Network Security Checklist

Network Security Checklist 

Your business faces threats on many fronts, and the more users, devices, and applications you add, the more vulnerable your network becomes.

Network security is any activity designed to protect the usability and integrity of your network and data. It includes both hardware and software technologies. Effective network security manages access to the network. It targets a variety of threats and stops them from entering or spreading on your network.

Network security combines multiple layers of defences at the edge and in the network. Each network security layer implements policies and controls. Authorized users gain access to network resources, but malicious actors are blocked from carrying out exploits and threats.

Digitization has transformed our world. How we live, work, play, and learn have all changed. Every organization that wants to deliver the services that customers and employees demand must protect its network. Network security also helps you protect proprietary information from attack. Ultimately it protects your reputation.

Major China manufacturers like Dahua, HikVision, Uniview are not impacted, from everything we have seen. We executed the proof of concept code from the disclosure on multiple devices and were unable to gain access using the backdoor.

The backdoor primarily impacts devices using HiSilicon SOC with Xiongmai software, which is dozens of small OEM manufacturers, using minimally modified OEM firmware, Open Source OS and drivers, and enabling telnet on port 9530.

For Firewalls 

SL No	Guidance	Compliance
1	Update the router to the latest firmware version.
2	Disable ping (ICMP) response on WAN port.
3	Disable UPnP (universal plug-and-play).
4	Disable IDENT (port 113).
5	Disable remote management of the router.
6	Change the default administrator password.
7	Enable stateful packet inspection (SPI).
8	The settings for a firewall policy should be as specific as possible. Do not use 0.0.0.0 as an address.
9	Check for incoming/outgoing traffic security policy
10	Check for firewall firmware / OS updates
11	Allow only HTTPS access to the GUI and SSH access to the CLI
12	Re-direct HTTP GUI logins to HTTPS
13	Change the HTTPS and SSH admin access ports to non-standard ports
14	Restrict logins from trusted hosts
15	Set up two-factor authentication for administrators
16	Create multiple administrator accounts
17	Modify administrator account lockout duration and threshold values
18	Create multiple administrator accounts
19	Check if all management access from the Internet is turned off, if it does not have a clear business need. At most, HTTPS and PING should
20	Ensure that your SNMP settings are using SNMPv3 with encryption and configure your UTM profiles
21	All firewall policies should be reviewed every 3 months to verify the business purpose

For Routers

SL No	Guidance	Compliance
1	Do not use Default password for your router
2	Check if the router block access to a modem by IP address
3	Ensure that router admin gets an alert when a new device joins the network
4	Most routers let you disable UPnP on the LAN side
5	Enable port forwarding and IP filtering for your router
6	Check if the router supports HTTPs, in some routers it is disabled by default
7	If HTTPS is supported, can admin access be limited exclusively to HTTPS?
8	Check if the TCP/IP port used for the web interface can be changed
9	To really prevent local admin access, limit the LAN IP address to a single IP address that is both outside the DHCP range and not normally assigned.
10	Check if the admin access can be limited to Ethernet only
11	Check if the router access can be restricted by SSID and/or by VLAN
12	The router should not allow multiple computers to logon at the same time using the same userid
13	Check if there is some type of lockout after too many failed attempts to login to the web interface
14	Make sure the remote administration settings are turned off by default
15	Check if the port number can be changed remotely
16	If you forget to logout from the router, eventually your session should time out, and, you should be able to set the time limit, the shorter, the more secure
17	Inbound WAN: What ports are open on the WAN/Internet side? The most secure answer is none and you should expect any router not provided by an ISP to have no open ports on the Internet side. One exception is old school Remote Administration, which requires an open port. Every open port on the WAN side needs to be accounted for, especially if the router was provided by an ISP; they often leave themselves a back door. The Test your Router page links to many websites that offer firewall tests. That said, none of them will scan all 65,535 TCP ports or all 65,535 UDP ports. The best time to test this is before placing a new router into service.
18	Inbound LAN: What ports are open on the LAN side? Expect port 53 to be open for DNS (probably UDP, maybe TCP). If the router has a web interface, then that requires an open port. The classic/standard utility for testing the LAN side firewall is nmap. As with the WAN side, every port that is open needs to be accounted for.
19	Outbound: Can the router create outgoing firewall rules? There are all sorts of attacks that can be blocked with outgoing firewall rules. Generally, consumer routers do not offer outbound firewall rules while business class routers do. In addition to blocking, it would be nice if the blocks were logged for auditing purposes. Note however, that devices connected to Tor or a VPN will not obey the outbound firewall rules.

For Network Switches

SL No	Guidance	Compliance
1	Check if the latest firmware is used.
2	Check the switch's user guide's for security features and see if the required ones have been implemented properly.
3	Create an Enable Secret Password Encrypt Passwords on the device
4	Use an external AAA server for User Authentication
5	Create separate local accounts for User Authentication Configure Maximum Failed Authentication Attempts
6	Restrict Management Access to the devices to specific IPs only
7	Enable Logging for monitoring, incident response and auditing. You can enable logging to an internal buffer of the device or to an external Log server.
8	Enable Network Time Protocol (NTP) - You must have accurate and uniform clock settings on all network devices in order for log data to be stamped with the correct time and timezone. This will help tremendously in incident handling and proper log monitoring and correlation.
9	Restrict and Secure SNMP Access

For Linux Servers

SL No	Guidance	Compliance
1	Update your package list and upgrade your OS
2	Remove unnecessary packages
3	Detect weak passwords with John the Ripper
4	Verify no accounts have empty passwords
5	Set password rules
6	Set password expiration in login.defs
7	Disable USB devices (for headless servers)
8	Check which services are started at boot time
9	Detect all world-writable files
10	Configure iptables to block common attacks
11	Set GRUB boot loader password
12	Disable interactive hotkey startup at boot
13	Enable audited to check for read/write events
14	Secure any Apache servers
15	Lock user accounts after failed attempts with Fail2Ban
16	Set root permissions for core system files
17	Keep watch for any users logging on under suspicious circumstances
18	In case of remote access activity: Make sure that the suspicious activity is flagged and documented
19	Make sure that the Suspected account privileges temporarily frozen
20	Make sure that there is a process in place for changing system configurations
21	Check that all system configuration changes are being recorded
22	Ensure start-up processes are configured correctly
23	Ensure regular users cannot change system startup configuration
24	Remove unused software and services
25	Review your server firewall security settings and make sure everything is properly configured
26	Make sure that membership to both the admin and superadmin group is restricted to as few users as Possible without causing any  problems

For Windows Servers

SL No	Guidance	Compliance
1	Install the latest service packs and hotfixes from Microsoft
2	Enable automatic notification of patch availability.
3	Set minimum password length.
4	Enable password complexity requirements.
5	Do not store passwords using reversible encryption. (Default)
6	Configure account lockout policy.
7	Restrict the ability to access this computer from the network to Administrators and Authenticated Users.
8	Do not grant any users the 'act as part of the operating system' right. (Default)
9	Restrict local logon access to Administrators.
10	Deny guest accounts the ability to logon as a service, batch job, locally or via RDP
11	Place the warning banner in the Message Text for users attempting to log on.
12	Disallow users from creating and logging in with Microsoft accounts.
13	Disable the guest account. (Default)
14	Require Ctrl+Alt+Del for interactive logins. (Default)
15	Configure machine inactivity limit to protect idle interactive sessions.
16	Require the "Classic" sharing and security model for local accounts. (Default)
17	Do not allow any shares to be accessed anonymously.
18	Restrict anonymous access to named pipes and shares. (Default)
19	Do not allow any named pipes to be accessed anonymously.
20	Do not allow everyone permissions to apply to anonymous users. (Default)
21	Do not allow anonymous enumeration of SAM accounts and shares.
22	Do not allow anonymous enumeration of SAM accounts. (Default)
23	Disable anonymous SID/Name translation. (Default)
24	Configure Microsoft Network Server to digitally sign communications if client agrees.
25	Configure Microsoft Network Server to always digitally sign communications.
26	Disable the sending of unencrypted passwords to third party SMB servers.
27	Configure Microsoft Network Client to digitally sign communications if server agrees. (Default)
28	Configure Microsoft Network Client to always digitally sign communications.
29	Allow Local System to use computer identity for NTLM.
30	Disable Local System NULL session fallback.
31	Configure allowable encryption types for Kerberos.
32	Do not store LAN Manager hash values.
33	Set LAN Manager authentication level to only allow NTLMv2 and refuse LM and NTLM.
34	Configure file system as well as registry permissions.
35	Ensure all volumes are using the NTFS file system.
36	Configure user rights to be as secure as possible: Follow the Principle of Least Privilege
37	Disable or uninstall unused services.
38	Configure log shipping (e.g. to Splunk).
39	Configure Event Log retention method and size.
40	Configure Policy Change audit policy & Privilege Use audit policy.
41	Configure Logon/Logoff audit policy.
42	Configure Account Management audit policy.
43	Configure the number of previous logons to cache.
44	Require strong (Windows 7 or later) session keys.
45	Configure machine inactivity limit to protect idle interactive sessions.
46	Digitally encrypt or sign secure channel data (always). (Default)
47	Configure Windows Firewall to restrict remote access services (VNC, RDP, etc.) to the organization VPN or only networks.
48	Configure the Windows Firewall in all profiles to block inbound traffic by default. (Default)
49	Enable the Windows Firewall in all profiles (domain, private, public). (Default)
50	Update and enable anti-spyware and antivirus software through Windows update.
51	Set the system date/time and configure it to synchronize against Organization time servers.
52	Disallow remote registry access if not required.
53	If RDP is utilized, set RDP connection encryption level to high.
54	Install software to check the integrity of critical operating system files.
55	Provide secure storage for Confidential (category-I) Data as required. Security can be provided by means such as, but not limited to, encryption, access controls, file system audits, physically securing the storage media, or any combination thereof as deemed appropriate.

Ports on Security Camera NVR & DVR

Ports on Security Camera, NVR & DVR? 

When you receive your DVR you might be wondering what some of the ports are for. This article will explain some of them, the reason they are their as well as a little bit of history.

USB = Universal Serial Bus

Universal Serial Bus is an industry standard developed in the mid-1990s to replace the slower serial and ps2 communication ports on a computer.  The purpose was to be able to attach devices like a mouse, a keyboard, disk drives, network adapters, portable media players, and other devices that help qualify the word Universal in the name of the port.  It has become such a standard that it has evolved over the years as USB 1.x, USB 2.0, USB 3.0, USB 3.1, and USB Type-C.  The DVRs and NVRs continue with this trend by offering USB ports for connecting a mouse and flash drives or hard drives to the unit by using one of the available ports.  Unfortunately, USB keyboards are not supported by the operating system and only the online keyboard is available for entering data.  DVRs and NVRs are very similar to computers, so the device needs to be supported in the operating system.  This matters especially when connecting drives in the sense that you could try to use a USB drive that is too new for the unit.  A DVR or NVR manufactured during a certain era will only support flash drives and hard drives with sizes appropriate to that era.  For example, you will not find a 64GB flash drive or a 6 Terabyte hard drive in 2007.  There is no harm plugging in a USB drive to see if it is recognized since the port is plug and play.

Ethernet Port

An 8P8C (8 position 8 contact) modular connector, often called RJ45 (Registered Jack 45), has become an extremely important plug since the world wide web is connected with this standard Ethernet port on all kinds of devices.  Our DVRs have one Ethernet port so that they can connect to a router for access to the unit from the world wide web.  Our NVRs have the same port, and may also have power over Ethernet ports (POE) for cameras to connect to it for power and video data transmission.  You can buy an 8 channel NVR, for example, that has a built-in 8 port POE switch that allows you to plug 8 IP network cameras into the back of the unit.  You can also buy an 8 channel NVR that does not have any built in POE ports, so the video data would need to be networked back to the NVR.  This can congest a network if you have other computers and devices using the same routers and switches, but there are ways to design your network topology to reduce or separate traffic.

BNC Connector

The BNC connector derived its name from Bayonet Neill–Concelman, which is a combination of its bayonet mount locking mechanism and its inventors, Paul Neill and Carl Concelman.  The BNC connector is a quick connect radio frequency connector commonly made in 50 and 75 ohm versions used for coaxial cable. 

This connector has become the heart and soul of the analog and HD-CVI DVR because of a quick plug and play connection option.  Many people like to use existing coax cable and continue to use it with new technologies like HD-CVI rather than mess with a complete overhaul to an IP technology system.  While IP may be the future, this connector has found new legs with new technologies and should remain viable for years to come.  As long as coax cable still exists, the BNC connector will remain the default option.

RCA Connector

An RCA connector is designed to carry audio and video signals, and received its name from the Radio Corporation of America in the early 40s when it was designed to be an internal connector in home radio-phonograph consoles.  This port has evolved over the years to encompass video in the famous red, white, and yellow composite video.  Our DVRs and NVRs use the connector for audio-in and audio-out primarily since video on our DVRs is covered by the BNC port and NVRs use networking to transmit video.

HDMI Port

HDMI stands for High-Definition Multimedia Interface, and it is a proprietary interface designed for sending video and audio to and from HDMI compliant devices.  The video is uncompressed and the audio can be compressed or uncompressed.  Our DVRs and NVRs have this port as a connection option to a TV or monitor for viewing the live video or playback, as well as adjusting the settings of the unit through the menu options.  The main improvement of this port over VGA, for example, is the ability to do high definition without video loss, which allows us to see higher quality video.  This means that we can see more cameras on the screen at one time clearly and see more detail.

In Summary

There were many ports used in the past that are now likely on the way out.  Most notably is the RS485 connector that is used to control the PTZ cameras.  With Ethernet IP camera and HD-CVI camera technologies taking off, connecting a PTZ is now done over the one cable with no additional cables needed for PTZ control.  They should still be present on hybrids and tribrids, but anyone buying a new system should opt for one of the new technologies since video surveillance is about protecting assets.  VGA should hang around a little longer, but HDMIs ability to handle high definition video without video loss and audio on the same cable, make it very convenient.  RS232 / Serial, PS2, LPT, are all in the port graveyard, but there are likely still some machines out there that have them.

No doubt that new standard ports will come, as they are always being invented or improved.  The research and development teams at all technology companies are working towards the next big thing, so that they can create a new standard port for years to come.  DVR and NVR companies will incorporate any new port into their system that is useful as it grows in popularity.  For example, if a port replaces USB 3.0 for connecting external hard drives, that would become a standard very quickly.

Some software based port are required to come online of IP camera, DVR or NVR. One for the HTTP port (port 80) and one for the TCP port (port 37777). You will find that the majority of network devices which are accessible using an Internet browser will be set as standard to port 80, including IP cameras and routers etc. This is due to the standard port for HTTP, or information being displayed through an browser, being port 80.

HTTPS (Hypertext Transfer Protocol Secure) is a secured HTTP version where all traffic is bind with strong encryption that passes through Port 443. This port is also connected with TCP protocol and creates a secure connection between the webpages and browser.

Port 554 RTSP for communication between the Content Server and the Wowza Media Server. Needs to be open between the Content Server and the Wowza Media Server.

TCP port 9530 uses the Transmission Control Protocol. TCP is one of the main protocols in TCP/IP networks. TCP is a connection-oriented protocol, it requires handshaking to set up end-to-end communications. Only when a connection is set up user's data can be sent bi-directionally over the connection.

Attention! TCP guarantees delivery of data packets on port 9530 in the same order in which they were sent. Guaranteed communication over TCP port 9530 is the main difference between TCP and UDP. UDP port 9530 would not have guaranteed communication as TCP.

A web server would typically have this open and listening if there are any types of these activities. If the machine is windows you can run "netstat -a -b -v -n", to display the processes associated with a particular open port.

A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei (HiSilicon), Huawei subsequently refuted their involvement.

How the Backdoor Works

The backdoor uses port knocking via the management port of vulnerable equipment. A series of commands are sent to the device via the management port, TCP 9530, which in turn opens telnet. When telnet is enabled the attacker can use one of six hardcoded root credentials to gain full control of the vulnerable device.

The skill level needed to exploit this is low and similar to the skill level needed to exploit the Dahua Wiretapping Vulnerability from last year, requiring a limited working knowledge of python. A proof of concept is available, which is used to:

• Send a command to open Telnet on the target device (OpenTelnet: OpenOnce)
• Use a pre-shared key for access (2wj9fsa2)
• Receive an 8 character number / respond with that number + PSK
• Open a Telnet session with the device
• Login with 1 of 6 hardcoded root accounts

Major Chinese Manufacturer Impact Unlikely

Major China manufacturers like Dahua, Hikvision, Uniview are not impacted, from everything we have seen. We executed the proof of concept code from the disclosure on multiple devices and were unable to gain access using the backdoor.

The backdoor primarily impacts devices using HiSilicon SOC with Xiongmai software, which is dozens of small OEM manufacturers, using minimally modified OEM firmware, Open Source OS and drivers, and enabling telnet on port 9530.

Further Reading:
https://ipvm.com/reports/hik-backdoor
https://ipvm.com/reports/hik-exploit
https://ipvm.com/reports/dahua-backdoor
https://thehackernews.com/2022/07/dahua-ip-camera-vulnerability-could-let.html
https://www.malwarebytes.com/blog/news/2021/09/patch-now-insecure-hikvision-security-cameras-can-be-taken-over-remotely
https://www.securityweek.com/many-hikvision-cameras-exposed-attacks-due-critical-vulnerability/
https://www.securityweek.com/backdoor-found-dahua-video-recorders-cameras/