2024.09.25. The Fair Economy — Synology recently presented four system security elements for preventing surveillance video leaks. These elements are intended to help companies and institutions self-diagnose the security of their surveillance systems, covering security video system devices, security systems, connectivity, and access security.
Concerns over the security of foreign-made video surveillance devices in the public sector have been growing recently, as the military has removed Chinese-made security video cameras.
Earlier, in March of last year, the National Intelligence Service (NIS) required public institutions to adopt video surveillance devices, such as IP cameras, that have confirmed security performance, such as the TTA's security performance quality certification for public institutions, when introducing such devices. At the time, the NIS announced that vulnerabilities had been found in Chinese Hikvision CCTV products and HiSilicon chipsets.
Seok Mi-eun, Senior Sales Manager for Korea at Synology, emphasized, "Not only the military but also public institutions and many companies are concerned about data leaks due to security vulnerabilities in surveillance equipment and systems. Based on Synology's experience of deploying video surveillance systems to hundreds of thousands of customers worldwide, we recommend that institutions conduct security checks considering their unique security risks and the extent of potential damage. It is important to thoroughly check the security of surveillance systems step by step, from selecting cameras with NDAA/TAA certification to system security that can threaten IT infrastructure, transmission security that determines whether files leak, and data safety of recorded files."
The first step in securing video surveillance system security is to "select safe and certified video surveillance equipment."
Manager Seok noted that if an organization is concerned about data leaks due to malware installed on cameras, it should choose products compliant with NDAA/TAA standards. NDAA/TAA-compliant products meet the U.S. federal government's procurement standards and security requirements. All of Synology's video surveillance cameras comply with NDAA/TAA security standards, making them an optimal choice for video surveillance service providers and security system integrators.
The next step is to "check the security of systems and equipment."
First, check whether the VMS (Video Management System) or the manufacturer of each device maintains a certain update frequency, whether continuous costs are incurred for new versions or technical support, and whether newly discovered security vulnerabilities can be resolved quickly.
In Synology's case, it operates an internal Product Security Incident Response Team (PSIRT) to actively handle various CVE vulnerabilities. Reports of zero-day attacks are processed within 24 hours to respond to constantly emerging security threats. Additionally, administrators should keep systems up to date through regular updates to resolve security vulnerabilities and prepare for such attacks.
When choosing video surveillance data management options, selecting a provider that offers data encryption protection can further secure surveillance data. Synology's VMS system provides two-factor authentication, requiring approval from another person for one individual to operate sensitive functions, and only allowing videos to be viewed if the correct encryption key is entered. Without the encryption key, even if a video is received in the file system, it cannot be decrypted or viewed.
Next, one must "check the security of the path accessing data on the recording server," whether transmitted from network cameras to the recording server or accessed from user clients. When purchasing cameras and VMS systems, one should verify support for HTTPS encryption and the Secure Real-time Transport Protocol (SRTP) to protect important data from theft.
Finally, to prevent damage to confidential data in the event of a leak, one can "inspect whether the system provides protection features for the video data itself." For example, using a watermark function allows tracking the source even if a leak occurs.
Manager Seok recommends that if there is no professional IT management staff, organizations should look for a vendor with a high security reputation that provides a complete solution to ensure the security of the video surveillance system. The conclusion is that even without a professional IT manager, the safety of the video surveillance system can be ensured through regular security maintenance and technical support provided by the vendor.
0 Comments
No comments yet.