Security & Risks
Chapter 6 — Physical security threats, cybersecurity vulnerabilities, risk assessment framework, and mitigation strategies for IK10 vandal-resistant surveillance systems
6.1 Physical Security Threat Taxonomy
Physical attacks on surveillance systems follow predictable patterns that can be categorized by attack method, required tools, time to execute, and the resulting system impact. Understanding this taxonomy allows designers to prioritize countermeasures and allocate budget to the threats most likely to be encountered in a specific deployment environment. The IK10 standard addresses impact resistance, but physical security design extends well beyond the camera housing itself.
The most effective physical attacks are not brute-force impacts but rather systematic approaches that exploit installation weaknesses: loose mounting, exposed cables, unlocked equipment cabinets, and inadequate access control to camera locations. A comprehensive physical security design must address all of these attack vectors, not just the camera housing rating.
| Attack Type | Method | Target | Time to Execute | Risk Level | Primary Countermeasure |
|---|---|---|---|---|---|
| Direct Impact | Hammer, bat, thrown object | Camera housing/dome | <5 seconds | HIGH | IK10 housing + metal cage |
| Cable Cutting | Wire cutters, bolt cutters | Exposed cable runs | <10 seconds | HIGH | Metal conduit + cable alarm |
| Camera Redirection | Manual rotation | Camera aim/angle | <30 seconds | HIGH | Anti-rotation pins + scene-change detection |
| Occlusion/Spray | Spray paint, tape, cloth | Camera lens | <5 seconds | HIGH | Occlusion detection + alarm |
| Mount Removal | Standard screwdrivers | Camera bracket/base | 1–5 minutes | MEDIUM | Security screws + anti-pry design |
| Equipment Cabinet | Prying, lock picking | PoE switch, NVR | 1–10 minutes | MEDIUM | IP66 cabinet + tamper switch + alarm |
| Laser Blinding | High-power laser pointer | Camera sensor | <5 seconds | MEDIUM | IR-cut filter + sensor protection + camera placement |
| Thermal Masking | Heat source in front of lens | Camera field of view | <30 seconds | LOW | Scene-change detection + overlapping coverage |
6.2 Cybersecurity Vulnerabilities & Mitigations
Modern IP surveillance cameras are network-connected computing devices that are subject to the same cybersecurity threats as any other networked device. The surveillance network presents a particularly attractive target for attackers because it provides access to sensitive video data, can be used as a pivot point to attack other network segments, and can be weaponized as part of a botnet (as demonstrated by the Mirai botnet attacks). A robust cybersecurity posture for an IK10 surveillance system requires addressing threats at the device, network, and management layers simultaneously.
| Vulnerability | Attack Vector | Potential Impact | Risk Level | Mitigation |
|---|---|---|---|---|
| Default Credentials | Network access | Full camera control; video access | HIGH | Mandatory password change on first boot; password policy enforcement |
| Unencrypted Video Stream | Network eavesdropping | Video data interception | HIGH | Enable RTSP over TLS; HTTPS for management; VPN for remote access |
| Outdated Firmware | Known CVE exploitation | Remote code execution; botnet | HIGH | Automated firmware update policy; CVE monitoring; vendor security bulletins |
| VLAN Misconfiguration | Network lateral movement | Cross-segment access; data breach | MEDIUM | Strict VLAN segmentation; firewall ACLs; regular network audit |
| Physical USB/SD Access | Physical access to device | Data extraction; firmware modification | MEDIUM | Disable unused ports; encrypted SD card; physical access control |
| ONVIF Discovery Abuse | Network scanning | Device enumeration; unauthorized access | MEDIUM | Disable ONVIF discovery on production; restrict to management VLAN |
| Weak TLS Configuration | Man-in-the-middle | Credential theft; session hijacking | MEDIUM | TLS 1.2/1.3 only; disable weak ciphers; certificate pinning |
| Log Tampering | Privileged account access | Evidence destruction; audit failure | LOW | Immutable audit log; SIEM integration; role separation |
Hardening Baseline: Every camera must be hardened before deployment using a documented checklist: (1) change default password, (2) disable unused services (Telnet, HTTP, RTSP without auth), (3) enable HTTPS, (4) configure NTP, (5) enable audit logging, (6) set firmware auto-update policy, (7) configure VLAN assignment, (8) test alarm output. This checklist must be completed and signed off by the commissioning engineer before the camera is accepted into service.
6.3 Risk Assessment & Residual Risk Management
A formal risk assessment must be conducted for each deployment zone before finalizing the system design. The risk assessment quantifies the likelihood and impact of each threat scenario, identifies the countermeasures already in place, and determines the residual risk after countermeasures are applied. The residual risk must be reviewed and accepted by the site security manager before the system is commissioned.
| Risk Factor | Assessment Criteria | Score Range | Notes |
|---|---|---|---|
| Threat Likelihood | Historical incident data + site-specific factors | 1 (rare) – 5 (frequent) | Use 3-year incident history if available |
| Attack Capability | Tools/skills required vs. typical attacker profile | 1 (expert) – 5 (unskilled) | Higher score = more accessible to attackers |
| Impact Severity | Evidence gap duration + operational disruption | 1 (minor) – 5 (critical) | Critical = >30 min evidence gap in high-risk zone |
| Countermeasure Effectiveness | Reduction in likelihood × impact | 0 (no effect) – 0.9 (90% reduction) | Document basis for effectiveness estimate |
| Residual Risk Score | (Likelihood × Capability × Impact) × (1 - Effectiveness) | 0 – 125 | Score >50 requires additional countermeasures |
Residual Risk Acceptance: A residual risk score above 50 must not be accepted without written sign-off from the site security manager and documentation of the business reason for accepting the risk. Risk acceptance is not a substitute for implementing available countermeasures — it is only appropriate when the cost of countermeasures exceeds the expected loss from the risk over the system lifetime.