Ensuring Network Information Security for Surveillance Camera Systems

According to the Ministry of Information and Communications, the “National Technical Regulation on Basic Network Information Security Requirements for Surveillance Camera Equipment” will be issued this year, requiring relevant enterprises and organizations to comply with the criteria in this decision before bringing products to market.

On May 22, 2024, Vietnamnet Newspaper, in coordination with the Authority of Information Security (MIC), organized a seminar on “Basic Network Information Security Standards for Surveillance Cameras” with the participation of representatives from camera manufacturing organizations, Network Information Security enterprises, and reporters from the Vietnam IT Journalists Club. During this seminar, parties exchanged issues related to Network Information Security for surveillance camera systems.

Table of contents

See more: Capacity Profile Of Phuc Gia Laboratory Corporation

I. Current Status of Network Information Security for Camera Systems

The use of surveillance cameras in Vietnam is rising sharply, but most are of unknown origin and sold floating in the market. At the same time, consumers do not yet have much awareness regarding the threats to Network Information Security from surveillance camera devices. This situation causes concern about Network Information Security, especially when these devices can become targets for cyberattacks. Control measures are needed to ensure information safety and privacy.

1. Current Status of Camera Usage in Vietnam

Reality and the statements of representatives attending this seminar show that the trend of using cameras globally, as well as in Vietnam, is increasing. These devices are not only used in households, businesses, healthcare, and schools but are also critical components in E-government systems, digital governments, and smart cities for monitoring traffic safety and social order.

According to relative statistics from enterprises, in 2023 alone, the scale of the Vietnamese camera market reached approximately 175 million USD in revenue—equivalent to 6 million cameras; from there, it can be estimated that our country is currently using up to 15 million cameras. Contrary to global trends, the usage rate of home surveillance devices in Vietnam is quite high (50%), while the global average is only 15% (according to data from Statista). Therefore, the surveillance camera market in Vietnam has great potential that we should focus on developing.

However, according to Mr. Vo Dang Thien (Deputy Editor-in-Chief of VietNamNet), most of these devices originate from China. Statistics show that about 90% of surveillance camera products in Vietnam are imported from this country through official and unofficial channels. Furthermore, some camera lines do not have servers located in Vietnam. With the current floating trade situation, consumers easily purchase uncertified models, leading to many concerns about information security and unauthorized data exploitation.

2. Status of Network Information Security for Surveillance Camera Devices

A camera may look simple, but it is a complex device featuring an operating system, software, audio and video recording functions, and two network interfaces: Wi-Fi and LAN. Additionally, these products usually operate 24/7 with minimal bug fixes, and almost no software updates or antivirus software. Consequently, if a vulnerability exists, the camera can become a spying device (especially AI-integrated devices), silently collecting and sending information to a third party. This poses a very serious risk to information security, necessitating more thorough control.

Indeed, the current difficulty in control has led to many major attacks targeting cameras worldwide. For instance, in 2023, hundreds of thousands of Hikvision cameras were attacked via password brute-forcing or old vulnerabilities; although the manufacturer issued patches, users failed to update them. Another case involved 150.000 Verkada cameras used in gyms, prisons, schools, and hospitals being attacked in the US in 2021. Despite having multi-factor authentication, hackers gained privileged access to the firm’s cameras by bypassing authentication layers.

In Vietnam, fortunately, no major incidents have been recorded, but the alarm regarding Network Information Security risks from cameras is very serious, for example:

In 2014, a website was discovered advertising live feeds from 730,000 different cameras worldwide without passwords, including over 1,000 in Vietnam (this website still exists and is continuously updated).
In 2020, according to a Vietnamese survey, the number of cameras with un-updated passwords reached 70%.
In 2023, some hackers offered access to cameras in Vietnam for sale, with some systems involving over 100,000 cameras. The cost to view was modest, only about 800,000 VND to access 15 cameras.

Attacked cameras leave consequences for both individual users and organizations, such as violated privacy, being monitored, and the leakage of personal information or business secrets, leading to blackmail, fraud, and intellectual property theft. Investigations show that the lack of Network Information Security in general, and specifically from surveillance cameras, stems from many causes ranging from the manufacturing stage to how consumers use them.

3. Recommendations for Safe Camera Usage

In many countries around the world, the proportion of consumers choosing to use cameras of unknown origin due to low costs is very high. To ensure information security for users, many countries have introduced clear laws to prevent this issue. For example, the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 calls for a ban on “telecommunications and video surveillance equipment or services” that are not NDAA-compliant, requiring the use of NDAA-compliant cameras in the U.S. However, most current security standards for IP Cameras are typically for monitoring devices within security systems, which differs from information security for surveillance cameras.

Recognizing the risks to Network Information Security from surveillance cameras, the Ministry of Information and Communications (MIC) issued Decision No. 724/QĐ-BTTTT regarding the set of criteria for basic Network Information Security requirements for surveillance cameras on May 07, 2024. To develop these criteria, the MIC collaborated with camera manufacturers in Vietnam and Network Information Security enterprises through meetings and discussions. Thus, this set of criteria represents an effort and a harmonious, receptive combination between State management agencies and the industry.

Mr. Tran Dang Khoa (Deputy Director General in charge of the Authority of Information Security) stated that whether a device poses a risk to Network Information Security or not, if the end-user lacks skills, the risk still exists. Therefore, it is necessary to focus on three main points: first, technology; second, management; and third, awareness. Specifically:

Camera Manufacturers: Comply with national technical regulations; cooperate with competent organizations to ensure compliance and improve product quality; establish alliances to research, share experience, and meet market needs.
Management Agencies and Organizations: Establish regulations and procedures to ensure security for camera systems; conduct periodic evaluations of security camera systems; monitor the cybersecurity of related components; and regularly update patches.
End-Users: Choose cameras with clear origins and transparent video storage locations; implement security measures such as changing passwords immediately upon handover and using strong passwords; select appropriate placement for cameras; and frequently monitor and update device patches.

At this seminar, all parties provided positive feedback and confirmed their ability to meet the technical requirement criteria for surveillance cameras. Representatives from these enterprises evaluated the new criteria as a “wake-up call” regarding the risks of information insecurity. A representative from Viettel Telecom also proposed accelerating the development of the national technical regulation for cameras and establishing an alliance to strengthen cooperation between manufacturers and the MIC to raise public awareness about the Network Information Security of surveillance cameras in the near future.

II. The Surveillance Camera Market in Vietnam

As mentioned in Part I, Vietnam is identified as a high-potential market for surveillance camera products. Ms. Vu Nguyet Lan, representative of MK Vision Joint Stock Company, remarked: “Regarding the current camera market in Vietnam, about 90% are Chinese cameras because the domestic market is still small. If there are cameras with a Vietnamese logo, users will feel more secure.”

Mr. Vo Dang Thien emphasized: “The issuance of standards for cameras and the proactive production of ‘Make in Vietnam’ cameras are urgent needs to ensure safety and Network Information Security for Vietnam.” Consequently, there is a requirement for a set of regulations for these open management platforms and support policies strong enough for these enterprises to survive domestically before expanding to international markets.

Regarding competition with foreign camera equipment, business representatives noted that while the Vietnamese market has great potential, it faces difficulties due to unfair competition and pricing issues. Participants expressed a desire for government support through policies and technical measures to ensure personal data security via cameras. They also suggested that domestic enterprises must unite to succeed, though they recognized this as a challenge since members may be market rivals.

Most representatives agreed that the set of technical criteria is an important and necessary step to ensure the quality and safety of domestic camera products. It can be said that the criteria issued by the MIC provide an opportunity to create “Make in Vietnam” camera products that can compete in the market and enhance the reputation of the Vietnamese camera industry. Furthermore, parties proposed cooperation and links between domestic enterprises to leverage the strengths of each unit and reduce production costs. They also recommended the establishment of an association, alliance, or club to jointly research, share technical knowledge, and propose support policies from higher levels.

III. Decision No. 724/QĐ-BTTTT Issuing the Set of Criteria for Basic Network Information Security for Surveillance Cameras

Decision No. 724/QĐ-BTTTT was issued by the Ministry of Information and Communications (MIC) on May 07, 2024, introducing the Set of Criteria for basic Network Information Security requirements for surveillance cameras, effective from the date of signing. The content of these criteria has been updated by Phuc Gia here; currently, this decision is recommended for application by Vietnamese and foreign organizations and individuals involved in the research, development, production, evaluation, selection, and use of camera equipment.

According to Mr. Tran Dang Khoa (Deputy Director General in charge of the Authority of Information Security), the MIC is currently coordinating with units, enterprises, and experts to develop a national technical regulation on basic Network Information Security requirements for surveillance camera equipment. This regulation is expected to be issued in 2024. Once active, all cameras produced in Vietnam or imported must undergo inspection, evaluation, and certification of conformity to meet national technical requirements before they are eligible for the Vietnamese market and provided to users.

Additionally, the Ministry of Information and Communications (now managed under the Ministry of Science and Technology) has officially issued QCVN 135:2024/BTTTT regarding basic information security requirements for Internet Protocol surveillance cameras. The issuance of this regulation helps protect national information systems, individuals, and organizations from escalating and complex cyber threats arising from surveillance camera devices.

For more details, please contact us at:

PHUC GIA LABORATORY CORPORATION

PHUC GIA CERTIFICATION CENTER

PHUC GIA INSPECTION TESTING CENTER

Address: