OT cyber security for low-voltage systems: the network behind cameras and controllers

When people talk about cyber security in an organisation, they usually think about computers, servers and email. But an average building has dozens or hundreds of other networked devices: cameras, recorders, door controllers, alarm panels, intercoms, HVAC and lift controllers. These are OT (Operational Technology) systems, and they have very different characteristics from office computers.

Why OT is different

• Equipment runs for many years and does not always receive updates.
• It is often installed and managed by outside vendors, not by IT.
• It must keep running: you cannot "switch off for a moment" a fire detection or access control system.
• Remote access by technicians is a daily need and is sometimes set up insecurely.

Principles from IEC 62443

The IEC 62443 series is the accepted international framework for securing industrial automation and control systems. Several key principles are also relevant to low voltage:

• Division into zones and controlled communication paths (conduits) between them.
• Defence in depth: several layers of protection, not a single wall.
• Least privilege for every user and component.
• Lifecycle management: updates, replacing unsupported equipment, documentation.

Practical steps

• A separate network (VLAN) for each family of systems, with a firewall that allows only necessary traffic.
• Remote access through a single controlled point, with strong authentication and logging, not remote-desktop tools or open ports for every vendor.
• An up-to-date inventory of all components: model, firmware, address, owner.
• Unique, managed passwords, and removal of accounts for vendors or employees who have left.
• Configuration backups for recorders, controllers and panels.
• Basic monitoring: an alert when a device disconnects or unusual traffic appears.

Regulation and recommendations in Israel

The Israel National Cyber Directorate publishes recommendations and a defence methodology for organisations, including specific guidance for cameras and IoT systems. After October 2023, warnings were issued about attempts to take over cameras. Organisations in regulated sectors (finance, energy, health and others) are sometimes subject to guidance from a dedicated regulator. Beyond that, Amendment 13 to the Protection of Privacy Law raises the bar for securing personal data, including video.

Cooperation between IT and the contractor

Success depends on working together: the IT department defines policy and network, and the contractor installs and maintains equipment accordingly. It is worth setting a cyber requirements document for contractors in advance, including it in the contract, and carrying out a periodic joint review.

Example: vendor remote access

In one organisation the camera vendor, the HVAC vendor and the access control vendor may each connect their own way: remote-control software, an open router port, or a cellular modem in the cabinet. Each of these is an opening into the network. The accepted solution is a single controlled access point: every vendor connects through it, with a personal user and strong authentication, only to their own network and at defined times, and every session is logged.

An example network structure

• Office network: computers and servers.
• Security network: cameras, recorders, access control and alarms.
• Building network: HVAC, lifts, lighting.
• Guest network: internet access only.

A firewall between the networks allows only necessary traffic: for example, the security viewing station may reach the recorder, but cameras cannot reach the office network.

Equipment lifecycle

Low-voltage equipment is sometimes installed for a decade or more, but manufacturer security support is time-limited. Keep a list with installation date and support status for each component, and plan replacement of unsupported equipment, especially devices exposed to other networks.

Incident response

Even with good protection, you need to know what to do when something happens: how to isolate a suspicious device without shutting down the whole system, who notifies whom, and how to restore settings from backup. A short written procedure saves valuable time.

A cyber requirements document for contractors: what to include

• No direct internet exposure of equipment and no port opening without approval.
• Default passwords changed and handed to the client securely.
• Remote access only through an approved point.
• Firmware updated at installation and versions documented.
• A full equipment list at handover, including addresses and locations.
• An obligation to report suspicious events.
• Confidentiality of the client's data and video.

Such a document makes expectations clear and lets you check compliance.

Periodic joint review

From time to time, IT and the contractor should go through the list together: is there new undocumented equipment, unused accounts, or equipment out of support? A short review like this prevents "security debt" from building up.

Working with regulators and insurers

Insurers and large clients increasingly ask about the security of connected systems. An organisation with an equipment list, a remote access policy and update records can answer such questionnaires quickly and credibly. The same documentation helps IT during a fault and the contractor on every service visit.

Summary

Low-voltage systems are part of the corporate network and therefore part of the risk. Separation, controlled access, updates and documentation are not luxuries; they are the basis for enjoying the benefits of connected systems without opening a back door into the network.