Your CCTV is on the internet. Is anyone looking after it?

Most businesses have more things on their network than computers. A CCTV recorder, a door entry panel, an alarm, the heating controls, a smart TV in the meeting room. This guide shows you how to secure CCTV and smart devices in your business, step by step, without needing to be technical.

It matters because this kit is now a favourite target. It’s often installed by a contractor, set up so they can log in remotely, then left alone for years with its original password and no updates. The supermarket fridge hack is what happens when someone finally uses that access.

Why smart devices are an easy way in

• Nobody owns them. They’re not on the IT list, so they don’t get the same care as laptops.
• Default passwords. Plenty of older kit still uses the login it shipped with, and those lists are public.
• Old software. Many devices never get updated, and older models stop getting security fixes altogether.
• Open to the internet. To make the phone app or the installer’s remote access work, the device is often reachable by anyone who finds it.
• Same network as everything else. Once someone is in the CCTV recorder, your office computers may be only one step away.

How to secure CCTV and smart devices, step by step

1. Make a list. Walk the building and write down everything connected that isn’t a computer or phone: CCTV cameras and recorder, door entry and access control, alarm panel, heating and air conditioning controls, smart TVs and screens, printers, EV chargers, cold rooms. Note the make, the model, who installed it and who looks after it.
2. Find out what can be reached from the internet. Ask each installer directly. Then ask whoever manages your router to check for “port forwarding” rules and whether UPnP is switched on, because that’s how devices usually end up exposed. If you can see your cameras from your phone, find out how: through the maker’s secure app service, or through an open connection straight to the recorder.
3. Change every default password. Give each device its own long, unique password and keep them in a business password manager, not on a sticker inside the cabinet. Remove old installer or “guest” accounts you don’t use.
4. Update the software. Ask the installer to apply the latest firmware and to check how long the maker will keep providing security updates. Turn on automatic updates where the device offers them.
5. Take login pages off the open internet. Remote viewing and remote support should go through a VPN or the maker’s secure remote service, ideally protected by multi-factor authentication. Remove port forwarding rules nobody can justify, and switch off UPnP on the router if nothing needs it.
6. Put them on their own network. Ask your IT provider to move building kit onto a separate network (often called a VLAN) from your office computers, so a compromised camera can’t reach your files or email.
7. Replace or isolate anything out of support. If the maker no longer issues updates, plan to replace it. Until then, keep it off the internet and away from everything else.
8. Make sure someone notices problems. Set up alerts that reach a real person, for example when a camera goes offline, a door is held open or a temperature drifts. Know what you’d do manually if a system stopped working.

Questions to ask your installer

You don’t need to understand the answers in detail. Vague or uncertain answers are the warning sign.

• Can this system be reached from the internet, and if so, how?
• How do you log in remotely, and who in your company can do it?
• Is that remote login protected by MFA or a VPN?
• Has every default password been changed, and where are the new ones kept?
• When was the software last updated, and until when will the maker support this model?
• Is it on a separate network from our office computers?
• Will you tell us if you find a security problem with it?

If you regularly work with contractors who have access to your systems, it’s worth asking the same questions in writing. My guide to supplier security questionnaires covers what good answers look like.

Buying new kit

Since April 2024, UK law (the Product Security and Telecommunications Infrastructure regime) has stopped makers of consumer smart devices using universal default passwords, and requires them to say how long they’ll provide security updates and how to report a problem. Plenty of business kit isn’t covered, and anything older won’t meet it, so before you buy, check:

• It forces you to set your own password during setup.
• The maker states a minimum security update period, and it’s at least as long as you plan to keep the device.
• Remote access works through a secure service with MFA, without opening ports on your router.
• The installer will put it on a separate network and hand over the admin details to you.

How this fits with Cyber Essentials

Cyber Essentials checks how your router and firewall are set up, including anything opened up to the internet, and expects you to remove or replace software that no longer gets security updates. Tidying up your building kit helps with both. The free Cyber Essentials readiness check will show you where else you stand.

If a device is already behaving strangely, settings have changed on their own or footage has gone missing, disconnect it from the internet, call the installer and check whether anything else on the network has been touched. If you think it’s gone further, treat it as a cyber incident and get help quickly.

FAQ

Is it safe to watch our CCTV on a phone?

It can be, if it works through the maker’s secure app service with a strong password and MFA. It’s much riskier if the app connects straight to a recorder that’s been opened up to the internet. Ask your installer which one you have.

Do we need to replace our old CCTV system?

Not straight away. If it still works but no longer gets updates, take it off the internet, put it on its own network and change the passwords. Then plan a replacement, rather than waiting for it to cause a problem.

Who’s responsible, us or the installer?

You are, because it’s your business and your network. A good installer will help, but make sure you know who has access and that you hold the admin passwords yourself.

Does this apply to a small office with a smart doorbell and a couple of cameras?

Yes. Consumer kit like video doorbells and plug-in cameras is just as easy to forget about. The same steps apply: unique passwords, updates, MFA on the app and, ideally, a separate network.