Why do unmanaged cameras complicate identity and access governance?

Why This Matters for Security Teams

Unmanaged cameras are not just passive hardware. They are networked devices with credentials, remote administration paths, firmware, and often vendor or integrator access that sit outside normal identity ownership. That makes them a governance problem as much as an endpoint problem. When the organisation cannot answer who created the account, who rotates the secret, and who revokes access at end of life, identity control becomes an orphaned risk. The pattern is consistent with the broader NHI problem described in Ultimate Guide to NHIs and the control expectations in NIST Cybersecurity Framework 2.0.

Security teams often underestimate cameras because they look low risk compared with servers or SaaS accounts. In practice, a camera can become a foothold into flat networks, a source of persistent weak credentials, or a path for lateral movement when shared accounts and default passwords remain in place. NHI Management Group’s research notes that only 5.7% of organisations have full visibility into their service accounts, which is a useful warning sign for device identities too. The issue is not the camera itself, but the absence of lifecycle stewardship around its identity. In practice, many security teams encounter camera compromise only after the device has already been used as a quiet internal access point, rather than through intentional asset governance.

How It Works in Practice

Identity and access governance for cameras works best when the device is treated as a managed workload, not a “set and forget” asset. Current guidance suggests every camera should have a named owner, a unique identity, a documented credential source, and a revocation path at retirement. The practical control set is similar to other NHI programs: unique secrets, short rotation intervals, vault-backed storage, access logging, and periodic attestation. The OWASP Non-Human Identity Top 10 and Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs both reinforce the same operational point: identity without lifecycle control becomes a permanent exposure.

• Assign each camera to an accountable system owner, not just a facilities vendor or installer.
• Replace default passwords and shared accounts with unique device credentials wherever the platform supports it.
• Store secrets in a managed vault and rotate them on a fixed schedule, or immediately after maintenance events.
• Separate camera networks from business systems so identity failure does not become broad access failure.
• Log administrative access, remote support sessions, and firmware updates as identity events.
• Retire credentials when a camera is decommissioned, transferred, or replaced.

Where this becomes more complex is in mixed estates. Legacy cameras, building systems, and managed security services may not support strong authentication or per-device credentials, so teams often need compensating controls such as segmentation, jump hosts, and time-bound vendor access. NHI lifecycle gaps are especially visible in environments with outsourced facilities operations, because ownership and technical administration are split across teams that do not share the same access review process. These controls tend to break down when legacy camera platforms only support shared admin logins because the organisation cannot enforce per-device identity or reliable revocation.

Common Variations and Edge Cases

Tighter camera governance often increases operational overhead, requiring organisations to balance stronger identity control against installation, maintenance, and vendor support constraints. That tradeoff is especially sharp in physical security environments, where uptime and response speed matter and some vendors still depend on shared service accounts. Best practice is evolving, but there is no universal standard for this yet: some environments can move quickly to unique device identity and vault-backed secrets, while others need staged remediation around the riskiest sites first. The NHI Management Group guidance in Top 10 NHI Issues and NHI Lifecycle Management Guide is useful here because it frames remediation as lifecycle work, not just password hygiene.

Edge cases matter. Cameras with cloud management portals may introduce third-party identity dependencies, while cameras used in regulated areas may require stricter audit retention and approval workflows. In some environments, disabling remote access entirely is the safest answer; in others, access must remain but should be time-bound and brokered through privileged access management. The important governance question is not whether the camera is “smart,” but whether its identity is owned, reviewed, and revoked like any other production credential. Where facilities, security, and IT each assume someone else owns the camera, the control model fails quietly until an audit, outage, or intrusion makes the gap visible.

Related resources from NHI Mgmt Group

• Why does identity matter more when vulnerabilities are discovered faster than they can be patched?
• What is the difference between prompt injection risk and identity abuse in agents?
• Why do non-human identities increase identity blast radius?
• What is the difference between identity governance and ITSM for access control?