Why Connected Cameras Deserve a Place in Every Cyber Risk Strategy

Australia’s shift from Chinese-made camera models

In 2023, the Australian government removed Chinese-made security cameras from federal buildings. This followed similar moves by the US and UK, motivated by digital security threats and political objections to the CCP. The action promoted a reexamination of how cameras, now equipped with remote surveillance and facial recognition tools, should be secured against international and domestic cyber threats.

Reports cited 60,000 cameras from two Chinese companies, of which over 900 were installed in government buildings. Their removal created demand for non-Chinese security cameras and discussions about how data flows, firmware control and software vulnerabilities can impact smart cameras as a whole.

Cyber threats to connected cameras

Digital risk mitigation strategies still commonly overlook cameras, despite their status as network-connected IoT devices. When treated solely as a facility-level tool, reports and governance miss potential entry points that attackers can exploit to spy, steal data or leverage access to adjacent systems.

Experts point to several key vulnerabilities in connected CCTV cameras:

• Weak, default and shared passwords
• A lack of multi-factor authentication
• No encryption on video streams or file metadata
• Lax update policies that allow known exploits to persist
• Low transparency in the development and maintenance of cameras
• Misconfiguration that leaves cameras open to public view
• Low lateral security that enables attackers to use cameras to access further internal networks

A third of all corporate IoT devices are outside IT control, and half of all connections to internal IT networks originate from high-risk source devices. These weaknesses make Cameras an attractive target not only for the data they capture but also for the additional access they provide. Their exploits, many of which remain unpatched for years, cement exactly why cyber risk strategy must evolve to incorporate connected cameras.

What to look for in connected cameras

Image quality and management systems guide much of the decision-making process for CCTV, but compliance with the Australian Privacy Act and broader GDPR requirements should always take priority. Intrusion causes significant reputational damage, but cameras and the data they gather fall clearly under privacy legislation, which opens companies to fines and further legal action.

Security leaders should consider options that include the following features and measures:

• End-to-end encryption that covers data in transit and at rest stops
• Multifactor identification, role-based access and zero-trust policies that limit how intruders gain access, and what actions they can execute
• Vendor-managed updates and patches
• Network segmentation that prohibits lateral movement across networks

No device is 100% safe. Sophisticated attackers use the same OSINT tools as security professionals to find registered vulnerabilities and devices that have yet to be patched. Removing Chinese-made cameras from federal buildings addressed concerns about international espionage, but their replacements are only as secure as cyber risk frameworks allow, and dedicated bad actors have myriad ways to stress-test systems to find entry points. Broader cyber strategies, such as firewall configurations to mitigate DDoS attacks and staff training on phishing practices, are undermined when widely exposed IoT devices are not taken into account.

Replacement cameras from vendors that value transparency and consistency in their update policies offer accountability to organisations. This should be paired with consistent storage and handling processes and ethical data use for optimal compliance.

Reframing cameras as cyber assets

IoT breach statistics alone prove how vulnerable endpoint connected cameras are. Rather than taking this as a sign to duct-tape lenses and return to in-person monitoring, see it as an opportunity to adapt your cyber risk strategy further. Encryption protects your sensitive data, continuous verification secures access and dedicated update policies prevent known, potentially catastrophic oversights from being weaponised against you.

Simply replacing a Chinese-made camera with a Western alternative does nothing but change who you’re expecting to attempt an attack. Shifting your perception of cameras entirely by incorporating them into your cybersecurity assessments puts these safety sentiments into practice, readying you for the upcoming surge in IoT devices that demand similar attention.