2 ms·

I spent over a decade working on security cameras and various NVR related applications. Hard wired cameras are more secure, BUT, if someone can get access to yo

I spent over a decade working on security cameras and various NVR related applications. Hard wired cameras are more secure, BUT, if someone can get access to your network cable, it's not hard to inject packets and DOS out most UDP-based cameras. Most large sites put their cameras on segregated networks, so it might not even be obvious to folks for a while.

amluto 3y ago
I consider this to be an embarrassing property of modern networking. A network switch that tracks and enforces the mapping between addresses and ports, blocks spoofed packets, ensures fair allocation of DHCP leases, and enforces fair allocation of bandwidth out to be available out of the box from any credible vendor. None of this is conceptually difficult, and all the building blocks are available in somewhat standardized form. But for some reason, port security is an exotic enterprise-y set of features rather than something one can deploy out of the box. Or an NVR deployment could use 802.1BR to isolate all the cameras. I’m a firm believer in endpoint security — endpoints should not need to trust the network for authentication or authorization when communicating with each other. But the network really ought to be able to do its job despite attacks by rogue endpoints or someone compromising a single piece of network infrastructure, and the network’s job is to maintain reliable connectivity.
- eschneider 3y ago
  802.1BR would certainly help in that situation, but it adds management overhead. A large deployment of IP cameras brings with it a fair amount of IT overhead and the capabilities of most corporate IT departments (let alone the 'security department') can be challenged by even basic setups. I've spent a lot of time handling support for big camera deploys and I was surprised by the number of customers who would bring their systems down by misconfiguring their own networks.
- MisterTea 3y ago
  > I’m a firm believer in endpoint security — endpoints should not need to trust the network It's called Ethernet for a reason. You fling packets into the ether and hope they come out the other end. What happens in the ether is anyone's guess.
adql 3y ago
They are also often on switch with single uplink to the recorder so if cameras are connected with 1gig you could just flood recorder itself, downing every camera connected to it.

amluto 3y ago

I consider this to be an embarrassing property of modern networking. A network switch that tracks and enforces the mapping between addresses and ports, blocks spoofed packets, ensures fair allocation of DHCP leases, and enforces fair allocation of bandwidth out to be available out of the box from any credible vendor. None of this is conceptually difficult, and all the building blocks are available in somewhat standardized form. But for some reason, port security is an exotic enterprise-y set of features rather than something one can deploy out of the box. Or an NVR deployment could use 802.1BR to isolate all the cameras. I’m a firm believer in endpoint security — endpoints should not need to trust the network for authentication or authorization when communicating with each other. But the network really ought to be able to do its job despite attacks by rogue endpoints or someone compromising a single piece of network infrastructure, and the network’s job is to maintain reliable connectivity.

eschneider 3y ago
802.1BR would certainly help in that situation, but it adds management overhead. A large deployment of IP cameras brings with it a fair amount of IT overhead and the capabilities of most corporate IT departments (let alone the 'security department') can be challenged by even basic setups. I've spent a lot of time handling support for big camera deploys and I was surprised by the number of customers who would bring their systems down by misconfiguring their own networks.
MisterTea 3y ago
> I’m a firm believer in endpoint security — endpoints should not need to trust the network It's called Ethernet for a reason. You fling packets into the ether and hope they come out the other end. What happens in the ether is anyone's guess.

adql 3y ago

They are also often on switch with single uplink to the recorder so if cameras are connected with 1gig you could just flood recorder itself, downing every camera connected to it.