Protecting Asia Pacific's CCTV surveillance systems

The ubiquity of surveillance technologies has become more prevalent in the pandemic era. From drones to closed-circuit television (CCTV) cameras, many countries in Asia Pacific have mobilised mass surveillance tools for contact tracing, monitoring of quarantined individuals, and managing the overall transmission of the coronavirus.

While this constitutes an increasing - and to some, unnerving - lack of privacy, residents in countries such as Singapore and South Korea have welcomed the proliferation of such tools during this time. The primary reason for this is safety.

However, recent events have exposed another side of the coin that deserves equal, if not more, attention - the safety of the tools watching over 60 percent of the world's population, residing in Asia.

In March, global IoT security camera provider Verkada fell victim to a cyberattack which gave perpetrators unfettered access to the live feeds of around 150,000 cameras. Hackers revealed sensitive footage from hospitals, banks, offices, and more - not to mention the facilities of electric vehicle car marker, Tesla.

With one billion surveillance cameras expected to be watching over the world this year, businesses and governments need to ramp up safeguards to prevent mass, unwarranted public disclosures of sensitive data.

Realigning cybersecurity priorities

Despite the increasing IoT cyber risks, it is unlikely that the safety of surveillance technologies will be prioritised. Organisations tend to focus on immediate security needs that may impact business operations. For instance, remote working has shifted cybersecurity's focus towards securing employees' endpoints, as we are seeing in Asia Pacific.

However, as we build more IoT capabilities into video surveillance devices, CCTVs become more vulnerable to attacks. In the mind of a threat actor, this means millions of new entry points through which they could attempt access. These new entry points allow threat actors to gain deeper access into the systems.

The good news it that existing cybersecurity solutions and best practices can also be applied to secure surveillance systems such as CCTVs.

In the case of the Verkada attack, many victims only found out when images were shared online, and a lot of time had passed between the breach and the story going public. This highlights the opportunity for real-time detection tools to thwart any potential reputational damage. In Asia Pacific, some economies like Singapore are already investing in boosting real-time detection capabilities. By applying these capabilities to the video security network, governments and organisations will be better positioned to mitigate similar incidents.

Another powerful tool is behaviour-based anomaly detection. When perpetrators get access to an environment, they perform an analysis to better understand the victim and the damage they can inflict. This involves activities such as the guessing of login usernames and passwords. This type of activity is an unmistakable deviation from what is considered normal and would instantly generate an anomaly alert, enabling the cybersecurity team to stop the perpetrators.

Lastly, the zero-trust network model also helps to create stronger protection. This means a presumption of distrust from anything inside or outside the network's perimeters, and verification being required to gain access. Complemented by strong verification requirements, the model aims to reduce the opportunity for threat actors to compromise user credentials and gain access into networks.

The Verkada attack has casted a spotlight on the safety of surveillance systems. Asia Pacific is primed to protect its surveillance systems since spending on cybersecurity is expected to increase by 12.6 percent this year. However, an organisation's ability to harness existing cybersecurity tools and practices in the surveillance arena will be crucial for the region to continue providing safe surveillance to its citizens.

The writer is regional director, APAC, at Nozomi Networks.