IP Camera and CCTV Security Guide: Hardening Enterprise Cameras, NVRs and Video Management Systems

Enterprise IP cameras and network video recorders are some of the most exploited devices on corporate networks, yet they are usually installed by facilities teams and integrators outside security's view. The CISA Known Exploited Vulnerabilities catalogue lists flaws in cameras and NVRs from more than half a dozen manufacturers, and botnets have recruited such devices for years. A compromised camera is a foothold inside the perimeter, a source of sensitive footage and a node in someone else's denial of service attack. This guide covers enterprise video surveillance: architecture choices, procurement restrictions, network design, device and VMS hardening, firmware lifecycle, monitoring and metrics. It is for security architects, network teams and physical security managers responsible for sites with tens to thousands of cameras. Home devices are covered in the Securing Home Cameras Guide.

Key takeaways

• Treat video as its own zone. Cameras, NVRs and the video management system (VMS) belong on dedicated segments with no inbound internet access and narrowly defined paths to users.
• Exploitation is routine, not theoretical. KEV entries cover Hikvision, Dahua, Reolink, NUUO, QNAP VioStor, PTZOptics, Amcrest and Edimax devices; patch or retire anything on that list.
• Procurement rules apply. US federal contractors face FAR 52.204-25 (Section 889) and UK government sensitive sites face the November 2022 Cabinet Office instruction; check before buying or renewing.
• Accounts are the weak point. Default passwords, shared integrator logins and ONVIF or VMS service accounts with admin rights cause most compromises; manage them as non-human identities.
• Plan for end of life. Cameras outlive their firmware support; KEV advises discontinuing some end-of-life models outright.

Why enterprise video systems are targeted

Cameras are small Linux devices with web servers, streaming services and often weak authentication, installed in bulk and rarely updated. The table lists camera and NVR entries in the CISA KEV catalogue (offline copy checked 27 October 2026), which means CISA has evidence of exploitation in the wild.

• Botnet recruitment: Mirai-family botnets have long scanned for cameras and DVRs with default credentials or known flaws, then used them for denial of service (ATT&CK T1584.005 Compromise Infrastructure: Botnet; T1498 Network Denial of Service). See the Mirai and IoT Botnet Families Guide.
• Network foothold: a camera on a flat corporate network is an unmonitored host from which attackers can scan and pivot (T1190 Exploit Public-Facing Application, T1046 Network Service Discovery).
• Footage and privacy: live and recorded video of offices, entrances and screens is sensitive personal data and a reconnaissance source for physical intrusion.
• Cloud and management planes: a compromised cloud video account or VMS admin can see and control every site at once.

Choosing an architecture

Decision guidance: choose cloud-managed when you cannot staff patching of recorders and servers, and then put most of your effort into the supplier assessment, SSO and admin roles. Choose on-premises when sites need to run without internet, when footage may not leave the country or the site, or when the cameras protect critical infrastructure. Whichever you choose, require that devices make only outbound connections to named destinations. See the Third-Party Risk Management Guide.

Procurement and supply chain restrictions

• United States, federal contracts: FAR 52.204-25 implements Section 889 of the John S. McCain NDAA for FY2019. Covered equipment includes video surveillance equipment produced by Hytera, Hikvision and Dahua (and subsidiaries and affiliates) when used for public safety, security of government facilities, physical security surveillance of critical infrastructure or other national security purposes. Paragraph (b)(1), effective 13 August 2019, bars agencies from procuring such equipment as a substantial or essential component; paragraph (b)(2), effective 13 August 2020, bars contracts with entities that use it, even unrelated to the contract.
• United States, FCC Covered List: the same three companies' video surveillance and telecommunications equipment was added on 12 March 2021 with the same purpose qualifier, under the Secure and Trusted Communications Networks Act of 2019.
• United Kingdom, government sensitive sites: a Cabinet Office written statement of 24 November 2022 (HCWS386) told departments to cease deploying surveillance equipment made by companies subject to China's National Intelligence Law onto sensitive sites, not to connect such equipment to departmental core networks, and to consider removing it ahead of scheduled upgrades.
• Everyone: whatever the jurisdiction, ask suppliers for a vulnerability disclosure policy, a published support period per model, signed firmware, a software bill of materials and the location of any cloud processing. See the OT Product Procurement Guide and the SBOM Guide.

These rules are summarised for orientation only; check the current text with your legal and procurement teams before relying on them.

Network design for video

1. Separate segments: put cameras on their own VLANs per site, with recorders and VMS servers in a separate video server zone. Clients reach video only through the VMS, not directly to cameras. See the Network Segmentation Guide.
2. Port authentication: enable IEEE 802.1X (EAP-TLS with device certificates) on switch ports where cameras support it, and MAC-based fallback with alerts where they do not.
3. No inbound internet: remove port forwards and disable UPnP on routers and devices. Remote viewing goes through the VMS behind SSO and MFA or through the cloud platform, never by exposing camera web interfaces.
4. Deny by default egress: cameras may talk only to recorders, NTP, syslog and, for cloud models, the named supplier endpoints. Block P2P relay services you did not choose.
5. Restrict management: camera web and SSH management only from a management jump host.

Hardening cameras, recorders and the VMS

Supplier hardening guides are the authoritative source for each product. The Axis OS hardening guide is a useful example of what to look for: it separates default protections, basic hardening on the device, extended hardening that needs PKI and network support, and legacy settings for older firmware.

• Credentials: devices that refuse to operate until an admin password is set (the Axis default) remove the factory password problem. Use unique per-device admin passwords from a vault, a separate low-privilege account for the VMS or ONVIF client, and central authentication (OAuth 2.0 or directory) where supported.
• Encryption and identity: HTTPS only, with certificates from your PKI or a manufacturer device identity certificate (IEEE 802.1AR); certificate-based 802.1X.
• Least functionality: disable Bonjour, UPnP, ZeroConf, WS-Discovery, SSH, audio, SD card and unused streaming profiles. Note that disabling LLDP can affect PoE negotiation on some switches; test first.
• Firmware integrity: require signed firmware and secure boot, and hardware key storage (TPM 2.0, secure element or TEE) where available.
• Time and logs: synchronise to internal NTP (NTS where supported) so footage timestamps hold up as evidence, and send logs to remote syslog.
• Host firewall: device-level IP filtering or firewall limited to recorders and management hosts.
• Video integrity: where evidence quality matters, look for signed video. ONVIF lists a Media Signing Add-on and a TLS Configuration Add-on alongside its profiles (S, G, T, M and others; Profile Q was deprecated on 1 April 2022).
• VMS servers: treat them as tier-one servers: patched OS, EDR, application allowlisting, SSO with MFA for operators, role-based camera permissions and audit of export and playback actions.

Where identity fits

A video estate carries many non-human identities: VMS service accounts that log into every camera, ONVIF client accounts, cloud connector tokens, integration API keys for access control and analytics, and integrator remote support accounts. A single shared camera password reused across a site turns one leaked credential into full control of every device. Inventory these accounts, scope each to the minimum role, vault and rotate them, and remove integrator accounts at the end of each engagement. See the Device and IoT Identity Guide and the API Key Management Guide.

Firmware lifecycle and end of life

• Inventory with versions: model, firmware, serial, location, segment and support end date for every camera and recorder. Most VMS platforms can export this.
• Subscribe to advisories: manufacturer PSIRT feeds and CISA KEV. Treat KEV-listed models as emergency work.
• Update in rings: one camera per model, then one site, then the estate; confirm recording continues and VMS integration still works.
• Retire unsupported devices: for CVE-2025-1316 CISA notes the Edimax IC-7100 may be end of life and advises discontinuing use. Budget replacement cycles to match support periods. See the IoT Secure Firmware Update Guide.

Privacy and data handling

Video of people is personal data. The UK ICO's video surveillance guidance says surveillance should be lawful, necessary and proportionate, and flags higher risk from AI analytics, automatic number plate recognition and facial recognition; the ICO notes the guidance is under review following the Data (Use and Access) Act. Security controls that support privacy duties: role-based access to live and recorded video, logging of every export, encryption of recordings at rest and in transit, defined retention enforced by the recorder, and contracts covering any cloud processor. See the UK GDPR and Data Protection Act 2018 Guide.

Implementing a programme

1. Discover: find every camera and recorder with network discovery and switch data, including devices installed by facilities and tenants. Check external exposure.
2. Contain first: remove internet exposure and port forwards, change default and shared passwords, and isolate KEV-listed models.
3. Segment: move devices to video VLANs with deny-by-default rules; pilot at one site and confirm recording and viewing still work before rolling out.
4. Harden by model: build a baseline per model from the supplier hardening guide, apply through the VMS or device management tool, and keep the previous configuration for rollback.
5. Bring identity under control: vault device credentials, move operators to SSO with MFA, and replace shared integrator logins with named, time-limited access.
6. Set the lifecycle: firmware rings, advisory monitoring and a replacement plan for unsupported devices.
7. Write it into procurement: security requirements in every new installation and integrator contract.

Small and large estates: a single office with a handful of cameras can achieve most of this with a dedicated VLAN, unique passwords, no port forwards and a reputable cloud-managed service. Large estates need a VMS-led configuration baseline, 802.1X, central logging and a named owner shared by physical security and IT.

Detection and measurement

• Monitor: outbound connections from camera segments to anything other than allowed destinations, scanning or lateral traffic originating from cameras, failed and successful logins to device web interfaces, configuration and firmware changes, VMS export and playback logs, and cameras going offline unexpectedly.
• Alert on: new devices on camera VLANs, devices reverting to factory settings, and traffic to known P2P relay services.

1. Percentage of cameras and recorders in inventory with current firmware version and support end date.
2. Number of video devices reachable from the internet (target zero).
3. Number of KEV-listed video devices still in service without isolation.
4. Percentage of devices with unique, vaulted admin credentials.
5. Percentage of devices on segmented video VLANs with deny-by-default egress.
6. Median days from manufacturer firmware release to estate-wide deployment.

Framework mapping

Common failure patterns

• Integrator-installed and forgotten: cameras commissioned with one shared password and a port forward for remote support, then never touched by IT.
• Flat networks: cameras on the user VLAN where any compromised laptop can reach them and any compromised camera can reach laptops.
• Cloud admin without MFA: the VSaaS or VMS console protected by a password alone, giving access to every site's footage.
• Consumer devices in enterprise sites: cheap P2P cameras bought locally that rely on unknown relay services and lose support within a few years.
• Firmware frozen at installation: no advisory monitoring, so KEV-listed flaws stay open for years. Default and hard-coded credentials recur across device types: the HPE Aruba Instant On hard-coded credentials case involved admin credentials built into access point firmware, fixable only by a firmware update.
• Procurement blind spots: restricted brands arriving through OEM rebadging or as part of a wider building system.

Practitioner checklist

• Inventory every camera, recorder and VMS server with model, firmware and support end date.
• Confirm no video device or interface is reachable from the internet.
• Isolate or replace every KEV-listed and end-of-life model.
• Place video on dedicated segments with deny-by-default rules and access through the VMS only.
• Set unique, vaulted credentials per device and low-privilege accounts for the VMS and ONVIF.
• Apply supplier hardening baselines: HTTPS only, discovery protocols and SSH off, signed firmware, NTP and syslog.
• Require SSO and MFA for VMS and cloud video consoles, with role-based camera permissions.
• Check procurement against FAR 52.204-25, the FCC Covered List and UK government guidance where they apply.
• Log video exports and monitor camera segments for unexpected traffic.

Standards and references

• CISA: Known Exploited Vulnerabilities Catalog
• US GSA: FAR 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
• FCC: List of Equipment and Services Covered by Section 2 of the Secure Networks Act
• UK Parliament: Written statement HCWS386, Security considerations relating to surveillance equipment
• ONVIF: Profiles
• ICO: Video surveillance (including guidance for organisations using CCTV)
• Axis Communications: AXIS OS Hardening Guide
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: IoT Security Guide · Physical Security Guide for Security Teams · Physical Access Control Systems Security Guide · Enterprise IoT Security Programme Guide · Securing Home Cameras Guide