Can Your Physical Security System Leak Private Data?

The endless and widespread announcements of new network security vulnerabilities raises serious data security and physical security concerns. In a commercial environment your security devices can contribute to that data leakage. As physical security technology progresses it increasingly has more data about you and your organization's habits and actions.

In the security control room of The Belagio Hotel in Oceans 11

In the security control room of The Belagio Hotel in Oceans 11

It is a cliche in heist movies -- The Hacker, Gadget Guy, or Mission Control Coordinator will hack into the targets security camera system turning the tables giving the heist crew all of the info and feeding the security guard misleading images. While heist movies are full of far fetched plots, and the simplicity that they present the CCTV takeover is somewhat far fetched, the reality is hackers anywhere on the internet can gain access to the cameras of many vulnerable organization. Once In they can manipulate cameras for the benefit of a heist or just turn all of your cameras and network devices into crypto currency miners or bandwidth eating DDoS attack bots. 

Less dramatic than a casino heist but far more frequent are hackers that are, mostly recreationally, accessing security cameras. The recent Mirai virus is an example where security cameras and servers are turned into bots taking direction from a hacker or hacker network. The Mirai malware is one of many leaving these networks and devices vulnerable.

The actions you can take a minimize your risk:

  1. Make your network security an integral aspect of any physical security roll out.
  2. Keep the firmware on firewalls and appliances (including security cameras, alarm panels, and iot devices) up to date at all times.
  3. Use well supported and business class of firewall. Open source is great if managed by knowledgeable engineers and the distribution is well supported with regular security patches.
  4. Do not open ports through your firewall; use VPN’s to access remote cameras or resources. Use modern and well accepted encryption on your devices. 
  5. Use 2-factor where a physical key (e.g., Yubikey) so that resources are restricted to users with the correct passphrase AND the correct physical key.

Related Resources

How Surveillance Cameras can Help Grow Retail Sales

If you own a retail business and utilize cameras only for security purposes, you’re missing out on their full potential to contribute to your company’s growth.

A number of technology companies are now using surveillance cameras — previously considered primarily as a way to deter or catch thieves — to help retail businesses learn about their customers’ shopping habits.

Video analytics, heat maps, and dynamic data can help companies perform A/B tests to see whether customers better respond to one campaign versus another. It allows retail firms to gather powerful data about customers without the need for surveys or other disruptive techniques.

How it works

MOBOTIX sells a security camera and analytics package that “can capture an entire room with no blind spots.”

The software captures the movement of people in the video image and then displays the results via heat map to allow business owners the areas that had the highest traffic. Companies will be able to see the most popular products or exhibition booths at a show, identify the most visited shelves in a store, or even show the patterns of how people enter or exit a particular location in the store.

This information can easily be presented in daily, weekly, or monthly reports for management.

Like MOBOTIX, other companies such as Prism and Prayas stress that video analysis is a better way to capture data without violating privacy rights of customers. An older method of gathering data had involved identifying and storing a unique identification code of a customer’s smartphone.

Instead, Prism CEO Steve Russell said his software doesn’t capture any identifying information about the customers; in fact, the video feed it presents back to businesses is completely void of humans. Instead the video analytics shows trends and the areas with the highest traffic.

Prayas Analytics, in the same vein, doesn’t include any facial recognition or personal identification functionality in its software to promote privacy.

Low cost to entry

The companies all try to make it easy for companies get started, all touting low costs to entry.

Prayas says that companies can keep their existing security system and only need to purchase access to the analytics software. Prayas can connect to the retail store’s surveillance cameras and get started immediately in analyzing its traffic patterns.

Prism also says its analytics software can overlay over existing video feed; they even say their high-quality imagery requires a low bandwidth of network in order to be successful.

Mobotix does require customers to purchase cameras. But the company argues that this can save money in the long run: Each camera includes its own high-speed computer with memory, preventing the need to have a computer or network server record, analyze, and store the information. All of the analysis power happens right in the camera, reducing the amount of network bandwidth the security system will need to use.

Upgrading your Analog Security Camera System

Various IP Cameras Installed by Urban Alarm

Various IP Cameras Installed by Urban Alarm

Of the more than 30,000 security cameras in Washington, D.C., many are analog cameras installed using older wiring. These cameras are no longer meeting the high-resolution image demands of 2016.

If you have a security system that relies on analog coaxial cable wiring, what's the best path forward?

There are two main options:

  1. Use a converter. Converters (like this one from Network Video Technologies) allow you to run IP (Internet protocol) over COAX and/or two conductor wires. 

    With this approach, you can:
    - Use higher resolution cameras with 3-5x the resolution of analog HD cameras. 
    - Zoom in on important information, without losing clarity.
    - Rely on a single cable for data and power for multiple cameras.

    The downside? The converter may be more expensive than the actual camera significantly increasing the per-camera costs.
  2. Add HD analog and phase in IP cameras. Keep your COAX cable and hook it up with HD resolution analog cameras. Over time, you can expand it to include IP cameras, as well. 

    While they don't have as high resolution as IP cameras, HD analog cameras can still hold their own. The cameras:

    - Offer good image quality.
    - Have minimal configuration requirements compared to IP cameras.
    - Can transmit video up to 1600' exceeding most network wire distances.
    - Work off network, so they won't take up bandwidth or clash with others resources.
    - Have zero latency.

    While HD analog cameras have recently been around half the cost of IP cameras, that difference is closing and and some IP cameras are more or less the same cost. Start off with HD analog cameras right away, and work in new IP cameras over time.

D.C. Government Now Offering Rebates for Private Security Cameras

Photo by V ictoria Pickering ; Creative Commons;  Flickr

Photo by Victoria Pickering; Creative Commons; Flickr

A new security camera rebate program is making it easier for D.C. residents to buy and install private security cameras.

Residents, businesses, and religious organizations in several D.C. wards can now apply for rebates to purchase and install security cameras on their buildings, as a part of the government’s  Private Security Camera Incentive Program.

The D.C. camera initiative will allow some owners and tenants to receive up to $200 per individual camera (there is a cap of $500 total per residence or $750 for commercial properties).

Offering security camera rebates is “another step to deter crime and assist police during investigations,” said Mayor Muriel Bowser in a statement. Police will be able to request video footage from camera owners to investigate crimes, but will not have access to live video feeds, the mayor’s office said.

In addition to capturing crime as it happens, the mere presence of video surveillance can deter intrusion altogether. Some systems also work like a motion detector to alert owners when something may be amiss.

The program will roll out first to applicants who live in these Police Service Areas (PSAs):

  • MPD First District: 104, 105, 107, 108
  • MPD Second District: 202, 207, 208
  • MPD Third District: 302, 303, 305
  • MPD Fourth District: 402, 403, 405, 409
  • MPD Fifth District: All PSAs
  • MPD 6th District: 602, 603, 604, 608
  • MPD 7th District: All PSAs

Applicants can identify their property’s PSA online. Only those in the priority PSAs can apply for now, but it will be opened up to anyone after August 1 — provided the program’s $500,000 budget has funding remaining.

Security cameras must be installed on the exterior of the building and need to meet minimum requirements — including 250 GB of storage for digital cameras (125 GB for analog) and 1280x720 screen resolution (640x480 for analog).

Recommended specifications are even higher. The ideal digital security camera will feature:

  • High video quality and at 15 frames per second
  • Camera resolution of 3 Megapixels
  • Screen resolution of 2048x1536 screen resolution
  • 2.5 TB of storage

The security cameras must have been purchased and set up after September 22, 2015. The property owner must also register the cameras with the Metropolitan Police Department in order to qualify for the rebate.

Qualified property owners or tenants can apply online for the rebate. The application requires:

  • Proof of purchase of the cameras
  • Proof of registration with MPD
  • Proof of installation
  • If the applicant is the tenant, proof that the property owner consents to the security cameras and rebate application

After the application is approved, it make take up to 45 days to process and send the rebate to the applicant.

Councilmember Charles Allen (Ward 6) authored the bill that ultimately led to the rebate program. He hopes the video surveillance will deter crime “by adding extra eyes on the street.”

Thermal Video Cameras are the future of video surveillance… and its really cool!

Thermal Video Cameras are the future of video surveillance… and its really cool!

Video surveillance cameras have come a long way in their ability to show meaningful images in low light. Infrared lights are a common feature of every the lowest priced cameras. Low light cameras can show a reasonable image in extremely low light conditions. But none of these come close to the images from a thermal camera and their effectiveness in video surveillance and outdoor intrusion detection.

Read More