Hanwha Vision NVR Network Device Security Enhancement Guide

1. Introduction

In recent years, network surveillance devices, developed to protect customer assets and personal information, have paradoxically become a means to steal personal information. Network surveillance devices process and manage video footage, which can contain sensitive personal information. As they communicate over networks, they allow remote access from anywhere in the world. Due to this characteristic, network surveillance devices are constant targets of cyberattacks.

Hanwha Vision, valuing customer assets and personal information, has continuously strived to enhance cybersecurity. This guide aims to help users understand the security features implemented in our products and use them safely.

2. Cybersecurity Level Definition

This guide defines cybersecurity levels based on the following criteria, with each level presupposing the achievement of the previous level:

• Basic Level: Refers to the security level achievable with the basic functions provided by the device without any additional user configuration.
• Protection Level: Refers to the security level achievable with the default settings of the device in its initial state or after a factory reset.
• Safe Level: Refers to the security level that can be enhanced by the user disabling unnecessary features or services that could potentially weaken security.
• Top-tier Safe Level: Refers to the security level that can be enhanced by integrating additional external security solutions with the device's built-in security features.

Note: If the initial setting is 'Default', it means the option is provided as is and not selectable by the user. If it is indicated by a dash (-), it means the option is not available, and the activity needs to be performed.

3. Basic Level

Hanwha Vision devices are designed considering cybersecurity, ensuring safety with their basic functions or default settings upon purchase.

3.1. Enforce Complex Password Settings

Hanwha Vision device passwords must be at least 8 characters long and meet complexity requirements (e.g., using a mix of uppercase letters, lowercase letters, numbers, and special characters). This feature helps prevent weak password creation and reduces the risk of unauthorized access.

3.2. Remove Initial Password

To prevent security vulnerabilities, Hanwha Vision devices require users to change the default password upon initial setup. This ensures that unauthorized users cannot access the device with the factory-set password.

3.3. Limit Input on Consecutive Password Failures

To prevent brute-force attacks, the device limits input for 30 seconds after 5 consecutive failed password attempts. This measure enhances security by blocking unauthorized access attempts while maintaining existing authenticated connections.

3.4. Disable Remote Services (Telnet, SSH)

Hanwha Vision products disable remote services like Telnet and SSH to enhance security, as these services can be exploited by malicious actors.

3.5. Encrypt Environment Settings

Environment settings are encrypted during the backup process to protect sensitive user information. This ensures that exported configuration files remain secure.

3.6. Encrypt Firmware and Ensure Secure Updates

Hanwha Vision provides encrypted firmware for secure updates. The firmware's integrity is verified during the update process to prevent the use of tampered firmware and protect against malware injection.

3.7. Watermarking and Encryption of Extracted Video Formats

Video files extracted in SEC format by Hanwha Vision NVRs are protected with watermarking and encryption, preventing unauthorized access and tampering. The SEC format includes a built-in player for easy playback.

3.8. Retain Logs Upon Initialization

Device logs are protected from deletion or reset, ensuring that security event data is available for analysis and forensic investigation.

3.9. HTML5 Streaming-Based NonPlug-in Web Viewer

The NVR supports HTML5 streaming for a secure and convenient web viewing experience, eliminating the need for vulnerable browser plug-ins.

3.10. Encrypt Important Information

User authentication credentials (ID, password) for network functions are securely stored using advanced encryption algorithms to protect sensitive information.

3.11. Individual Device Authentication

Hanwha Vision devices support device authentication using certificates to ensure secure communication between devices and prevent man-in-the-middle attacks.

4. Protection Level

Hanwha Vision devices are inherently secure with their default settings, providing basic protection even after a factory reset.

4.1. Factory Reset

Performing a factory reset on a used device restores its default settings, achieving the Protection Level of security.

4.2. Disable Unused Multicast

For RTSP protocol, multicast settings can be configured. If this service is not needed, disable it to enhance security.

4.3. Disable Unused DDNS

If DDNS and UPnP services are not required, disable them to enhance security. These services can be exploited if not properly secured.

5. Safe Level

Hanwha Vision devices allow users to enhance security by disabling unnecessary services and ports that could be exploited by external threats.

5.1. Check for and Update to the Latest Firmware Version

Users can check for the latest firmware versions on the Hanwha Vision website and download them for installation. This ensures devices are protected against known vulnerabilities.

5.2. Set Accurate Date and Time

Accurate date and time settings are crucial for analyzing system logs and identifying security events. Users can configure the device's time settings to match their local time zone.

5.3. Use Secure Communication Protocols (HTTPS)

Hanwha Vision NVRs support both HTTP and HTTPS. HTTPS provides encrypted communication, protecting sensitive data transmitted between the NVR and clients.

5.4. Use Secure Communication Protocols (RTSP)

To secure video streams transmitted via RTSP, it is recommended to tunnel RTSP over HTTPS. This involves configuring both the IP camera and the NVR for HTTPS streaming.

5.5. HTTPS (Self-signed Certificate)

This feature allows secure connections using a self-signed certificate provided by Hanwha Vision, eliminating the need for users to obtain and install their own certificates.

5.6. HTTPS (Public Certificate)

Users can register their own public certificates and private keys to enable secure HTTPS connections. This provides an additional layer of security for data transmission.

5.7. Change Default Ports

Modifying default port numbers (e.g., changing HTTP from port 80 to 8000) makes it more difficult for attackers to scan for and exploit services. Users should ensure that any changes to port numbers do not disrupt connectivity with other devices.

5.8. IP Filtering

IP filtering allows users to create lists of allowed or blocked IP addresses, controlling network access and enhancing security. Users can configure rules for both IPv4 and IPv6 addresses.

5.9. Securely Use SNMP

It is recommended to use SNMP v3 for secure network device management. While SNMP v1 and v2c are supported, users should change the default community strings to enhance security.

5.10. Change Administrator Account and Create Additional User Accounts

Changing the default administrator account ('admin') and creating user-specific accounts with limited privileges is crucial for security. This prevents unauthorized access and reduces the risk of credential exposure.

5.11. Restricted Settings

Users can configure access restrictions for specific features and network access. This includes setting user access limitations and configuring automatic logout after a period of inactivity to enhance security.

5.12. Log Inspection

Regular inspection of system logs is essential for identifying security incidents, troubleshooting issues, and ensuring compliance with regulations. Logs provide valuable information about system events, errors, and potential security breaches.

6. Top-tier Safe Level

Hanwha Vision devices offer advanced security features and can be further enhanced by integrating external security solutions.

6.1. 802.1x Certificate-Based Access Control

Network devices can be secured with port-based access control using 802.1x authentication. This requires an 802.1x-compatible network switch, an authentication server, and device-specific certificates and private keys. Users can configure these settings through the NVR's interface.