CCTV and Video Management System Security Assessments

Footage is information. It shows who entered a facility, when, with whom, and what they did. On a sensitive site, it can reveal the layout of secure areas, the movement of personnel, the operation of controls, and the identity of people whose identity is meant to be protected.

That means a video management system is not simply a camera network. It is a system holding a large volume of sensitive, and often personal, information. It should be governed accordingly. In most organisations, it is not.

The same pattern applies here as elsewhere in physical security. These systems were once standalone, so they were treated as building systems. Today they are networked, integrated, and frequently sit on or adjacent to the corporate network, but the way they are managed has not caught up. They are patched less, monitored less and reviewed less than any corporate system holding comparable information.

Cameras are the part most often overlooked. An organisation may have hundreds of them, each one a networked device running firmware, and in many cases that firmware has not been updated since the day the system was commissioned.

A camera is an endpoint. It has an operating system, a network interface, credentials and a management interface. Treated as a fixture rather than a device, it can quietly become the least protected thing on the network, and the easiest way onto it.

• No vulnerability scanning of the camera or VMS environment, ever
• Camera firmware never updated after commissioning
• Video management and recording servers running old, unsupported versions with no patching regime
• Operating system patches not applied to VMS or recording servers
• Guard and operator workstations sharing a single login, so no action can be attributed to a person
• No multi factor authentication and no identity management across the platform
• Remote access via a weak VPN configuration, commonly a pre shared key with absent or unsuitable encryption for the tunnel
• No process to review access, and no process to revoke it when someone no longer needs it
• Manufacturer hardening guidance published, but never applied
• Camera networks flat, unsegmented and unmonitored
• Footage export with no approval, no logging and no oversight
• Retention periods that reflect available storage rather than any actual requirement

Individually these look like operational shortcuts. Together they usually mean the video system is neither secure nor reliably able to produce the footage it was installed to capture.

Beyond assessing what is deployed, our consultants provide advice on the architecture itself.

Many video environments were not designed so much as accumulated, expanded site by site and camera by camera over years, without an overall design holding it together. We identify the gaps in that architecture, including segmentation, remote access, identity, storage and resilience, and advise on a target design that is defensible and workable.

We are independent of the manufacturers and work across the platforms in common use in Australia, including Milestone, Avigilon and Geutebrück, as well as other video management systems.

Our assessments apply the same standards regardless of platform, drawing on the manufacturer's published hardening guidance alongside the ISM and ACSC guidance.

Our consultants work in the physical security systems space specifically, and understand these platforms in depth. That matters, because a control applied without understanding the system will break the operation, and a control that breaks the operation gets reversed.

A camera network that has been secured but no longer records reliably has not been improved. Our objective is a system that is genuinely defensible and still does the job it was installed to do.

Government agencies, Defence organisations, government suppliers and critical infrastructure operators, particularly where footage captures sensitive areas, sensitive activity, or people whose identity requires protection.