Your cameras are on the same network as your accounting. That should worry you.

Open the network room at most businesses around the Black Hills and you'll find one switch doing everything. Office computers, the printer, the file server, the card terminal, and somewhere near the bottom of the rack, the recorder for the security cameras.

The cameras went in to protect the place. The way they're usually wired, they're also one of the easiest ways for a stranger to get into it. I know that sounds backwards. Bear with me.

Why cameras get picked on

A security camera is a computer. Albeit a small one, running software you'll never look at, and it has a few bad habits.

It doesn't get updated and, unlike your laptop, can't pester you about updates until you cave. A camera bolted under the eave got its firmware at the factory and, in most buildings I've been in, hasn't been updated since. A firmware vulnerability found in year two is still open as a liability in year eight. The Mirai botnet, the one that knocked out a big piece of the internet back in 2016, was built mostly out of cameras and recorders nobody had ever updated.

They also typically get installed with weak defaults. Default admin passwords. Old services left switched on. And on a lot of the budget friendly systems, a "cloud" feature that opens a path from the internet straight to the recorder so the phone app works without anyone having to configure anything. Handy, yes, but also exactly what automated scanners used by cyber crime syndicates are looking for, and those scanners sweep the whole internet around the clock. A business in Rapid City is not too small to show up on the list.

A camera that's been taken over can sit there for months and nobody will notice a thing, because there's nothing to notice.

What is a "flat network" and why is it dangerous?

A flat network is one where every device can talk to every other device. That's what you get by default when everything hangs off one switch and one router. It also means that if any one device gets compromised, all other devices are also in reach.

This usually unfolds with a script (it's almost never a person) accessing a camera through a five-year-old firmware bug or a known factory password that was never changed. On a flat network, that camera is now standing inside your building, on the same floor as the PC running QuickBooks, the CRM with your customer list, the point of sale, and every workstation you own.

If an office PC falls victim to social engineering or is hit with a phishing email, whoever's on it can reach the camera system. If you're a medical or dental practice, there's extra liability, because at that point camera placement and network separation start bumping into patient privacy rules.

To be fair, this problem doesn't stop at cameras. Door controllers, thermostats, printers, and smart TVs all have the same issues: never updated, never monitored, always on.

The professional fix

Anywhere security is taken seriously, network segmentation is how this vulnerability is handled. You group devices by what they are, give each group its own network, and only let the groups talk to each other in ways you've specifically allowed.

On a properly designed business network, that looks like this.

The cameras get their own network, a VLAN, which is a fenced-off section that exists only for the surveillance system. Cameras talk to the recorder. The recorder talks to the handful of things it needs to. Nothing on the camera network can get to accounting, and nothing in the office can connect to a camera unless there's a rule that says it can.

That camera network gets little or no internet access. Cameras have no reason to be out on the internet by themselves. Cutting that off kills the phone-home features that attackers lean on, and it means that even if someone does get into a camera, it can't call out.

Remote viewing goes through a controlled path. Wanting to check the cameras from your phone is reasonable, and there are safe ways to set that up. What you should not do is open a port on the firewall straight to the recorder. That shortcut shows up in breach reports constantly.

Guest WiFi, payment systems, and office machines get the same treatment. Once the network is segmented, each system lives in its own zone, and a breach to that zone is contained there.

Most businesses shy away at this due to the perceived cost involved. However, with modern managed switches, a real firewall, and a few hours of someone sitting down and configuring it, the cost is more approachable than ever.

We treat this design as part of the camera job, not an add-on. When we install security cameras in Rapid City and around the Black Hills, the segmentation is an integral part of our process, and it's written down so the next person who touches the network isn't guessing. It's the same approach we take across our cybersecurity work.