attachment_2_bid_2877_24.pdf

IP Camera Configuration Guide

Interim guidance: April 2, 2019

Table of Contents

1. Introduction 3

1.1 Security cameras in a network environment 3

1.2 Limit Internet exposure 3

1.3 Limit local network exposure 3

2. About the protection levels 4

3. Default protection 4

4. Standard protection 5

4.1 Factory default settings 5

4.2 Use latest firmware 5

4.3 Set master password 5

4.4 Create a video client account 5

4.5 Configure network settings 6

4.6 Set time and date 6

4.7 Disable audio 6

4.8 Edge Storage Encryption 6

5. Enterprise protection 7

5.1 Open ports 7

5.2 HTTP digest authentication 7

5.3 Domain and host name 7

5.4 Disable unused services 8

5.4.1 FTP server 8

5.4.2 SSH – Secure Shell 8

5.4.3 ARP/Ping setting of IP address 8

5.4.4 AXIS Device Dispatcher – AVHS 8

5.4.5 Network discovery protocols 9

5.4.6 SOCKS 9

5.4.7 Always multicast video 9

5.4.8 QoS - Quality Of Service 9

5.5 IP address filter (IP tables) 9

5.6 HTTPS Encryption 10

6. Managed enterprise protection 10

6.1 IEEE 802.1X network access control 10

6.2 SNMP monitoring 10

6.3 Remote System Log 11

1. Introduction Organizations should strive to apply cybersecurity best practices in the employment of IP cameras to minimize the risk of flaws that could be exploited in an attack. However, securing a network, its devices, and the services it supports requires active participation by the entire vendor supply chain, as well as the end-user organization. A secure environment depends on its users, processes, and technology.

The guide provides technical advice for anyone involved in deploying IP camera solutions. It establishes a baseline configuration as well as a hardening guide that deals with the evolving threat landscape.

You may need the product’s User Manual to learn how to configure specific settings.

1.1 Security cameras in a network environment

The most apparent threats to a network camera are physical sabotage, vandalism and tampering. To protect the product from these threats, it is important to select a vandal-resistant model or casing, to mount it in the recommended way, and to protect the cables.

From an IT/network perspective, the camera is a network endpoint similar to business laptops, desktops and mobile devices. Unlike a business laptop, a network camera is not exposed to the common threat of users visiting potentially harmful websites, opening malicious email attachments, or installing untrusted applications. However, the camera is a network device with an interface that may expose the system to risks. This guide focuses on reducing the exposure area of these risks.

1.2 Limit Internet exposure

It is not recommended to expose the camera as a public web server, allowing unknown clients to get network access to the camera. For Individuals and small organizations that do not operate a VMS (Video Management System) and need to access video from remote locations. Large organizations using a VMS should consult the VMS vendor for remote video access.

1.3 Limit local network exposure

In a VMS environment, the clients will always access live and recorded video through the VMS server.

Placing the VMS server and cameras on an isolated network, through physical or virtual isolation, is a common and recommended measure to reduce exposure and risks.

2. About the protection levels This guide uses different protection levels depending on system size and needs. Each level assumes that the previous level’s recommendations are followed.

Protection level Recommended for Procedures

0 Default protection

1 Standard

2 Enterprise

3 Managed enterprise protection

Only recommended for demo purposes and test scenarios.

Minimum recommended level of protection. This level is adequate for small businesses or office installations where, typically, the operator is also the administrator.

Recommended settings for corporations that have a dedicated system administrator.

Large network infrastructure with an IT/IS department. For environments where cameras may need to be integrated into an enterprise network infrastructure.

N/A

> Factory default settings > Use latest firmware > Set the master password > Create a video client account > Configure network settings > Set time and date > Disable audio when applicable > Edge Storage Encryption

> HTTP digest authentication > Domain and host name > Disable unused services > IP Address filter > HTTPS Encryption

> IEEE 802.1X Network Access

Control > SNMP monitoring > Remote system log

3. Default protection Cameras are delivered with predefined default settings and a default password. It is not recommended to use these settings for daily operations.

4. Standard protection The standard protection level is the minimum recommended level of protection. This level is adequate for small businesses and small organizations where, typically, the operator is also the administrator.

4.1 Factory default settings

Before starting, make sure that the product is in a known factory default state.

4.2 Update to the latest firmware

When new vulnerabilities are discovered, most are either not critical or are very costly to exploit.

Occasionally a critical vulnerability is discovered, and device, computer, and systems services need to be patched. Patching software and firmware is an important process of cybersecurity. An attacker will often try to exploit common (known) vulnerabilities, and if they gain network access to an unpatched service, they may succeed. Make sure you always use the latest firmware because it may include security patches for known vulnerabilities. The release notes for a specific firmware may explicitly mention a critical security fix but not all the general ones.

4.3 Set master password

The password is the most important means of protection for a network camera. Make sure to use a strong password and keep it protected. On a multi-camera installation, the cameras can have the same password or unique passwords. Using the same password simplifies management but increases the risk if one camera’s security is compromised.

Create a hard-to-guess password of at least 8 characters, preferably using a password generator.

4.4 Create a video client account

The default root account has full privileges and should be reserved for administrative tasks. It is recommended to create a client user account with limited privileges for daily operation. This reduces the exposure of the administrator password.

A Video Management System (VMS) should normally use the Operator privileges group but may in some cases require administrator privileges. Check with the VMS vendor.

4.5 Configure network settings

The device IP configuration depends on the network configuration, such as IPv4/IPv6, static or dynamic (DHCP) network address, subnet mask and default router.

4.6 Set time and date

From a security perspective, it is important that the date and time are correct so that, for example, the system logs are time-stamped with the right information.

It is recommended that the camera clock be synchronized with a Network Time Protocol (NTP) server.

For individuals and small organizations that do not have a local NTP server, a public NTP server may be used. Check with your Internet service provider or use a public NTP server such as pool.ntp.org.

4.7 Disable audio

Audio is enabled by default in camera models that support it. Audio will typically have a higher data classification compared to video due to privacy and integrity. It is recommended to check local regulations before allowing audio streaming.

4.8 Edge Storage Encryption

If the camera has support for SD Card and video is recorded to this storage device, it is recommended to apply encryption. This will prevent unauthorized individuals that may have removed the SD card to play the stored video. If a Network Attached Storage (NAS) is used as a recording device, it should be protected in a locked area and its accounts/credentials need to be properly configured.

5. Enterprise protection For medium and large organizations that deploy a professional video surveillance system, it is recommended to use a Video Management System (VMS) software or NVR. The enterprise protection level involves minimizing risks by reducing the possible attack area of the network camera. It is important to follow the VMS manufacturers’ cybersecurity recommendations.

Some of the settings described in this section are already preset at the factory. Make sure that they are correct by following the instructions below.

5.1 Open ports

For reference, the cameras may have the following open ports pre-configuration.

Port Service

TCP-21 FTP Server

TCP-80 HTTP Server

TCP-554 RTSP Server

TCP-49152 UPnP (Discovery Protocol)

TCP-1900 UPnP Simple Service Discovery Protocol (SSDP)

UDP-3702 Web Service Dynamic Discovery

UDP-4815 Bonjour Discovery Protocol (mDNS)

UDP-57143 Bonjour (mDNSResponderPosix)

5.2 HTTP digest authentication

In order to prevent clients from sending login passwords in clear text over the network, it is recommended to allow only digest authentication (encrypted passwords).

5.3 Domain and host name

If your network infrastructure has support for local Domain Name System (DNS), it is recommended that cameras are accessed using a Fully Qualified Domain Name (FQDN) instead of its IP address.

This makes it easier to manage and keep track of cameras.

5.4 Disable unused services

Unused or unnecessary services should be disabled on the IP cameras to reduce security risks. Below are examples of services that should be disabled if not needed:

5.4.1 Disable FTP server

The FTP server is default enabled and typically used for advanced maintenance and troubleshooting. The FTP server should be disabled after camera deployment.

Note that later camera firmware may have this service disabled by default, but we recommend that you check the setting.

5.4.2 Disable SSH – Secure Shell

SSH command line interface is disabled by default. SSH can be helpful for advanced maintenance and troubleshooting, but during normal operations SSH should be disabled. We recommend making sure that it is.

5.4.3 Disable ARP/Ping setting of IP address

ARP/Ping is a legacy service that allows an administrator to set a static IP address using a command line terminal to send an ARP/Ping command combination. The service is only available for two minutes after the camera has been restarted. This service has been removed in later firmware, but if you have older firmware, it is recommended that you disable the service completely.

5.4.4 Disable Network discovery protocols

Discovery protocols are support services that make it easier to find the camera and its services on the network. After deployment, once the camera device IP address is known and the camera is added to the VMS, it is recommended that you disable the discovery protocol to stop the camera from announcing its presence on the network.

> UPnP (Universal Plug and Play) > Bonjour > Link-local address (Zero Conf)

5.4.5 Disable SOCKS

SOCKS is disabled by default and used only for specific purposes, to allow the camera to reach network services (e.g. HTTP or FTP image upload) on the other side of a firewall/proxy server.

5.4.6 Disable Always multicast video

Always multicast video is disabled by default. The service is used for specific environments to broadcast video on the local network without clients requesting multicast video.

5.4.7 Disable QoS - Quality Of Service

If the network infrastructure does not support QoS, turn it off.

5.5 Enable IP address filter (IP tables)

Enabling IP filtering only for authorized clients will prevent the camera from responding to network traffic from any other clients. Make sure to add all authorized clients (VMS server and administrative clients) to the white list.

5.6 Enable HTTPS Encryption

HTTPS encrypts the traffic between the client and the camera. It is recommended to use HTTPS for all administrative tasks on the camera. Note that enabling HTTPS will not automatically encrypt video sent over RTP/RTSP. If video is classified as restricted and needs to be protected with encryption, the video client needs to request RTP/RTSP video tunneled over HTTPS. This is controlled by (and depends on) the video client/VMS capabilities.

A self-signed certificate is adequate for providing encryption but will not protect from man-in-the-middle-attack. Clients (e.g., web browsers) will warn that the certificate is not trusted.

A CA-signed certificate (private or public CA) is needed for the client to authenticate that it is accessing the correct camera and thereby mitigate the risk of an attacking computer impersonating a camera.

6. Managed enterprise protection

Managed enterprise networks are systems that typically have additional management tools and services that the cameras need to be aligned with.

6.1 IEEE 802.1X network access control

To be accepted in a network infrastructure that is protected by IEEE 802.1X, the cameras need to have appropriate certificates and settings.

6.2 SNMP monitoring

cameras support the following SNMP protocols:

> SNMP v1: Supported only for legacy reasons and should not be used.

> SNMP v2c: May be used on a protected network segment.

> SNMP v3: Recommended for monitoring purposes.

6.3 Enable Remote System Logging

A syslog server collects all the log messages generated by all cameras. This simplifies audits and prevents log messages from being destructed in the camera either intentionally/maliciously or unintentionally (by a camera reboot overwrite caused by the max log size being reached).

5.5 Enable IP address filter (IP tables)