Security Cameras on the Business Network: The Watchers Need Watching

Here’s an irony worth sitting with: the security cameras — installed to protect the business — are frequently the least secure devices on its network. IP cameras and their recorders are computers: they run software, listen on the network, and ship from factories with a documented history of default passwords, unpatched firmware, and phone-home behavior. Compromised cameras have starred in some of the internet’s largest botnets, and inside a business network, a hijacked camera is a foothold with a view — literally. The fixes are standard IT hygiene applied to devices nobody thinks of as IT. Here’s the short list.

Rule one: cameras live in their own room

The single most important control is segmentation: cameras and their recorder (NVR) on their own network segment, walled off from the computers, servers, and everything that matters. The logic is the same as the shop floor’s — these are devices you can’t fully trust and often can’t fully patch, so the design assumes one might turn hostile and limits what hostile can reach. A camera VLAN needs to talk to the NVR and (maybe) the internet for remote viewing; it has no business reaching the accounting server, and on a segmented network, it can’t. This also contains the reverse direction: ransomware on the office network can’t reach the recorder and delete the footage of its own arrival.

Rule two: the defaults are the vulnerability

The camera-security incidents that make news share one root cause with numbing regularity: default credentials, never changed — admin/admin on a device listening to the network, sometimes to the whole internet. The hygiene pass: every camera and the NVR gets a unique strong password in the password manager · firmware updated at installation and then on a schedule — camera vendors patch real vulnerabilities that real scanners exploit, and “we’ve never updated the cameras” is the norm at businesses that patch everything else; put them on the exception-managed list with an annual firmware day · and anything reachable from the internet gets the full scrutiny: no camera or NVR should be directly exposed with port forwarding (the classic install shortcut, and an open door scanners find in hours) — remote viewing goes through the vendor’s authenticated cloud relay or a proper remote-access path, with MFA where offered.

The recording question: cloud, local, or both

Where footage lives is a real decision with trade-offs worth making consciously. Local NVR: no subscription, full control, works through internet outages — and the recorder is a single point of failure that a burglar can steal or an intruder can wipe, which is partly why it lives on the segmented network. Cloud recording: survives theft and tampering, accessible anywhere, patched by the vendor — for a monthly fee, dependent on upload bandwidth, and subject to the vendor-diligence questions: where’s the footage stored, who can access it, what’s the retention? The pragmatic pattern for most businesses is hybrid — local recording for depth, cloud for the critical views — with retention set deliberately either way: footage is data with privacy and records implications, and “keep everything forever” is neither necessary nor always wise.

The vendor and the lifecycle

Camera systems arrive via installers, and installer access is vendor access with all the usual rules: no permanent remote connection left over from the install, named credentials rather than a shared account, access enabled for service visits and disabled after. And cameras join the asset inventory like everything else with an IP address — model, location, firmware date, password rotated — because the camera nobody remembers is the camera nobody patched, and unknown devices are where problems live undisturbed.

The bottom line

Treat the camera system like what it is — a fleet of small computers with lenses: segmented onto its own network, purged of default passwords, firmware-patched on a schedule, never directly exposed to the internet, recording per a deliberate retention choice, and installer access governed like any vendor’s. An afternoon of hygiene, and the devices watching the building stop being the way into it.