Security cameras are supposed to protect a business. But a camera is also a small computer that stays connected to your network day and night, and most owners never think about it again once it is mounted. If the cameras share a network with the computers that hold your accounting files, customer records and email, a weak camera can become the easiest way into everything else.
This is not a theoretical worry. Internet-connected cameras and video recorders have been taken over in large numbers before. The best-known case is the Mirai botnet in 2016, which spread largely through cameras and recorders that still used factory default passwords. The good news is that the fixes are mostly simple, and many cost nothing but an afternoon.
How a camera system becomes a back door
The same few problems show up in business camera systems again and again:
- Default or shared passwords. The recorder still uses the password it shipped with, or every employee logs in with the same account.
- Old firmware. Camera and recorder makers release updates that fix security flaws, but nobody installs them.
- Open ports for remote viewing. To let the owner watch from a phone, someone set up "port forwarding" on the router, which leaves the recorder reachable by anyone on the internet who finds it.
- One flat network. Cameras, office computers, the credit card terminal and guest Wi-Fi all sit on the same network, so anything that gets into one device can reach the others.
- Forgotten access. A former employee or a previous installer still has a login.
Five ways to close the door
1. Change every default password
Give the recorder and each camera a unique, strong password, and give each person who needs access their own account instead of a shared one. If the system supports two-step sign-in, turn it on. This single step closes off one of the most common ways these systems get taken over.
2. Keep firmware up to date
Check the manufacturer's website for updates for your camera and recorder models, and put a reminder on the calendar to check again every few months. If the manufacturer has stopped releasing updates for your model, plan to replace it. Equipment that no longer gets security fixes only gets riskier with time.
3. Put the cameras on their own network
Your cameras do not need to talk to your accounting computer, and your accounting computer does not need to talk to your cameras. Separating them, usually with a VLAN (a virtual network that keeps groups of devices apart on the same switches) plus firewall rules that block traffic between the camera network and the office network, means a problem with a camera stays with the cameras. The firewall rules matter: on many routers, separate VLANs can still talk to each other until rules stop them. This is one of the most effective changes you can make, and it is far easier to build in when a system is installed than to add later.
Quick check: if your cameras get their network address from the same router as your office computers and you never set up anything special for them, they are almost certainly on the same network.
4. Stop exposing the recorder to the internet
If remote viewing works because a port was opened on your router, close it and use a safer method instead: a VPN that you connect to before viewing, or a well-maintained cloud service from a reputable manufacturer. Cloud-managed systems, such as Verkada, are designed so you can view cameras remotely without opening ports at all.
5. Review who has access
Once or twice a year, look at the list of accounts on the camera system and remove anyone who has left the company, changed roles or finished a project. Do the same for any outside company that installed or serviced the system.
Cloud-managed or a recorder in the closet?
Both can be secure. A traditional recorder (an NVR) keeps footage on site and gives you full control, but someone has to keep it updated and set up remote access safely. A cloud-managed system handles updates and remote access for you, which removes several of the problems above, though you are also trusting the vendor's own security, and you still need good passwords and a clean list of users. The right choice depends on your building, how many sites you have, how long you need to keep footage and how you prefer to pay. We install both, and we are happy to explain the tradeoffs for your situation.
A five-minute self-check
- Do you know the password to your camera system, and is it something other than what it shipped with?
- When was the last firmware update?
- How do you view your cameras away from the office, and did anyone open a port on the router to make that work?
- Are your cameras on a separate network from your office computers?
- Does anyone who no longer works with you still have a login?
If you are not sure about two or more of these, it is worth having someone look. Most of these fixes are quick, and finding out how your system is set up costs far less than cleaning up after someone else finds out first. You can read more about how we install and set up business camera systems on our security camera installation page.