Regardless of the industry they operate in, South African enterprises face significant cybersecurity challenges. Fortunately, enterprises appear to be waking up to that. According to the KPMG Africa Cyber Security Outlook, 34% of surveyed organisations have a fully independent cyber and information security function, with oversight through risk management and internal audit, while 47% have information security incorporated into IT security.

Cybersecurity concerns extend through the organisation and out among its stakeholders and supply chains. It also covers video surveillance, which remains a critical component of any organisation’s physical security and asset protection strategy. Thanks to advancements in network video and connected technologies, video surveillance is smarter than ever. However, it also now faces greater risks, which is why enterprises need to commit to best practices and make sure their surveillance networks, data, and devices remain protected from any potential vulnerabilities, and threat actors seeking to exploit them.

From analogue to digital, to connected

Physical security used to be a relatively straightforward process: point a CCTV camera at the thing you want to secure and monitor the feed from a centralised location. Devices stored little to no information and were not connected to any greater network. This all changed during the digital revolution in the 1990s with the advent of the Axis NetEye 200 – the world’s first internet protocol camera capable of transmitting footage wirelessly over a computer network.

From there, video surveillance has only grown in technical complexity and functionality. Camera manufacturers have increased their products’ processing capabilities, effectively creating a whole solution at the edge of the network capable of gathering, analysing, and storing data at the point of capture. This yields several benefits, including the ability to place edge solutions in locations that may be logistically challenging or lacking adequate infrastructure, and reduced labour installation and associated costs.

The trade-off of this innovation has been that cameras are no longer passive devices but active components of greater organisational IT ecosystems. As a result, like any connected technology, they can be a point of attack for malicious actors.

The perils of cyberspace

The integration of physical security and video surveillance into greater IT networks has resulted in the sector being a potential backdoor for cyberattacks. According to Check Point Research, the first two months of 2023 saw a 41% increase in the average number of weekly attacks per organisation targeting IoT devices, compared to the same period in 2022. In addition, on average, 54% of organisations suffer from attempted cyberattacks targeting IoT devices every week.

Video surveillance devices can suffer from several cyber vulnerabilities. For example, an organisation’s IT and physical security teams may not always be aligned, meaning that there is a failure to adhere to critical shared security policies and guidelines. Security systems may also not be as well maintained or cared for as other systems, resulting in them being more susceptible to intrusions by threat actors.

The risk of these vulnerabilities is measured according to two factors: the probability of a vulnerability being exploited, and the impact that that exploitation may have on the rest of the system. Threat actors are getting smarter and have access to advanced technologies such as artificial intelligence (AI) to develop malware and phishing-based strategies. Organisations need to take these threats seriously and they can do that by adhering to effective best practices when protecting their networks.

Resiliency, efficiency, and performance

Video surveillance networks can range from a single pair of devices to an expansive network made up of dozens, if not hundreds, of interconnected devices. Administrators can face a mammoth task in reinforcing the resiliency of those networks, and need access to the right knowledge and tools to maintain efficiency and meet security standards and obligations.

Organisations can take the following steps to ensure the resiliency of their video surveillance devices and networks:

Keep a complete device inventory: Instead of just prioritising critical assets, organisations should retain clear documentation and information about all devices connected to their networks. Effective device management also means organisations can efficiently troubleshoot or replace devices that may be discontinued by their manufacturer, or no longer receive software support.
Establish a user account and password policy: Device login details and passwords are commonly shared throughout an organisation, which may result in deliberate or accidental misuse. The solution is to create a multi-layered system of accounts with varying levels of user privilege, as well as use temporary accounts to grant temporary access as required.
Utilise cost-efficient HTTPS management: Video systems may be subject to regulations regarding traffic encryption between clients, which itself is an important tool for network resiliency. Device management software that manages certificates and HTTPS configuration can both reduce costs and ensure a trusted connection.
Awareness and mitigation: Organisations must adopt a continuous learning and improvement mentality when it comes to cybersecurity readiness, as well as enshrine a culture of security across their personnel and departments. In addition, they must work with vendors and supply chain partners that have a proven cyber maturity record.

These steps form part of a holistic approach to taking care of your devices. As more enterprises in South Africa leverage the power of video surveillance to secure and improve their business functions, they must also consider the security implications of digital devices.