Taiwan’s Institute for Information Industry (III) has announced the draft standard on cybersecurity for IP video surveillance, seeking to help local manufacturers develop hardened, cyber secure products as they export to overseas markets.
Taiwan’s Institute for Information Industry (III) has announced the draft standard on cybersecurity for IP video surveillance, seeking to help local manufacturers develop hardened, cyber secure products as they export to overseas markets.
The draft proposal, announced in a news conference on July 27, was co-developed by III and Taiwan Association of Information and Communication Standards as they joined forces with vendors, government agencies and the academia to work on a topic that officials of the organizations said has become one of the most pressing issues facing the industry in the era of IP video as well as the Internet of Things.
Cybersecurity has gained the attention of security players across the world, especially after a spate of recent incidents. At the end of last year, hackers exploited vulnerabilities in networked devices, including certain IP camera models, and used them to launch DDoS attacks against major web hosting services, resulting in service shutdowns across major web services such as Amazon.com and Netflix.
This has created a rippling effect across the industry, prompting calls on exercising best practices against cyber threats for users and vendors alike. Against this backdrop, III announced the draft standard in hope of providing a set of guidelines for Taiwan vendors, most of whom compete in overseas markets where users attach a great significance to cybersecurity.
According to III, they are looking to publish the official standard towards the end of the year. The standard initially covers video surveillance and equipment under it, including IP cameras, NVRs and NAS, and will eventually be extended to other IoT devices, the institute said.
The draft standard is roughly divided into the following sections, and requirements under each section are summarized as follows:
Operating system
- The camera shall leave on only ports that are for necessary web services
- The camera must have a firmware upgrade mechanism, and all upgrades must be encrypted
- The web interface should not contain any of the top ten risks listed under the Open Web Application Security Project
Transmission
- The transmission of data between the camera and other devices must be encrypted, and the strength of encryption must conform to internationally recognized guidelines
- The camera shall not have wireless settings that are deemed unsafe
Authentication
- The default password for each IP camera from the manufacturer must be different
- The vendor must require the user to change the default password upon initial setup
- Different access levels must be set for accessing resources within the camera
Privacy
- When recording, some form of reminder should be given
- Data stored in the camera must be encrypted
- Accessing data in the camera should only be granted to those authorized to do so