Reset

Hikvision Senior Director of Cybersecurity: Tips to Improve Security While Working From Home, Ways to Reduce Hacks, Concerns

April 30, 2020

Hikvision HikWire blog article Network Segmentation on Your Home Computer Network

Implement Network Segmentation on Your Home Computer Network for Improved Security

 

As more people are working from home (WFH) due to coronavirus, Hikvision’s senior director of cybersecurity, Chuck Davis, is providing tips to improve security, reduce hack risks, and ease concerns while working remote.

Work From Home (WFH) Threats & Hacks
Fear that your work computer is a “zombie” computer controlled by a threat actor or hacker has likely not been high on the list of concerns for most new work-from-home employees in recent weeks. But the unfortunate fact is that your work computer might be the device that lets a threat actor into your home network. According to research conducted by cybersecurity companies, Arctic Security and Team Cymru, more than 50,000 U.S. organizations have sent their employees to a work-from-home environment with malware-infected computers.

How did this happen? The typical home network and the typical corporate network are very different. On a corporate network, your computer is well-protected. Firewall rules and cybersecurity tools block certain types of traffic that is known to be malicious or suspicious, so that if a device becomes infected, the malware is unable to reach a threat actor on the Internet. This is sometimes not the case when an employee takes their work computer outside of the corporate network to work at home. Without the corporate network cybersecurity tools in place, the malware can successfully reach the threat actor, thereby giving them access to your computer and the network on which it is running. These days, that network is likely your home network. Now, your malware-infected “zombie” computer is silently under the control of a threat actor who can see and possibly control your computer and explore your home network.

“Our analysis indicates that the employees’ computers were already hacked before COVID-19 made the news, but were lying dormant behind firewalls, blocking their ability to go to work on behalf of the threat actors. Now those zombies are outside firewalls, connected to their corporate networks via VPNs, which were not designed to prevent malicious communications,” said Lari Huttunen, senior analyst at Arctic Security, in the Businesswire press release

These findings should be eye-opening for work-from-home employees and their employers. Team Cymru experts say that this research provides organizations with an unprecedented opportunity to assess the extent of compromise within their organizations, rather than hiding behind a “block and forget” security mentality. “Block and forget” means that the organization’s cybersecurity team block’s outgoing malicious traffic and then they forget about the issue, rather than finding and removing the malware.

While the cross-infection of networks is not a new problem, the massive amount of people suddenly working from home has illuminated how many companies follow the dangerous “block and forget” method of managing cybersecurity.

What Can Organizations Do?
Organizations need to address the problems, not the symptoms. The problem is that a computer is running malicious code and just blocking its ability to communicate with a botnet or threat actor doesn’t solve the problem. Organizations need to get rid of the malware itself. There is an old cybersecurity saying that states: “If a computer is infected with malware, it can no longer be trusted.”

If an organization practices the “block and forget” method, the malware can’t reach a threat actor on the Internet to give them access to your computer. However, unless the malware is analyzed or removed, there is no way of knowing if the malware is doing something else malicious. Just blocking known communications channels is dangerous. Organizations must identify threats and remove them, like re-imaging or replacing infected systems.

Ultimately, the best option for organizations is to put security tools on each endpoint and implement a zero trust network, which means that the corporate network is treated much like a public network where no device is trusted and nothing is available to devices (like printers or network shares or web services) unless specifically provisioned to a device and/or user. This is a difficult thing to implement and it takes a lot of time and effort unless you have the luxury of building your zero trust network from the ground up.

What Can Employees Do?
The best thing that you can do to protect your home network is to implement home network segmentation. You can read more about that in Hikvision’s network segmentation blog. Below are three simple and effective things you can do today (without purchasing anything) to boost your network security:

  1. Firmware Updates: Log into your home router and check to see if there are any firmware updates. There likely are and unfortunately, many routers do not update themselves. Try to remember to do this at least a few times per year if not every month. And, for your next router, be sure it supports automatic updates.
     
  2. Operating System Updates: This should happen automatically each month, but just in case, check to see if your operating system has any security updates. Here are instructions for Windows and macOS.
     
  3. Guest Network: See if your home router offers a guest network. Most do these days and it is there to give Internet access to the guests in your home without giving them access to the devices on your home network. Activate the guest network with WPA-2 and create a good password. This is now your “work” network and will isolate your work computer from your personal devices but still give you Internet access so you can VPN into work, video conference, and surf the web without fear of a malware infected “zombie” work computer spreading the malware to your personal devices.

Historically, organizations have been very concerned about personal devices on their network. The Bring Your Own Device (BYOD) craze of a decade ago had cybersecurity teams working hard to give employees a way to stay connected with their smart phones and tablets without giving them intranet access. They did this by creating guest networks. Now the tables have turned and based on the research by Arctic Security and Team Cymru, the threat of malware coming from a work asset is a reality. It’s time to take control of your home network and isolate those work devices from your home network assets.

For more work from home tips to reduce risk of hacks and other threats, read this blog from Hikvision’s WFH series: “Hikvision Senior Director of Cybersecurity: Work From Home Tips to Improve Security and Reduce Hacks, Ease Concerns.”

IMPORTANT! This model requires non-standard firmware. Do Not Install standard firmware (e.g. v.4.1.xx) on this model. Doing so will permanently damage your system. You must use custom firmware v.4.1.25 from the iDS-9632NXI-I8/16S product page.

View the most updated version of this document here:

https://techsupportca.freshdesk.com/en/support/solutions/articles/17000113531-i-series-nvr-firmware-upgrade-instructions

 

The I-series NVR (such as the DS-7716NI-I4) is one of Hikvision's most popular and feature-rich recorders. As such, many firmware revisions have been introduced over the years to continually ensure the product is compatible with the newest technology available. Due to the many revisions, we recommend that the user closely follows the instructions below in order to reduce the amount of time spent as well as the chance of failure.

 

Database Optimization and Repair

As more affordable IP cameras are introduced over time with greater video resolution and data sizes, more efficient database management also becomes necessary. The introduction of firmware v4.0 brought about a new database architecture in order to be futureproof.

 

After upgrading to v4.X, the recorder database will need to be converted and optimized. If you are experiencing issues where playback is expected but not found, make sure "Database Repair" is performed as indicated in the procedures and scenarios below.

 

Preparing the Upgrade

Before proceeding with upgrade, it is recommended that NVR configuration file is exported from the NVR over the network or on to a local USB drive.

 

Upgrading from v3.4.92 build 170518 or Older

  1. All recorders must reach v3.4.92 before proceeding further. Upgrading from versions before v3.4.92 directly to any version of v4.X will likely cause the recorder to fail.
  2. If the recorder is already at v3.4.92, a full factory default is highly recommended before upgrading to any version of v4.X. There is a high chance of unit failure (requiring RMA) if the unit is not defaulted before upgrade.
  3. After reaching v3.4.92 and performing a full factory default, an upgrade directly to v4.50.00 is acceptable.
  4. After the upgrade is completed and the recorder is reprogrammed, it may be beneficial to perform a Database Repair. For details, refer to the section "Database Optimization and Repair" above.
  5. To verify repair progress, you may refer to the HDD status, or search the recorder log for repair started and stopped entries. Note that while the HDD is repairing, new recordings are still being made, but some existing recordings may not be searchable until repair is complete.
  6. If you continue to observe playback issues after database repair, ensure there are no power, network, or motion detection issues. Should the problem persist, contact technical support.

 

Upgrading from Any v4.X Build to v4.50.00.

  1. Any v4.X build can be upgraded directly to v4.50.00.
  2. Export configuration is highly recommended before performing the upgrade.
  3. If upgrading from any v4.X version that was not v4.22.005, a Database Repair is recommended. Refer to Step 4 and onwards in the previous section.

 

Downgrading

Downgrading is not recommended. Due to new features and parameters constantly being added, downgrading may cause the NVR to factory default itself or require a manual default to operate properly.

By downloading and using software and other materials available via this website, you agree to be legally bound by HIKVISION General Terms of Use . If you don’t agree to these terms, you may not download or use any of those materials.

If you are agreeing on behalf of your company, you represent and warrant that you have legal authority to bind your company to the General Terms of Use above. Also you represent and warrant that you are of the legal age of majority in the jurisdiction in which you reside (at least 18 years of age in many countries).