Understanding restricted surveillance technology, network security best practices, and when it’s time to consider NDAA-compliant alternatives.

Cameras have become part of the technology infrastructure of nearly every business. They protect buildings, monitor parking facilities, oversee warehouses, and help organizations investigate incidents. But what happens when the technology intended to improve physical security becomes a cybersecurity and supply-chain concern?

That question has become increasingly important for organizations using equipment manufactured by companies such as Hikvision and Dahua.

The U.S. government has placed significant restrictions on telecommunications and video-surveillance technology from several Chinese manufacturers, including Huawei, ZTE, Hytera Communications, Hikvision, and Dahua. Under Section 889 of the 2019 National Defense Authorization Act, federal agencies face restrictions involving covered telecommunications and surveillance equipment, and the rules can also affect organizations doing business with the federal government.

Why the Concern?

Modern security cameras are network-connected computing devices. They contain processors, operating systems, firmware, storage, network interfaces, web-management interfaces, and cloud connectivity.

The concerns surrounding Hikvision, Dahua, Hytera, Huawei, and ZTE go beyond common cybersecurity weaknesses such as default passwords or poor network configuration. Congress and federal agencies identified covered equipment from these manufacturers as presenting national-security and supply-chain risks, particularly when used in telecommunications, public safety, government facilities, critical infrastructure, and other national-security environments.

For businesses, the concern is slightly different.  Although businesses should still be concerned about network-connected surveillance equipment providing authorized access to sensitive video, operational information, or the networks to which the devices are connected. The more applicable issue for businesses is the supply-chain concern.  

At the same time, those broader supply-chain concerns should not overshadow basic cybersecurity practices. Default credentials, outdated firmware, unnecessary Internet exposure, poorly configured remote access, and inadequate network segmentation can create vulnerabilities in any manufacturer’s camera system. Those are separate risks—and one’s organizations can directly control through good cybersecurity practices.

What If the Cameras Are Already Installed?

This is where the conversation becomes more complicated.

Organizations may have thousands—or even tens of thousands—of dollars invested in existing surveillance infrastructure. Replacing every camera, recorder, and supporting component immediately may not be operationally or financially realistic.

First, determine whether regulatory, contractual, customer, insurance, or government-contracting requirements require the equipment to be removed. Organizations doing business with the federal government should pay particular attention to Section 889 because its restrictions can extend beyond equipment supplied directly to the government.

If immediate replacement is not required, the next question should be:

How can we reduce the risk while the equipment remains in service?

Start With Good Network Security—security controls used to reduce the risk of vulnerabilities in Hikvision, Dahua, or other restricted equipment shouldn’t be considered special measures. They are cybersecurity best practices that should be applied whenever a new device and system is connected to an organization’s network.

A security camera is not just a camera—it is a network-connected computing device. The same is true of access-control systems, printers, sensors, smart televisions, building-management systems, and other Internet of Things (IoT) devices. Every connected device creates another potential entry point and should be incorporated into the organization’s overall security architecture.

Network segmentation should be standard practice. Cameras and surveillance equipment should generally be placed on dedicated VLANs or isolated networks rather than sharing unrestricted network access with employee computers, servers, payment systems, or other sensitive resources. Firewall rules and access controls can then determine exactly which systems the cameras are permitted to communicate with.

Outbound communication is just as important. A device should not automatically receive unrestricted Internet access simply because it is connected to the network. Determine what external connectivity is required for the device to perform its intended function, allow what is necessary, and restrict what isn’t.

For organizations retaining equipment that has been identified as a supply-chain concern, these established security practices become even more important. The objective is not to create an entirely different security model for those cameras, but to make sure the controls that should already exist are being consistently applied.

Control Who—and What—Can Access the Cameras

Access management is another fundamental security practice that should apply to all network-connected devices, regardless of manufacturer.

Default passwords should be changed before equipment is placed into service, and devices should use strong, unique credentials. Unnecessary accounts, protocols, services, peer-to-peer features, and remote-management capabilities should be disabled when not required.

Administrative interfaces should not be directly exposed to the Internet. If technicians or third-party providers require remote access, organizations should establish a controlled method of access, such as a VPN or other secure remote-access solution. Access should be limited to authorized users, monitored, and protected with multifactor authentication when supported.

Firmware and vulnerability management need to be part of the process. Organizations should maintain an inventory of cameras and related equipment that includes the manufacturer, model, firmware version, IP address, physical location, and support status. Available security updates should be evaluated and applied, and devices that are no longer supported by their manufacturer should be identified as candidates for replacement.

These aren’t simply recommendations for organizations using Hikvision or Dahua equipment. They are basic security practices for building and maintaining a secure network.

The concerns surrounding restricted surveillance technology simply reinforce an important principle: anything connected to your network needs to be treated as part of your cybersecurity environment.

Mitigation Is Not the Same as Elimination

These controls can significantly reduce cybersecurity exposure, but they do not eliminate the underlying supply-chain concern.

If an organization determines a manufacturer presents an unacceptable risk—or if contractual or regulatory requirements prohibit its use—the short-term strategy should be replacement. When evaluating replacement equipment, organizations should consider NDAA-compliant alternatives and verify that the proposed equipment does not contain prohibited components or technology covered by Section 889.

However, replacing surveillance equipment is not always as simple as choosing a different camera.

Many businesses rely on third-party video management systems, security platforms, access-control systems, or other software that integrates directly with specific camera manufacturers and models. Before purchasing replacement equipment, talk with your security or solutions provider. Ask which NDAA-compliant cameras are supported by their platform and whether changing manufacturers will affect existing features, integrations, recording capabilities, or software licensing.

Another important question is whether old and new cameras can operate simultaneously within the existing system. If the platform supports a mixed-camera environment, an organization may be able to replace higher-risk equipment gradually instead of replacing its entire camera infrastructure at once. This can have a significant impact on the cost and operational disruption of a full replacement project.

Most importantly, don’t make the replacement decision in isolation. Cybersecurity, physical security, IT, and third-party providers should be part of the conversation. The goal should be to select equipment that reduces supply-chain risk while remaining compatible with the organization’s operational environment.

The larger lesson extends well beyond Hikvision or Dahua. Cameras, access-control systems, printers, sensors, televisions, and other connected devices are computers on your network.

Physical security and cybersecurity can no longer be treated as separate conversations.

If a device is connected, it needs to be inventoried, segmented, maintained, monitored, and eventually replaced when its risk can no longer be appropriately managed.