IP camera cyber security: Israeli warnings, US restrictions and what to do in practice

An IP camera is a computer in every sense: it has an operating system, network services, passwords and firmware updates. That makes it a target, from takeover for spying to using the camera as an entry point into the corporate network. The issue made headlines in Israel especially from October 2023.

What the Israel National Cyber Directorate published

The Israel National Cyber Directorate (INCD) issued warnings to camera owners (October 2023, updated in 2024), followed by an urgent call to disconnect cameras from the internet or restrict access to them, after attempts to take over cameras for intelligence gathering were identified. The INCD's recommendations document for security cameras states that tens of thousands of internet-exposed cameras were found in Israel in 2022. The INCD does not approve or reject specific manufacturers; its recommendations deal with configuration, updates and how cameras are connected.

US restrictions

In the United States there are regulatory restrictions on equipment from certain Chinese manufacturers, including Hikvision and Dahua:

• Section 889 of the FY2019 NDAA prohibits federal agencies from procuring video surveillance equipment from these manufacturers for certain purposes, and from contracting with entities that use it.
• The FCC has included these manufacturers on its Covered List since 2021.
• In FCC 22-84 (November 2022), the FCC prohibited new equipment authorisations for these manufacturers' video surveillance equipment for public safety, government facilities, critical infrastructure and national security purposes, pending approved marketing plans. Existing authorisations were not automatically revoked.

In Israel we found no official general prohibition on using any specific manufacturer's cameras across the economy. Research bodies such as the Institute for National Security Studies (INSS) recommended in 2026 considering a gradual transition at sensitive sites. Organisations in sensitive sectors, government suppliers or companies with US operations should check the requirements that apply to them.

Zohar Cameras works with several manufacturers and authorised distributors, so equipment can be matched to the client's requirements and policy without dependence on a single vendor.

The European and UK context

The EU adopted the Cyber Resilience Act, which will gradually require manufacturers of products with digital elements to meet security requirements and provide updates, with most obligations applying from late 2027. In the UK, the PSTI Act came into force in April 2024 and, among other things, bans universal default passwords on connected products. These trends are expected to affect the whole camera market, including Israel.

Practical hardening steps

• Do not expose cameras and recorders directly to the internet (port forwarding). Use VPN or a secure cloud solution for remote access.
• Replace default passwords with strong, unique ones and manage users by permission.
• Update firmware regularly and replace equipment the manufacturer no longer supports.
• Separate the camera network from the corporate network (VLAN, firewall).
• Disable unused services such as UPnP, P2P or Telnet.
• Document all equipment: model, firmware version, IP address and location.
• Include periodic checks in the service contract.

What a typical attack looks like

In most cases no sophisticated hacking is needed. Dedicated search engines scan the internet and find exposed devices; the attacker then tries default passwords or exploits a known vulnerability in un-updated firmware. Once taken over, the camera can be used for viewing, disruption, or as a stepping stone into the internal network. That is why the two basic steps, removing direct internet exposure and using strong passwords, block a large part of the risk.

A short self-check for organisations

• Are there open ports on the router forwarding to the recorder or cameras?
• When was firmware last updated, and is the model still supported?
• Who holds the admin password, and is it unique per site?
• Is the camera network separated from the computer network?
• Are the manufacturer's P2P/cloud services enabled, and is that intentional?

Managing risk when choosing equipment

An organisation that wants to follow a particular vendor policy can write it into its requirements document: a list of permitted manufacturers, a requirement for security updates for a defined period, and the ability to disable cloud services. The decision is then made upfront and transparently, not after the fact.

What about existing systems

Replacing an existing system wholesale is a business and budget decision. In many cases risk can be reduced significantly right away through hardening, separation and updates, with gradual replacement planned by site sensitivity, similar to the recommendations published for sensitive sites.

Manufacturer P2P and cloud services

Many cameras and recorders include an "easy connect" service to the app via the manufacturer's cloud (P2P). It is convenient, but it means the device communicates out to external servers. An organisation should decide consciously whether that is acceptable: if so, protect the account with a strong password and extra authentication; if not, disable the service and use VPN or an approved management solution. The decision should be documented, not left to a default.

Firmware updates in practice

A firmware update is not always one click: check compatibility with the recorder and software, update one device first as a test, and back up settings beforehand. A service contract should define how often available updates are reviewed.

Summary

Cyber security in low-voltage systems is not about one manufacturer but about design, configuration and maintenance. An organisation evaluating new equipment should combine the regulatory requirements relevant to it, the INCD recommendations and basic hardening, and so significantly reduce risk.