Security system level protection: What requirements should the video surveillance part meet?

Which systems require waiting maintenance

If the video surveillance system belongs to critical information infrastructure or is included in the classification scope, It needs to be constructed and rectified according to the requirements of Class Protection 2.0. Most security projects involve level two, Some government, financial, and energy projects are Level 3.

Requirements directly related to video surveillance

Rectification list (can be directly compared and executed)

• Clear all default accounts and shared accounts, make each person have a separate account, and log out promptly after resignation.
• Password policy: length ≥8 (recommended ≥12), complexity requirements, 90-day replacement, 5 failed lockouts.
• Enable platform operation auditing: log-ins, configuration changes, video deletions, and video exports must leave traces.
• The logs are sent to independent storage to avoid being deleted by the machine; they are retained for no less than 6 months.
• The video network and the office network are VLAN or physically isolated, and the front-end camera network segment is prohibited from accessing the Internet.
• Close redundant services on the device (Telnet, FTP, UPnP), and upgrade the firmware to the manufacturer's latest secure version.
• Enable watermark or verification mechanism on video files, encrypt them when exporting and record the operator.

Common misunderstandings

It is inaccurate to interpret waiting guarantee as "buying a firewall" or "doing an evaluation". It is more about the implementation of management systems and technical configurations. Most of the items in the above list It is a configuration and process issue and does not require the purchase of additional equipment.