Cameras are often installed for deterrence and then forgotten, so when an incident happens the footage is missing, unsynchronised or impossible to find, and the system meant to detect intruders has become another unmonitored network device. MITRE D3FEND names the countermeasure Video Surveillance (D3-VS), synonyms "CCTV Surveillance" and "Video Monitoring", and defines it as "Monitoring of physical areas via camera video feeds to deter, detect, and investigate unauthorized access and related security events." It sits under the Detect tactic as a child of Physical Access Monitoring. This card treats D3-VS as a detection source for the security operations team: what D3FEND says about it, its thin ATT&CK relationship, how to tie video to access control and log events, how to verify it works, and its limits. Camera and recorder hardening is covered separately in the IP Camera and CCTV Security Guide, which this page does not repeat.
Key takeaways
- D3FEND's guidance is operational, not just physical. Its article covers event-driven recording, time synchronisation with other logs, health and tamper monitoring, and secure export for investigations.
- The ATT&CK link is one inferred row. D3FEND relates D3-VS to Video Capture (T1125) only because both involve the Digital Camera artefact; a CCTV system does not detect webcam spying.
- Video is most useful when triggered by other events. An access denial, a door forced alarm or a sensor alarm should bookmark the matching footage automatically, so analysts start from the event, not from hours of recording.
- Clock drift breaks investigations. If camera, recorder, access control and SIEM clocks disagree, footage cannot be matched to log events with confidence.
- A camera that is offline or obstructed is a silent failure. Heartbeat and tamper alerts, plus a scheduled walk test, are part of the control.
D3-VS at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-VS (d3f:VideoSurveillance) |
| Tactic | Detect |
| Parent technique | Physical Access Monitoring |
| Synonyms | CCTV Surveillance, Video Monitoring |
| Digital artefact | Digital Camera (D3FEND relation: monitors), defined by D3FEND as an optical instrument that captures images in digital memory |
| D3FEND references | US DHS CCTV Technology Handbook, NIST SP 800-53 Rev 5, ONVIF Profile S |
| Typical components | IP cameras, video management system (VMS) or network video recorder (NVR), video analytics, integration with physical access control and the SIEM |
| Effort | Medium to high: capital cost, storage, privacy assessment and ongoing health monitoring |
| Main limitation | Sees only physical areas in view; detects nothing in cyberspace on its own |
How it works
D3FEND's article describes the mechanism in five parts, which double as a design checklist.
- Capture and stream: digital cameras stream to a VMS or NVR for live monitoring, recording and retrieval.
- Record continuously or on events: recording can be continuous or event-driven, triggered by analytics such as motion in regions of interest or line crossing, or by external triggers such as access denials and sensor alarms.
- Synchronise time: time synchronisation aligns video with other logs, which is what makes footage usable alongside access control and SIEM events.
- Monitor health: health monitoring detects camera outages and tamper.
- Export securely: export workflows preserve integrity for investigations.
Interoperability between cameras and VMS products is usually through ONVIF profiles. D3FEND cites Profile S, which covers video streaming and configuration for IP video systems. As checked in November 2026, the ONVIF Profile S page states "Profile deprecation in process; last date of product conformance submissions is March 31, 2027." ONVIF Profile T covers H.264 and H.265 streaming, HTTPS streaming and motion and tampering detection events, which are the events this card relies on. Confirm which profiles your devices and VMS are conformant to before relying on cross-vendor event integration.
Event sources that should trigger or bookmark video
| Event | Source | What the analyst needs from video |
|---|---|---|
| Access denied, invalid or revoked badge | Physical access control system | Who presented the credential, and whether they then entered by another route |
| Door forced or held open | Door contacts via the access control system | Whether a person entered, and tailgating behind them |
| Motion or line crossing out of hours | Camera or VMS analytics, motion sensors | Confirmation of a real intrusion versus a false alarm |
| Rack or cage door opened, device unplugged | Electronic locks, sensors, network port down events | Who was at the equipment, matching the physical access to systems in PE-6(4) |
| Camera offline, view obstructed or moved | VMS health and tamper events | Last good frames and who was nearby before the outage |
Sibling countermeasures supply several of these triggers: D3-ELM Electronic Lock Monitoring, D3-MSM Motion Sensor Monitoring and D3-PSM Proximity Sensor Monitoring.
Where identity fits
Cameras, recorders and the VMS are non-human identities on the network: each has an administrative account, often service accounts for the VMS to pull streams, and integration credentials for the access control system and SIEM. D3FEND's own considerations call for unique credentials, timely firmware updates, encrypted transport and network segmentation. Treat those device and integration accounts like any other machine credential, with an owner, rotation and no shared defaults. Footage of people is also personal data, so operator access to it is an identity governance question in its own right.
ATT&CK techniques D3FEND relates to D3-VS
Relationship type: inferred only. D3FEND lists one related offensive technique, labelled "inferred and experimental" (checked November 2026). Each ID was checked against ATT&CK v20.
| ATT&CK ID | Technique | Relation via artefact | Practical reading |
|---|---|---|---|
| T1125 | Video Capture (Collection) | D3-VS monitors Digital Camera; T1125 accesses Digital Camera | The shared artefact is the camera. Video surveillance does not detect an adversary recording through a laptop webcam. The defensible reading is the reverse: surveillance cameras are themselves cameras an adversary can access, so protecting and monitoring the VMS reduces the chance that your own feeds become a collection source |
ATT&CK notes that T1125 cannot easily be mitigated with preventive controls because it abuses legitimate system features, and describes endpoint detections such as unexpected processes opening camera devices. Those belong to endpoint monitoring, covered in the MITRE ATT&CK T1125 Video Capture guide. The real threats D3-VS addresses, such as tailgating, forced entry and unauthorised access to equipment rooms, sit outside Enterprise ATT&CK; see the Physical Security Guide for Security Teams.
Choosing an approach
| Approach | Strength | Trade-off | Fits when |
|---|---|---|---|
| Continuous recording, reviewed after incidents | Nothing is missed in view | Large storage; footage is rarely looked at until it is needed | Small sites and a few critical areas |
| Event-driven recording and bookmarks | Analysts go straight to relevant clips | Depends on trigger reliability; set pre-event buffers | Sites with an access control system and alarms |
| Live monitoring by operators | Real-time response | Staffing cost; attention fades on idle screens | Staffed security control rooms |
| Integrated with SIEM and incident response | Physical and cyber events correlated in one timeline | Integration and time sync work; privacy controls on who can view | Data centres, regulated sites and converged security teams |
Smaller organisations often get most value from a few cameras on entry points and the equipment room, event bookmarks from the access control system, and a short documented retention period. Larger estates add central health monitoring and SIEM correlation. The convergence model is discussed in Physical and cyber security convergence.
Implementation steps
- Define what must be seen. List entry points, equipment rooms, racks and cages. For each, record the purpose (deter, detect or investigate) and the event that should trigger a bookmark.
- Assess privacy before installing. Under the GDPR, the EDPB's Guidelines 3/2019 say a DPIA is required for systematic monitoring of a publicly accessible area on a large scale (Art. 35(3)(c)) and advise checking the supervisory authority's DPIA list. In the UK, the ICO's video surveillance guidance applies; as checked in November 2026 the ICO marks it as under review following the Data (Use and Access) Act.
- Set retention from purpose. The EDPB guidelines say footage should in most cases be erased, ideally automatically, after a few days, and that retention beyond 72 hours needs more justification. Size storage for the retention you can justify, not the maximum the recorder holds.
- Synchronise clocks. Point cameras, recorders, the VMS and the access control system at the same internal time source as the SIEM, and alert on drift. See the NTP Security Guide.
- Integrate events. Send access control alarms to the VMS to create bookmarks, and send VMS health, tamper and operator audit events to the SIEM.
- Lock down operator access. Role-based access to live and recorded footage, export limited to named roles, and operator actions recorded and reviewed, as the EDPB guidelines recommend.
- Pilot one site. Run for a month, tune analytics regions to cut false motion alarms, then roll out. Keep previous VMS rule and analytics configuration exported so a bad change can be reverted.
How to verify it works
- Walk test: on a schedule, badge a test card at a monitored door, trigger a denial and walk the camera's view. Confirm the bookmark exists, the timestamps match the access control log to within your drift tolerance, and the person is identifiable at the intended level.
- Tamper test: briefly cover or disconnect a camera in a maintenance window and confirm the health or tamper alert reaches the SIEM or control room.
- Retrieval drill: ask an investigator to find and export footage for a given event. Time it, and confirm the export carries integrity information and is logged. Evidence handling is covered in the Evidence Handling and Chain of Custody Guide.
- Retention check: confirm footage older than the documented period has actually been deleted, and that recent footage is present for every camera.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | Why it matters |
|---|---|---|
| Cameras online and recording | 99% or better, with every outage alerted | An offline camera is a blind spot |
| Clock drift between VMS and SIEM | Within one second | Footage must match log events |
| Access alarms with a matching video bookmark | All alarms on covered doors | Proves the integration works |
| Time to retrieve footage for an event | Under 15 minutes | Investigations start fast |
| Walk and tamper tests passed | 100% per quarter | Shows detection, not just recording |
Limits, bypasses and failure patterns
- Coverage gaps: poor placement, occlusion and difficult lighting leave entry points unseen. D3FEND's considerations call this out first.
- Footage without context: recording everything but bookmarking nothing makes footage practically unsearchable during an incident.
- Silent outages: cameras that fail, are moved or are obstructed without a health alert leave a blind spot that is only found after an incident.
- Clock drift: unsynchronised devices make timeline reconstruction unreliable, and the evidential value of footage falls with it.
- The surveillance system as an attack path: an exposed or unpatched VMS can let an outsider view feeds or pivot into the network. Segment it and manage its credentials as non-human identities.
- Over-retention and over-access: keeping footage longer than the purpose justifies, or letting too many people view it, creates privacy risk without detection benefit.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-6 Monitoring Physical Access; PE-6(1) Intrusion Alarms and Surveillance Equipment | PE-6(1) calls for monitoring physical access to the facility using intrusion alarms and surveillance equipment |
| NIST SP 800-53 Rev 5 | PE-6(4) Monitoring Physical Access to Systems | Monitoring access to the system itself, not only the facility |
| NIST SP 800-53 Rev 5 | AU-8 Time Stamps | Consistent time across video and audit records |
| NIST CSF 2.0 | DE.CM-02 | The physical environment is monitored to find potentially adverse events |
| GDPR | Art. 25, Art. 32, Art. 35(3)(c), as applied in EDPB Guidelines 3/2019 | Privacy by design, security of processing and DPIA for large-scale monitoring of public areas |
| MITRE D3FEND | Physical Access Monitoring, D3-VS | Parent and technique |
The PE control family is explained in NIST SP 800-53 PE Physical and Environmental Protection.
Practitioner checklist
- Document the purpose and trigger event for every camera covering a security area.
- Complete a DPIA or privacy assessment before installation where the law requires one.
- Set and enforce a retention period you can justify, with automatic deletion.
- Synchronise all video and access control clocks with the SIEM time source and alert on drift.
- Bookmark footage automatically from access control and sensor alarms.
- Send camera health, tamper and operator audit events to the SIEM.
- Give each camera, recorder and integration account a unique, owned credential.
- Restrict live view and export to named roles and review operator activity.
- Run walk, tamper and retrieval tests on a schedule and record the results.
Standards and references
- MITRE D3FEND: Video Surveillance (D3-VS)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE-6)
- EDPB: Guidelines 3/2019 on processing of personal data through video devices
- ICO: Guidance on video surveillance (including CCTV)
- ONVIF: Profile S
- ONVIF: Profile T
- MITRE ATT&CK: T1125 Video Capture
Related NHI Mgmt Group resources: IP Camera and CCTV Security Guide · Physical Access Control Systems Security Guide · Physical Intrusion Response Playbook · MITRE D3FEND Guide