Hikvision Cybersecurity Director on Multi-Factor Authentication (MFA) to Reduce Security Concerns, Lower Risk of Password Being Hacked

May 29, 2019

Hikvision Chuck Davis Multi factor authentication blog article cybersecurity

In the last Hikvision blog, we discussed password management strategies and using password managers to reduce security concerns.         

Today, we’ll discuss multi-factor authentication to protect yourself online, and reduce the risk of having your password hacked.   

MFA: Multi-Factor Authentication for Protecting Your Online Accounts (Not a Master of Fine Arts)
You don’t need a Master of Fine Arts degree to use MFA (multi-factor authentication). Sorry for the acronym humor. MFA—multi-factor authentication—requires a user to provide an additional means of authentication or verification, in addition to entering a username and password, in order to log into an account or website.

Before we delve into MFA, let’s talk quickly about authentication. Traditionally, authentication is made up of two things, a username and a password.

The username is meant to be the identity of the account. This is not meant to be private or difficult to figure out. In fact, in most cases the username is meant to be public or at least visible to others who use the same system, service, network, etc.

The password is meant to be the secret that is exchanged to allow the user to access the system, service, network, etc. Using just a username and password is known as one-factor authentication because the user is verifying his or her identity with one piece of evidence or one factor

MFA adds two or more pieces of verifiable evidence or factors to the authentication process to greatly reduce security concerns by lowering the chances of an account being accessed by the wrong person. Two-factor authentication (2FA) is a subset of MFA and is a means of authenticating with just two pieces of verifiable evidence or factors. A good real-world example of 2FA is using an ATM. You use something you have, the ATM card, and something you know, your pin number.

There are generally four factors of authentication that are available for us to use today:    

  1. Something you have (i.e. a number generator like Google Authenticator)
  2. Something you know (i.e. a password or passphrase)
  3. Something you are (i.e. biometrics like fingerprint or facial geometry)
  4. Where you are (i.e. GPS location tracked by your phone or IP address location)

Below, I’ll explain some options that fit into each of these categories.

Hardware Token: Something you have

A hardware token can come in many forms. Back in the 90s, you could always tell the IT people in a company because they had little fobs on their keychains that had a small display with numbers changing every 30 seconds. This is known as a Time-based One Time Password (TOTP). While this is still an option today, most implementations of TOTP are executed using a mobile app or SMS message (see below). Another popular hardware token is the Yubikey. This is a hardware token that typically is plugged into a computer via USB however some Yubikeys support near field communication which supports devices without USB ports, like an iPhone. To use this token, you log in with your username and password, then, a field appears on the page that asks for the Yubikey authentication. Instead of typing into that field, the user plugs in the Yubikey and touches the sensor. With this physical connection, the key is entered by the Yubikey.

TOTP SMS: Something you have   

The SMS Time-based One Time Password (TOTP) is a text message or email with a numeric code, called a one-time password (OTP) because it is only good for one use. This method is less popular with cybersecurity professionals since it’s been shown to be weak compared to other options but it’s still MUCH better than only using a username and password.

Time-based One Time Password (TOTP) Token: Something you have

Another popular method is the use of a TOTP generator such as those found on the old hardware RSA keychain tokens or a smartphone app like Google Authenticator, LastPass, FreeOTP and others. These numbers change every 30 seconds based on a shared algorithm that the software token and the authentication server both know. There is no network or Internet communication needed to use the soft token. The image below shows the time-based token on a mobile phone and where it is entered into the webpage after the username and password are entered into Google.

Phone/e-mail: Something you have    

Two other TOTP MFA options are to receive a phone call or an email with the MFA code. While this is better than no MFA, it has been shown many times how easy it is for a threat actor to intercept or use this option without the knowledge of the user who owns the account.

Backup Codes: Something you have

Backup codes are provided to you when you set up MFA on many sites. The idea behind the backup codes is that you secure them in a safe locked desk/office, safe deposit box, or an encrypted vault, like your password manager. They are used only if you lose or do not have access to your regularly used MFA. For example, if your phone is stolen, you can no longer use the Google Authenticator. In this case, you could pull out your backup codes and login to your account.

Biometrics: Something you are

Biometrics became mainstream with fingerprint readers and facial recognition technology embedded in the mobile devices and laptops that we use every day. However in those implementations, biometrics is used as an alternative to the username and password rather than as another factor. We don’t see biometrics used much in MFA online these days, but the possibility is there to use it.

GPS: Where you are

GPS location is another factor that isn’t used much for MFA today, but is frequently tracked to find if accounts have been breached. Let’s say that Sally logs in to her company’s VPN from New York City at 8 a.m. on Monday and then logs in to the VPN server again at 10 a.m. from Paris. Obviously, she was not able to get from NYC to Paris in two hours, so the VPN server would deny that second connection and alert the cybersecurity team to investigate.    

QR: Something you have

QR Codes are growing in popularity as a method of authentication and in some cases, replacing username and passwords altogether. While this is currently not that common for most Internet users, there is technology in the works today that could make QR codes and cameras in phones and computers the replacement for username and passwords.   


  1. We all hate passwords, especially since we need to make them complex, which makes it difficult for us to remember them.
  2. Password managers allow us to create great passwords for all accounts.
  3. MFA will further secure an account by requiring more than just a username and password to authenticate.

MFA is offered on many of the most popular websites such as Google, Facebook, Twitter, and LinkedIn, however, most users don’t enable it.

Below are two websites that offer a searchable list of websites that support multi-factor authentication and instructions on how to enable MFA on those sites:


By using MFA as an additional security measure, you can reduce security concerns when logging into your accounts online. For additional cybersecurity insights from Hikvision, visit this link.

IMPORTANT! This model requires non-standard firmware. Do Not Install standard firmware (e.g. v.4.1.xx) on this model. Doing so will permanently damage your system. You must use custom firmware v.4.1.25 from the iDS-9632NXI-I8/16S product page.

View the most updated version of this document here:


The I-series NVR (such as the DS-7716NI-I4) is one of Hikvision's most popular and feature-rich recorders. As such, many firmware revisions have been introduced over the years to continually ensure the product is compatible with the newest technology available. Due to the many revisions, we recommend that the user closely follows the instructions below in order to reduce the amount of time spent as well as the chance of failure.


Database Optimization and Repair

As more affordable IP cameras are introduced over time with greater video resolution and data sizes, more efficient database management also becomes necessary. The introduction of firmware v4.0 brought about a new database architecture in order to be futureproof.


After upgrading to v4.X, the recorder database will need to be converted and optimized. If you are experiencing issues where playback is expected but not found, make sure "Database Repair" is performed as indicated in the procedures and scenarios below.


Preparing the Upgrade

Before proceeding with upgrade, it is recommended that NVR configuration file is exported from the NVR over the network or on to a local USB drive.


Upgrading from v3.4.92 build 170518 or Older

  1. All recorders must reach v3.4.92 before proceeding further. Upgrading from versions before v3.4.92 directly to any version of v4.X will likely cause the recorder to fail.
  2. If the recorder is already at v3.4.92, a full factory default is highly recommended before upgrading to any version of v4.X. There is a high chance of unit failure (requiring RMA) if the unit is not defaulted before upgrade.
  3. After reaching v3.4.92 and performing a full factory default, an upgrade directly to v4.50.00 is acceptable.
  4. After the upgrade is completed and the recorder is reprogrammed, it may be beneficial to perform a Database Repair. For details, refer to the section "Database Optimization and Repair" above.
  5. To verify repair progress, you may refer to the HDD status, or search the recorder log for repair started and stopped entries. Note that while the HDD is repairing, new recordings are still being made, but some existing recordings may not be searchable until repair is complete.
  6. If you continue to observe playback issues after database repair, ensure there are no power, network, or motion detection issues. Should the problem persist, contact technical support.


Upgrading from Any v4.X Build to v4.50.00.

  1. Any v4.X build can be upgraded directly to v4.50.00.
  2. Export configuration is highly recommended before performing the upgrade.
  3. If upgrading from any v4.X version that was not v4.22.005, a Database Repair is recommended. Refer to Step 4 and onwards in the previous section.



Downgrading is not recommended. Due to new features and parameters constantly being added, downgrading may cause the NVR to factory default itself or require a manual default to operate properly.

View the most updated version of this document here:
K-Series DVR upgrade instruction
The Turbo 4 Hybrid DVR K series has multiple models and across different platform and chipset. It also has similar firmware development of other recording product line; DVR K series has also introduced the GUI4.0 to ensure the series to be compatible to the newest technology available. The new database architecture is also brought into the DVR firmware v4.0 to be future proof and for better recording search experience. 

Database Optimization and Repair

As more affordable cameras introduced over time with greater video resolution and data sizes, more efficient database management also becomes necessary. The introduction of firmware v4.0 brought about a new database architecture in order to be futureproof.
After upgrading to v4.X, the recorder database will need to be converted and optimize. If you are experiencing issues, where playback is expected but not found, please make sure to perform "Database Rebuild" as indicated in the procedures and scenarios below.

Preparing the Upgrade

Before proceeding with upgrade, it is recommend exporting DVR configuration file from the DVR over the network or on to a local USB drive.


Action after firmware upgraded 

1. Upgrade the DVR according to the chart above. 

2. Reconfirming Channel's Recording Schedule 

    - Confirm channel's recording schedule is enable. 

    - Check if the channel is on correct recording schedule.

3. Double Check Storage Setting

    - Make sure all channel are assigned to record on its HDD group when the Storage setting is under Group Mode. 

4. Perform Database Rebuild locally. 

    • Some version above support Database Rebuild via web access - K51 and K72

    • Perform Database Rebuild regardless if system is having any database issue symptom. 

    • Database Rebuild process is average ~30 to 60min per TB. The process may still varies depends recording data.

    • After Database Rebuild - Check log to confirm Database Rebuild has went thru properly. 

    • If Database Rebuild Started and Stopped log has been log only within few minutes. Database rebuild may not has been completed properly. It is strongly recommend performing the Database Rebuild again.

    • To check log > System > Log > Information > Database Rebuild Started and Stopped.

    • If the log option is not available - access system via SSH can also obtain similar result.

5. Recording Data is still missing after database rebuild process. 

If the data has not been recorded or has been overwritten, Database rebuild process is not able retrieve those lost data. Have the system upgraded to the latest available firmware version above to prevent any future data lost is strongly recommended for all application.





By downloading and using software and other materials available via this website, you agree to be legally bound by HIKVISION General Terms of Use . If you don’t agree to these terms, you may not download or use any of those materials.

If you are agreeing on behalf of your company, you represent and warrant that you have legal authority to bind your company to the General Terms of Use above. Also you represent and warrant that you are of the legal age of majority in the jurisdiction in which you reside (at least 18 years of age in many countries).