When the cameras you install to protect your organization become a way for someone else to watch you, the security implications go well beyond video footage.
Recent reports that hackers accessed Dahua surveillance cameras and recorders in Ukraine, including changing settings and creating unauthorized accounts, raise bigger questions about IoT security, exposed devices and the risks of turning everyday connected technology into an intelligence-gathering tool.
I have four cybersecurity experts offering perspective on the story for your consideration, including why connected devices are so often overlooked, how compromised cameras can expose an organization’s people and security operations, how attackers can exploit the connections between physical and cyber infrastructure, and how camera networks can become powerful intelligence assets when their data is aggregated.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security (www.ridgesecurity.ai)
“I’ve seen the broader risk firsthand during several authorized, full-scope adversarial emulation engagements. While the techniques differed from those reported in Ukraine, the principle is the same. Compromising surveillance infrastructure can give attackers visibility into the very systems and personnel responsible for protecting an organization. I call that watching the watchers.
What concerns me is that these systems rarely operate in isolation. Video surveillance, physical access controls, building automation, and alarm systems may be interconnected. For an advanced adversary coordinating cyber and physical operations, that visibility can reveal security procedures, personnel movements, and potential gaps in response. The camera is no longer just watching the door; it may be helping someone figure out when to walk through it.
Manufacturers must take greater responsibility for secure-by-default configurations, strong authentication, firmware maintenance, and independent adversarial testing before and after products reach the market. Organizations should isolate these systems, eliminate unnecessary cloud access, and validate their defenses against realistic attack paths. Installing a security device shouldn’t require taking its security claims on faith.”
John Strand, Owner, Black Hills Information Security (www.blackhillsinfosec.com)
“Watch any spy movie and you’ll see the importance of cameras. They can reveal physical blind spots, capture high-resolution video of someone’s fingers as they type a password, or show sensitive information on a screen.
“What’s interesting about this particular story is how many problems are stacked together. Predictable serial numbers. Easy cloud access. Outdated firmware. It’s amazing to me how bad the entire security ecosystem around some of these cameras is.
“But this isn’t unusual. We see the same thing across connected IoT devices that fall outside traditional endpoint management. Patching is poor, firmware gets forgotten, and there’s often absolutely no security monitoring. These devices can see what people type and what’s on their screens, yet nobody is watching the devices themselves.”
Phillip Wylie, Chief Security Evangelist, Suzu Labs (www.suzulabs.com)
“Security cameras are supposed to help protect organizations, but when they’re compromised, they can become surveillance tools for attackers. Instead of protecting your environment, they’re potentially giving someone else visibility into your operations, personnel, and physical security.
“One of the biggest challenges with IoT devices is that they’re often installed and forgotten. Organizations may not realize these devices are running outdated firmware, using weak credentials, or are accessible from the internet. Attackers look for these weaknesses because they can provide an easy entry point into an organization’s environment.
“Manufacturers need to prioritize security by design, including secure default configurations, strong authentication, and reliable firmware updates. Organizations also need to take responsibility for securing these devices by changing default credentials, limiting internet exposure, segmenting networks, and regularly checking for firmware updates.
“Ultimately, a security camera is another computer connected to your network, and it needs to be treated with the same level of security attention as any other endpoint.”
Donald McFarlane, Board Member, Xcape, Inc (www.xcapeinc.com)
“A camera is a sensor. A network of cameras (or radios, vehicles, routers or other connected devices) is an intelligence collection system.
“We have been seeing nation states turn privately deployed technology into intelligence assets for a long time. Russian intelligence has been publicly linked to compromising cameras to monitor NATO logistics and to identify Ukrainian personnel. U.S. agencies have assessed that Chinese state actors have penetrated and persisted in American communications infrastructure for years, maintaining access that could support disruption in a future conflict.
“An individual camera gives you an image. Aggregated sensor data gives you pattern of life: where people go, who they meet, which facilities matter, how goods move, and how critical systems operate.
“Hostile intelligence services don’t care what our acceptable-use policies or privacy statutes say. If we let them get the data, they’ll use it for their purposes.
“It isn’t enough to regulate what Flock, a police department, or another legitimate operator may do with aggregated data. We must ask whether Russia, China or somebody else can obtain that same data and build their own intelligence picture.
“When you deploy a nationwide sensor network capable of reconstructing movements and relationships, you have built an intelligence platform whether you intended to or not.
“The security requirement has to follow the intelligence value of the aggregate, not the apparent sensitivity of the individual sensor.
“Policymakers and operators must ask themselves: what collection or effects capabilities have we created, who else wants them, and how well are we protecting them?”
Cameras are things that you need to trust. And if you cannot trust them, the only option is to toss them ASAP.
The CISA’s new strategy promises to evict hackers before they strike, with nearly 968 fewer staff to do it
Posted in Commentary with tags CISA on October 27, 2026 by itnerdThe CISA released CISA 2030: Defend, Harden, Prevail on Oct 26, committing the agency to move from passive defense to an “aggressive, anticipatory” stance built on three pillars: leading national cyber defense, prioritizing infrastructure security and mobilizing national resilience. The Defend pillar calls for modernizing operational technology, improving asset visibility and anomaly detection, and strengthening supply chain integrity.
Jason Brown, Director of Customer Advisory Counter Fraud Lead, iCOUNTER
“CISA 2030 is an honest strategy. It accepts that intrusions will happen and commits the agency to an anticipatory stance. Detect adversaries early, evict them decisively, and remove footholds before they are weaponized. That is exactly the right goal.
The gap is the third party. The strategy treats supply chain as a question of technology and software integrity, but adversaries are not waiting for a flawed product. They are compromising the service providers, platforms, and partners that organizations already trust, and using that access to reach the real target. Verizon’s 2026 Data Breach Investigations Report found third parties involved in 48% of breaches, up from 30% a year earlier.
CISA is also asking for an intelligence to operations pipeline, and that is the right instruction. Intelligence that only informs is not enough. It has to drive action, with remediation attached, at machine speed. As CISA narrows its focus and pushes more action to the local level, owners and operators will carry more of that mission themselves. The organizations that extend it across their third party ecosystem will be the ones that stop the compromise before the incident reaches them.”
Everyone should take time to read it and doing all things possible to make sure that are not pwned by threat actors. Ever. Even with their staffing challenges.
UPDATE: More commentary has come in:
John Strand, Owner, Black Hills Information Security:
“I like almost everything CISA says in this release. But as always, the devil is in the details. Couple that with the immense budget cuts CISA has had to deal with, and achieving this mission becomes exceedingly difficult.
“We’re talking about thousands of municipalities and critical infrastructure organizations that need protection under this umbrella. Every single one needs money. Every single one needs resources. And every single one needs help upgrading aging infrastructure.
“That takes more than a press release.ㅤ
“I like the direction and the renewed focus on critical infrastructure. But I think everyone should pause, take a deep breath, and wait to see when the money actually starts flowing and how it gets allocated.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase:
“CISA’s new strategy reinforces an important reality: protecting critical infrastructure requires securing not just the software organizations deploy but the changes that software makes to critical systems.
“Databases underpin essential services across financial institutions, healthcare, energy, and government. Yet database changes often lack the same automated security checks, policy enforcement, and visibility applied to application code.
“As AI accelerates software development, that gap becomes increasingly consequential. Organizations need to validate database changes before deployment, enforce consistent policies, detect configuration drift, and maintain a clear record of what changed, when, and by whom.
“CISA is right to prioritize software security and operational resilience. Extending those principles to the database layer is an important step toward protecting the integrity and availability of the systems Americans depend on.”
Leave a comment »