Cybersecurity hardening

Securing cameras, network and VMS: credentials, firmware, encryption, segmentation, supply chain and monitoring.

Cameras and controllers are network computers mounted in public places. An unhardened camera is a foothold into the network and a privacy risk. Treat physical security systems like any other IT system, and use the manufacturers' hardening guides (Axis OS Hardening Guide, Genetec Security Center Hardening Guide) as your baseline.

Cameras and devices

• Change default credentials before connecting devices to the production network; use unique, strong passwords stored in a vault, and separate admin and VMS service accounts.
• Keep firmware current using the manufacturer's LTS or active track, and subscribe to their security advisories.
• Disable unused services and protocols (e.g. UPnP, Bonjour, FTP, Telnet, SSH if not needed, unencrypted HTTP).
• Use HTTPS with certificates from the organisation's CA; enable 802.1X where the network supports it.
• Set NTP from a trusted internal source and configure syslog to a central collector.
• Use hardware security features where available, such as secure boot, signed firmware and a secure keystore (Axis calls this Axis Edge Vault).
• Use signed video where supported so exported evidence can be verified as unaltered.

Network

• Isolate cameras and controllers on dedicated VLANs with ACLs; no direct internet access unless a specific cloud service requires it, and then only to documented destinations.
• Never port-forward cameras or NVRs to the internet. Use the VMS's secure remote access, a VPN, or vendor cloud services designed for it.
• Lock down switch ports (802.1X or port security, disable unused ports, alert on link changes).
• Monitor for new or unknown devices on video VLANs.

VMS (Security Center example)

• Follow the Security Center Hardening Guide's basic and advanced steps; Genetec provides a security score widget to track compliance.
• Least privilege: start from the privilege templates (Operator, Investigator, Supervisor…) and remove what each user does not need; use partitions to limit which entities users can see.
• Integrate users with Active Directory / Entra ID and enforce MFA where supported; disable or rename default admin accounts as the guide recommends.
• Deactivate unused roles to reduce the attack surface.
• Enable secure communication: Media Router secure communication uses RTSP over TLS for the control channel. To encrypt the video data itself, set camera encryption to In transit from Archiver or In transit and at rest. Playback and export use RTSP over TCP and are encrypted when encryption is on.
• Keep Windows, SQL Server and Security Center patched; back up the Directory database and configuration.

Supply chain and compliance

• In the US, Section 889 of the FY2019 National Defense Authorization Act (implemented in FAR 52.204-25) prohibits federal agencies and contractors from using covered telecommunications and video surveillance equipment from Huawei, ZTE, Hytera, Hikvision and Dahua (and their subsidiaries/affiliates). The FCC Covered List also names video surveillance and telecom equipment from these companies; the FCC no longer grants new equipment authorizations for covered equipment and in 2026 moved to prohibit further import and marketing of previously authorized covered equipment. Check the current list before every project.
• Many state, local, education and private customers have adopted similar policies. Ask about procurement restrictions early in discovery.
• Request the manufacturer's vulnerability disclosure policy, software bill of materials (SBOM) if available, and product lifecycle/end-of-support dates.
• Check for third-party security certifications relevant to the customer (e.g. FIPS 140 validated modules, UL 2900 series, ISO/IEC 27001 for cloud services).

Operate it

1. InventoryEvery device with model, firmware, IP, MAC and location; automate with VMS reports or device management tools.
2. Patch cadenceQuarterly firmware review at minimum; emergency process for critical advisories.
3. MonitorSyslog/SIEM integration, health monitoring for offline cameras, failed logins and configuration changes.
4. Review accessQuarterly review of VMS users, privileges and remote access.
5. TestPeriodic vulnerability scans of video VLANs, coordinated so they do not disrupt recording.