Rudie Opperman, Engineering and Training Manager EMEA at Axis Communications explains how organisations in the Middle East can safeguard surveillance devices from cyberattacks
Business leaders in the Middle East are aware of the importance of securing their digital infrastructure and resources. According to the IDC, IT security spending in the Middle East and Africa (MEA) region is expected to reach $7.7 billion in 2026 – representing a CAGR of 7.8% over four years – with security software accounting for the largest share of spending this year.
Cybersecurity concerns extend through an organisation and out among its stakeholders and supply chains. It also covers video surveillance, which remains a critical component of any organisation’s physical security and asset protection strategy. Thanks to advancements in network video and connected technologies, video surveillance is smarter than ever. Those advancements come at the same time the region’s physical security is also growing, thanks to an increase in construction activity, smart city projects, and commercial facilities.
However, it also now faces greater risks, which is why enterprises need to commit to best practices and make sure their surveillance networks, data, and devices remain protected from any potential vulnerabilities, and threat actors seeking to exploit them.
From analogue to digital, to connected
Physical security used to be a relatively straightforward process: point a CCTV camera at the thing you want to secure and monitor the feed from a centralised location. Devices stored little to no information and were not connected to any greater network. This all changed during the digital revolution in the 1990s with the advent of the Axis NetEye 200 – the world’s first internet protocol camera capable of transmitting footage wirelessly over a computer network.
From there, video surveillance has only grown in technical complexity and functionality. Camera manufacturers have increased their products’ processing capabilities, effectively creating a whole solution at the edge of the network capable of gathering, analysing, and storing data at the point of capture. This yields several benefits, including the ability to place edge solutions in locations that may be logistically challenging or lacking adequate infrastructure, and reduced labour installation and associated costs.
The trade-off of this innovation has been that cameras are no longer passive devices but active components of greater organisational IT ecosystems. As a result, like any connected technology, they can be a point of attack for threat actors.
The perils of cyberspace
The integration of physical security and video surveillance into greater IT networks has resulted in the sector being a potential backdoor for cyberattacks. According to Check Point Research, the first two months of 2023 saw a 41% increase in the average number of weekly attacks per organisation targeting IoT devices, compared to the same period in 2022. In addition, on average, 54% of organisations suffer from attempted cyberattacks targeting IoT devices every week.
Video surveillance devices can suffer from several cyber vulnerabilities. For example, an organisation’s IT and physical security teams may not always be aligned, meaning that there is a failure to adhere to critical shared security policies and guidelines. Security systems may also not be as well maintained or cared for as other systems, resulting in them being more susceptible to intrusions.
The risk of these vulnerabilities is measured according to two factors: the probability of a vulnerability being exploited, and the impact that that exploitation may have on the rest of the system. Threat actors are getting smarter and have access to advanced technologies such as artificial intelligence (AI) to develop malware and phishing-based strategies, a trend that is gaining traction in the Middle East. Organisations need to take these threats seriously and they can do that by adhering to effective best practices when protecting their networks.
Resiliency, efficiency, and performance
Video surveillance networks can range from a single pair of devices to an expansive network made up of dozens, if not hundreds or thousands, of interconnected devices.
Administrators can face a mammoth task in reinforcing the resiliency of those networks, and need access to the right knowledge and tools to maintain efficiency and meet security standards and obligations. Organisations can take the following steps to ensure the resiliency of their video surveillance devices and networks:
Keep a complete device inventory: Instead of just prioritising critical assets, organisations should retain clear documentation and information about all devices connected to their networks. Effective device management also means organisations can efficiently troubleshoot or replace devices that may be discontinued by their manufacturer, or no longer receive software support.
Establish a user account and password policy: Device login details and passwords are commonly shared throughout an organisation, which may result in deliberate or accidental misuse. The solution is to create a multi-layered system of accounts with varying levels of user privilege, as well as use temporary accounts to grant temporary access as required.
Utilise cost-efficient HTTPS management: Video systems may be subject to regulations regarding traffic encryption between clients, which is an important tool for network resiliency. Device management software that manages certificates and HTTPS configuration can both reduce costs and ensure a trusted connection.
Awareness and mitigation: Organisations must adopt a continuous learning and improvement mentality when it comes to cybersecurity readiness, as well as enshrine a culture of security across their personnel and departments. In addition, they must work with vendors and supply chain partners that have a proven cyber maturity record.
These steps form part of a holistic approach to taking care of your devices. As more enterprises in the Middle East leverage the power of video surveillance to secure and improve their business functions, and protect their facilities and resources, they must also consider the security implications of digital devices.
