Keeping Bad Actors Out of K12s IP Surveillance System | EdTech Magazine
Keeping Bad Actors Out of K–12’s IP Surveillance System
Schools can utilize the extensive capabilities of networked cameras without the cybersecurity risks.
Eileen Belastock
by
Eileen Belastock
Twitter
Eileen Belastock is the director of technology and information at Nauset Public Schools in Massachusetts.
LISTEN
06:10
K–12 districts are investing a larger portion of their budgets in new security technologies to create safer environments for their school communities.
A 2020 study conducted by Omdia on behalf of the Security Industry Association showed the market for physical security equipment in K–12 and higher education was $716 million in 2020. The K–12 sector accounted for about 56 percent of that amount.
IP Cameras Have Benefits and Drawbacks
Before the introduction of IP video surveillance cameras in schools, physical and digital security were typically separate. Now, however, technology is intertwined with every aspect of school security.
As school districts upgrade their video security systems, some are moving away from closed-circuit TV cameras to more robust IP security systems. These network cameras have far more capabilities than traditional CCTV cameras, using network devices to integrate access control, communications, mass notifications, door locks and security cameras.
Unfortunately, along with the benefits of accessibility and ease of use, these highly sophisticated network video systems come with the constant threat of cyberattacks.
Click the banner to discover resources from CDW to help protect your district from cyberattacks.
K–12 security cdw
IP cameras are not dissimilar from other network devices exposed to attack scenarios. As districts transition to IP security systems, they face the same data breach risks. The systems are highly vulnerable and easy to hack, and they present a considerable surface area cybercriminals can use to access a district’s network.
In addition to common threats — malware, ransomware, distributed denial of service, man-in-the-middle and brute-force attacks — video cameras are susceptible to third-party eavesdropping. As recently as May 2021, Eastern Hancock County Community School Corp. in Indiana suffered a cyberattack on its camera system, resulting in a day of lost instruction.
Best Practices for Securing IP Cameras
Fortunately for Eastern Hancock Schools, no personally identifiable information was stored on its network, and thanks to regular backups, no data was lost from the attack. Yet, this remains an example of why district CTOs and data security officers must address the vulnerabilities of their IP security cameras. The goal is to prevent unauthorized access to the system that could compromise other devices in the network.
Here are several security strategies schools can implement to prevent or mitigate attacks on their IP camera systems:
Proactive steps include partnering with an Internet of Things solution provider to discover every IoT device connected to a district’s network and assess each device’s security risk. Districts should also invest in technology that integrates IoT security into a broader solution that protects the data center, network, mobile devices, endpoints and cloud assets.
Best practices for managing staff email passwords, guarding against phishing, protecting student data privacy and restricting access to school and district networks need to extend to IP cameras. Like other vulnerable access points, IT departments must enable multifactor authentication, limit access by IP address and create a video client account to reduce the risk of compromising the device administrator password.
Penetration tests are used by many districts to evaluate network security. These simulated attacks are often carried out by trusted third parties authorized by districts to attempt a breach of their systems. However, IP cameras are often overlooked as vulnerabilities. Schools should ensure that pen tests are performed on these IP devices, using the same tools, techniques and processes attackers would use to pinpoint weaknesses in the security system.
Software updates and patches must be installed, whether the district uses CCTV, IP cameras or a hybrid approach. Access to the latest software can prevent security holes within the camera systems. Most cloud-based IP systems automatically push out updates and patches. However, for on-premises storage, IT must be sure to choose a product that requires scheduled updates and patches.
Video data storage must be secured, either on-premises or in the cloud, to avoid data loss in the event of a breach. The cloud is ideal for backing up sensitive information saved on local servers. One of the cloud’s security advantages over on-premises servers and infrastructure is its ability to segment storage away from user workstations, where most attacks enter.
LEARN MORE: What is Backup as a Service, and how can it protect K–12 districts?
The principle of least privilege limits a users’ access to what is required to do their jobs. Users are granted permission to read, write or execute only those files or resources specific to their work. This applies to network and IP camera system access as well.
Strengthen the Digital Security Chain with Collaboration
CTOs and data security officers understand the critical need to secure all elements of the digital chain: data, infrastructure, devices, endpoints, applications and identity. IP cameras include all of these elements and represent a potential gateway to cybersecurity breaches.
CTO Marlo Gaddis and her team at the Wake County Public School System in North Carolina work with security, maintenance and operations staff to manage a security chain for the district’s digital resources, data center and network systems.
“By collaborating as a group, we are making sure that we have best practices all the way around to guarantee the safety of our school community,” Gaddis says.
Schools can utilize the extensive capabilities of networked cameras without the cybersecurity risks.
Eileen Belastock
by
Eileen Belastock
Eileen Belastock is the director of technology and information at Nauset Public Schools in Massachusetts.
LISTEN
06:10
K–12 districts are investing a larger portion of their budgets in new security technologies to create safer environments for their school communities.
A 2020 study conducted by Omdia on behalf of the Security Industry Association showed the market for physical security equipment in K–12 and higher education was $716 million in 2020. The K–12 sector accounted for about 56 percent of that amount.
IP Cameras Have Benefits and Drawbacks
Before the introduction of IP video surveillance cameras in schools, physical and digital security were typically separate. Now, however, technology is intertwined with every aspect of school security.
As school districts upgrade their video security systems, some are moving away from closed-circuit TV cameras to more robust IP security systems. These network cameras have far more capabilities than traditional CCTV cameras, using network devices to integrate access control, communications, mass notifications, door locks and security cameras.
Unfortunately, along with the benefits of accessibility and ease of use, these highly sophisticated network video systems come with the constant threat of cyberattacks.
Click the banner to discover resources from CDW to help protect your district from cyberattacks.
K–12 security cdw
IP cameras are not dissimilar from other network devices exposed to attack scenarios. As districts transition to IP security systems, they face the same data breach risks. The systems are highly vulnerable and easy to hack, and they present a considerable surface area cybercriminals can use to access a district’s network.
In addition to common threats — malware, ransomware, distributed denial of service, man-in-the-middle and brute-force attacks — video cameras are susceptible to third-party eavesdropping. As recently as May 2021, Eastern Hancock County Community School Corp. in Indiana suffered a cyberattack on its camera system, resulting in a day of lost instruction.
Best Practices for Securing IP Cameras
Fortunately for Eastern Hancock Schools, no personally identifiable information was stored on its network, and thanks to regular backups, no data was lost from the attack. Yet, this remains an example of why district CTOs and data security officers must address the vulnerabilities of their IP security cameras. The goal is to prevent unauthorized access to the system that could compromise other devices in the network.
Here are several security strategies schools can implement to prevent or mitigate attacks on their IP camera systems:
Proactive steps include partnering with an Internet of Things solution provider to discover every IoT device connected to a district’s network and assess each device’s security risk. Districts should also invest in technology that integrates IoT security into a broader solution that protects the data center, network, mobile devices, endpoints and cloud assets.
Best practices for managing staff email passwords, guarding against phishing, protecting student data privacy and restricting access to school and district networks need to extend to IP cameras. Like other vulnerable access points, IT departments must enable multifactor authentication, limit access by IP address and create a video client account to reduce the risk of compromising the device administrator password.
Penetration tests are used by many districts to evaluate network security. These simulated attacks are often carried out by trusted third parties authorized by districts to attempt a breach of their systems. However, IP cameras are often overlooked as vulnerabilities. Schools should ensure that pen tests are performed on these IP devices, using the same tools, techniques and processes attackers would use to pinpoint weaknesses in the security system.
Software updates and patches must be installed, whether the district uses CCTV, IP cameras or a hybrid approach. Access to the latest software can prevent security holes within the camera systems. Most cloud-based IP systems automatically push out updates and patches. However, for on-premises storage, IT must be sure to choose a product that requires scheduled updates and patches.
Video data storage must be secured, either on-premises or in the cloud, to avoid data loss in the event of a breach. The cloud is ideal for backing up sensitive information saved on local servers. One of the cloud’s security advantages over on-premises servers and infrastructure is its ability to segment storage away from user workstations, where most attacks enter.
LEARN MORE: What is Backup as a Service, and how can it protect K–12 districts?
The principle of least privilege limits a users’ access to what is required to do their jobs. Users are granted permission to read, write or execute only those files or resources specific to their work. This applies to network and IP camera system access as well.
Strengthen the Digital Security Chain with Collaboration
CTOs and data security officers understand the critical need to secure all elements of the digital chain: data, infrastructure, devices, endpoints, applications and identity. IP cameras include all of these elements and represent a potential gateway to cybersecurity breaches.
CTO Marlo Gaddis and her team at the Wake County Public School System in North Carolina work with security, maintenance and operations staff to manage a security chain for the district’s digital resources, data center and network systems.
“By collaborating as a group, we are making sure that we have best practices all the way around to guarantee the safety of our school community,” Gaddis says.
