Security

GSX 2023: 5 Ways to Safeguard Physical Security Systems from Cyberattacks

Next-generation surveillance systems rely on network connections to operate. Here’s how businesses can keep them safe.

Twitter

Rebecca Torchia is a web editor for EdTech: Focus on K–12. Previously, she has produced podcasts and written for several publications in Maryland, Washington, D.C., and her hometown of Pittsburgh.

Securing a network is a lot like securing a building, said Michael Bendis, an associate partner at Syska Hennessy Group, in a Tuesday Global Security Exchange 2023 presentation. This is especially true when it comes to networked physical security systems, such as next-generation surveillance cameras.

Access control is the most important aspect in both scenarios, Bendis explained in his session, “Protecting Physical Security Systems from Cyber Attacks.” Just as there are many ways someone can enter a building, there are many ways someone can enter a network. Instead of doors or windows, however, the portals to a network are devices.

In Dallas for this year’s GSX conference, attendees listened closely as Bendis described the importance of protecting physical security systems from attack.

Click the banner below to become an Insider and gain exclusive insights after GSX 2023.

He noted that the biggest difference between securing a physical location and an online space is scale: “When you get to the network — following this analogy — imagine that anybody in the world can magically appear at your door and check it. That’s what happens in a network. Anyone in the world can see an internet-connected device, and they can check it for vulnerabilities.”

Having underscored the importance of shoring up network protections, Bendis then shared with the crowd how to keep these systems secure.

1. Audit the Cybersecurity Protections of the Manufacturer

Every security company should have a cybersecurity program, so Bendis advised listeners to first make sure their security technology company has one.

When investing in new solutions, businesses should check for several things: cyber protections in the security company’s supply chain to ensure all the individual parts are secure; standard protections, such as an inability to use default passwords; programs to identify and update against known vulnerabilities; and good communication.

EXPLORE: How to surmount hybrid cloud’s biggest security challenges.

2. Hire Qualified Teams to Install and Configure Security Systems

People who install physical security systems are doing work beyond that of an electrician. They’re configuring devices, setting up networks and coordinating with IT teams, Bendis said. Tech is also being delivered in “no-trust mode,” he added, a different configuration than the old days of plug-and-play.

“The reason plug-and-play would work is because the configuration would be so open that it would accommodate all the different scenarios to connect that device. So, even if you’re using the device to communicate with your network one way, other paths were still open for hackers to get in,” he said.

With zero trust, the device won’t communicate with anything until it’s programmed the right way by the organization using it.

3. Physically Secure Devices on the Building's Exterior

Make sure surveillance cameras, intercom systems and other physical security technologies can’t be removed from the exterior of a building using a single screwdriver, Bendis said.

This not only would allow attackers to disable security systems but also would give them access to the network cables within the hardware.

Instead, either install tamper switches that can notify security teams, physically secure connections or put external devices on fiber so criminals can’t use them to access the network.

4. Manage Security Tech Through Careful Tracking and Communication

Business and security leaders need to keep an inventory of all devices. “You need every make, model, camera, firmware version, software version, the Windows version of your servers — a listing of every device that’s on the network. That will go a long way if a vulnerability is identified,” Bendis said.

There should also be communication with the manufacturer so that, if it identifies a vulnerability, it can contact any business using its products. If vulnerabilities are found, updates and patches close those gaps. Businesses should have a process for installing updates quickly and effectively.

5. Coordinate with the Corporate Tech Department

Because most devices are on a corporate network, there needs to be communication with the IT department, Bendis advised. Follow the IT department’s security requirements, which may include:

Digitally segregating the security system on its own virtual LAN
MAC filtering via devices’ IP addresses
Routing configurations that restrict cameras’ access to servers
System monitoring

Businesses Need Immutable Cloud Storage for Video Files

In a session Monday titled “Using Immutable Storage to Protect Surveillance Video from Ransomware,” Drew Schlussel, senior director of technical product marketing for Wasabi Technologies, spoke on the importance of protecting video surveillance files.

“Every year, the resolution doubles,” Schlussel said, talking about surveillance video quality. “So, your capacity requirements are doubling almost every two to three years.”

Businesses need somewhere to store their data and backup files that is safe and that can expand in capacity to meet their needs.

Schlussel emphasized the importance of having unaltered video surveillance files if needed for lawsuits. With modern artificial intelligence capabilities, businesses need to be aware of deep fakes, or video files that are altered to change a narrative. “In theory, you could take an existing video surveillance asset and modify it,” Schlussel said. This is why organizations need immutable storage, he argued.

Immutable storage systems preserve the state of the data as it is written into that system. “If you have evidence you need to retain for one, three, five or seven years, object lock will ensure that nobody can change it or delete it until the timer runs out,” he said.

Keep this page bookmarked to stay up to date with GSX 2023 coverage, and follow us on X (formerly Twitter) at @BizTechMagazine or use the event hashtag, #GSX2023.

Photography by Rebecca Torchia, Courtesy of GSX