out and isolate IoT, video, and VoIP into their own independent segments, best practice not just for security but performance and functionality as well. While it takes a bit more setting up it's also interesting and adds safety and versatility over time, plus you don't need any extra gear or cable. Worth a bit of consideration anyway if you have time and/or enjoy that sort of thing, along with a decent local VPN setup. The latter should also become even better over the next few years as WireGuard support spreads.

Seriously folks... put all those cameras behind firewalls, and only grant access to them over a VPN.

by m-p-3 8y ago

Seriously folks... put all those cameras behind firewalls, and only grant access to them over a VPN.

dchest 8y ago

Next: "Zero-Day Bug in VPN Software Allows Hackers to Access CCTV Surveillance Cameras"

mmt 8y ago
That would only be a headline if the VPN software were somehow camera-specific, which seems unlikely. That fact alone is a benefit to using general-purpose security tools: more eyes on it, making a zero-day that much less likely (and a fix that much faster). Another benefit is that updating a single instance of firewall or VPN software is much easier than updating dozens of cameras. Of course, if there are more VPN clients than cameras, that ceases to be true. Adding such a layer is also just a kind of defense-in-depth. With the instant example, both the cameras and the VPN software (or firewall) would have to have vulnerabilities, at the same time.

markovbot 8y ago

Put the cameras behind firewalls, only allow access to them from the NVR, and only on the port(s) the NVR needs. No reason the entire internal network should have direct access to them.

xoa 8y ago

It’s not a bad idea to stick them on their own VLAN as well, with access exclusively to the NVR and/or specific management devices. Their only purpose is to feed video back to specific systems, why let anything else touch them at all?

bonestamp2 8y ago
Agreed, all my IoT stuff has its own separate network with its own access point.
- xoa 8y ago
  If you've got more mid-range network gear you might consider setting up a simple RADIUS system and switching to 802.1x auth (with just a basic guest portal or something for visitors) and per-port VLAN control as necessary. Makes it very convenient to segment out and isolate IoT, video, and VoIP into their own independent segments, best practice not just for security but performance and functionality as well. While it takes a bit more setting up it's also interesting and adds safety and versatility over time, plus you don't need any extra gear or cable. Worth a bit of consideration anyway if you have time and/or enjoy that sort of thing, along with a decent local VPN setup. The latter should also become even better over the next few years as WireGuard support spreads.