If your CCTV system uses internet-connected cameras, it is also a network device, and network devices get exploited. IP cameras shipped with default credentials, unpatched firmware, and flat network access represent a genuine cybersecurity risk for NI businesses. This guide explains the specific vulnerabilities and how to eliminate them.
What Makes IP CCTV Different from Older Analogue Systems
Traditional analogue CCTV was isolated by design. Footage travelled from camera to DVR over coaxial cable and went nowhere else unless you physically removed a disc or tape. You could not reach an analogue camera from the internet because it simply was not networked.
IP cameras changed that fundamentally. Your network video recorder (NVR), your cameras, and your remote-viewing application are all connected to the same infrastructure that your emails, invoices, and customer records travel over. In many smaller businesses, they sit on the same flat network with no separation between a camera covering the car park and a PC that holds payroll data.
That connectivity is the feature. Remote viewing, real-time alerts, AI analytics, and cloud backup all depend on the camera being a proper network device. The cybersecurity exposure comes with the territory, but the majority of installation companies do not address it in any structured way.
At Advanced Overwatch, when we take over security systems from previous installers, misconfigured network settings are among the most consistent problems we find. Cameras accessible on the open internet, default credentials intact, firmware several versions out of date. It is rarely carelessness on the part of the business owner. Most were simply never told it mattered.
The Three Primary Attack Vectors on IP CCTV Systems
1. Default Credentials Left Unchanged
Every IP camera ships with factory-set login credentials, typically combinations such as admin/admin or admin/12345. These default usernames and passwords are publicly documented in manufacturer manuals and widely available online.
Search engines designed to index internet-connected devices can identify cameras that remain accessible with their default settings. A motivated attacker requires no specialist skills: they search, find an open camera on a known IP range, enter the default credentials, and they are in. Once access is established, they can view live and recorded footage, alter camera angles, disable recording, or use the device as a foothold for deeper network intrusion.
What correct practice looks like: Every camera and NVR must have its default credentials changed before it is commissioned. Access should be restricted to named users with distinct passwords. Where the system supports role-based access control (RBAC), installer, administrator, and viewer accounts should be configured separately with appropriate permissions for each role.
2. Unpatched Firmware
Camera firmware is software, and software has vulnerabilities. Major camera manufacturers, including brands that Advanced Overwatch installs such as Hikvision, Dahua, and Hanwha, periodically issue critical firmware updates to patch security flaws. In several high-profile cases over the past few years, vulnerabilities have allowed unauthenticated remote access to camera feeds and control interfaces.
The security research community actively tests IP camera firmware and discloses vulnerabilities through responsible disclosure processes. Once a patch is published, the vulnerability details become public knowledge. Unpatched cameras are therefore known-vulnerable targets with documented attack methods freely available.
Most IP cameras do not update their firmware automatically. Without a process for checking and applying updates, a camera commissioned in 2022 may still be running 2022 firmware in 2026, carrying every vulnerability discovered in those four years.
What correct practice looks like: Firmware versions should be audited at commissioning and at every scheduled maintenance visit. High-severity patches should be applied promptly. Enterprise-grade NVR platforms from the manufacturers we work with support bulk firmware management across large camera estates, making this practical even for sites with dozens of cameras.
3. Flat Networks Without Segmentation
The most overlooked risk is network architecture. In a typical SME, a single Wi-Fi or LAN network carries everything: office computers, staff phones, payment terminals, and the CCTV system. If an attacker gains access to the CCTV network through any of the methods described above, they have a network foothold that may reach financial systems, file servers, and cloud credentials.
This is not a theoretical concern. Retail and hospitality businesses are high-value targets because payment card data passes through the same infrastructure. A CCTV camera used as an entry point to a retail point-of-sale network is an established attack pattern, documented in multiple incident reports from the payment card security industry.
What correct practice looks like: CCTV cameras and NVRs should sit on a dedicated virtual local area network (VLAN), isolated from business IT systems. Traffic between the CCTV VLAN and other network segments should be controlled by firewall rules. Cameras should not be able to initiate outbound connections to the internet except through defined, audited services. For most sites, this means connecting through the manufacturer’s secure cloud relay rather than through direct port forwarding.
What UK GDPR Requires from You
UK GDPR requires businesses to implement appropriate technical and organisational security measures to protect personal data. CCTV footage that captures identifiable individuals is personal data under UK GDPR. If your CCTV system is compromised and footage is accessed or exfiltrated without authorisation, that is a personal data breach, with potential reporting obligations to the Information Commissioner’s Office (ICO) and significant reputational consequences for your business.
The ICO has published specific guidance on CCTV use, including requirements for data security. Treating CCTV as a standalone security tool rather than as part of your data protection obligations is a compliance gap that regulators are increasingly focused on, particularly as IP camera breaches attract media attention and enforcement scrutiny.
For businesses that handle payment card data, PCI DSS (the Payment Card Industry Data Security Standard) has additional network segmentation requirements that apply directly when CCTV systems share infrastructure with payment environments.
Cyber Essentials and Why NI Businesses Should Pay Attention
Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC). It addresses five foundational security controls: boundary firewalls, secure configuration, user access control, malware protection, and patch management. All five apply directly to an IP CCTV estate.
Many Northern Ireland public sector contracts and an increasing number of commercial tenders now require Cyber Essentials certification from suppliers. Getting your CCTV infrastructure right is not just sound security practice. For businesses working with government bodies, councils, schools, healthcare providers, or larger commercial clients, it is becoming a contractual requirement.
Certifying your broader IT environment under Cyber Essentials while leaving your CCTV network misconfigured is also a practical contradiction: an auditor examining your network architecture will expect CCTV to be included in the scope.
What a Professional Installer Does Differently
When Advanced Overwatch commissions an IP CCTV system, cybersecurity configuration is part of the installation specification, not an afterthought. Our engineers work through a commissioning process that includes:
- Changing all default credentials before any camera goes live
- Assigning dedicated user accounts with appropriate access levels for each role
- Placing cameras and NVRs on an isolated VLAN, separated from business IT systems
- Configuring the NVR to connect outbound through defined cloud relay services only, with no direct inbound internet exposure through port forwarding
- Documenting the firmware version at commissioning and flagging any known security advisories for the installed hardware
- Advising on remote access method and platform, recommending manufacturer cloud relays (such as Hikvision Hik-Connect or Dahua DMSS) over direct port forwarding
For larger commercial sites, we provide network architecture specifications to the client’s IT team or managed service provider, ensuring the CCTV VLAN is correctly firewalled, monitored, and documented.
This approach is particularly important on sites covered by existing cyber insurance policies. Increasingly, insurers are asking about network segmentation and access controls as part of underwriting assessments.
How to Audit Your Existing CCTV System
If your current system was installed by a previous contractor and you are uncertain about its security configuration, start with these four checks:
Remote access method. Is your NVR accessible via port forwarding, or through a manufacturer cloud relay? Check your router’s port forwarding rules. An NVR directly exposed on the internet through a fixed port is significantly more vulnerable than one accessed via a cloud relay.
Credential status. Can you log into the NVR using admin/admin or a similarly obvious combination? If yes, default credentials are almost certainly still in place on the cameras too.
Firmware version. Log into the NVR interface and find the firmware version. Check the manufacturer’s website for the current release and compare. A gap of more than twelve months is a concern. A gap of several years is a serious vulnerability.
Network position. Are your cameras visible on the same network subnet as office computers and payment systems? Your IT support or a basic network scan can confirm this within minutes.
If you identify problems, do not attempt to resolve them piecemeal without a clear plan. Changing credentials incorrectly can lock you out of your own system. VLAN reconfiguration requires switch and firewall expertise. Engage a qualified installer to carry out a structured security review before making changes.
Advanced Overwatch provides CCTV system security audits for businesses across Northern Ireland, covering credential review, firmware assessment, network architecture, and access control configuration. If your system was installed by a previous contractor, or if you have questions about your current setup, contact our team.
Advanced Overwatch
028 7087 8077
info@advancedoverwatch.com
SSAIB Certified (NIRE127) | ISO 9001, 14001, 27001, 45001 | Established 2017
Related Questions
Can a hacker access my CCTV cameras remotely?
Yes, if the system has not been properly secured. IP cameras accessible on the internet with unchanged default credentials or known firmware vulnerabilities can be discovered and accessed without physical proximity to your premises. The most common routes in are factory passwords left intact and unpatched software. A properly configured system with unique credentials, current firmware, and no direct internet exposure significantly reduces this risk. If you are unsure whether your current system is exposed, a security audit from a qualified installer will identify the gaps quickly and without disrupting your existing cameras.
Does UK GDPR apply to CCTV footage in my business?
Yes. If your CCTV cameras capture images of identifiable individuals, including employees, customers, and visitors, that footage is personal data under UK GDPR. You must secure it with appropriate technical measures, retain it only as long as necessary, and be prepared to report a breach to the Information Commissioner’s Office if footage is accessed without authorisation. The ICO’s CCTV guidance sets out specific obligations for operators in plain language. Getting your system’s cybersecurity right is not just an IT matter; it is a data protection requirement with real regulatory consequences if ignored.
What is VLAN segmentation and why does it matter for CCTV?
A VLAN (virtual local area network) divides a single physical network into separate, isolated logical networks. Placing CCTV cameras on their own VLAN means that even if a camera is compromised, an attacker cannot move laterally to reach office computers, file servers, or payment systems. Without segmentation, all networked devices share the same broadcast domain, meaning a breach of any one device is effectively a breach of the whole network. For businesses that hold sensitive data or process card payments, VLAN separation of your CCTV infrastructure is a practical necessity, not a luxury reserved for large enterprises.
Standards Explained
UK GDPR — The United Kingdom General Data Protection Regulation. The post-Brexit successor to EU GDPR, it governs how businesses collect, store, and protect personal data including CCTV footage of identifiable individuals. The Information Commissioner’s Office (ICO) is the UK data protection regulator and has published a dedicated CCTV Code of Practice outlining the security and retention obligations that apply to camera operators.
Cyber Essentials — A UK government-backed cybersecurity certification scheme developed by the National Cyber Security Centre (NCSC). It defines five foundational security controls: boundary firewalls and internet gateways, secure configuration, access control, malware protection, and patch management. All five controls are directly relevant to an IP CCTV estate. Cyber Essentials certification is increasingly required for UK public sector suppliers and is becoming standard in commercial procurement.
BS EN 62676 — The British and European Standard series for video surveillance systems. It covers system design, performance requirements, and installation practices for CCTV equipment including networked IP-based systems. Part 4 of the standard addresses cybersecurity design requirements for video surveillance, including guidance on network architecture, access control, and firmware management for connected camera systems.
PCI DSS — The Payment Card Industry Data Security Standard. It applies to any business that stores, processes, or transmits payment card data. Requirement 1 (network segmentation) and Requirement 2 (system configuration) directly apply to businesses where CCTV infrastructure shares a network with point-of-sale terminals or payment processing systems. Non-compliance can result in fines and loss of card-processing privileges.
ONVIF — Open Network Video Interface Forum. An industry body that defines open standards for IP-based physical security products, including the communication protocols used between IP cameras, NVRs, and video management software (VMS) platforms. ONVIF compliance ensures interoperability between cameras and recorders from different manufacturers. Most professional-grade cameras from Hikvision, Dahua, and Hanwha carry ONVIF certification.
