On May 7, the Ministry of Information and Communications issued a Decision on the set of criteria for basic network information security requirements for surveillance cameras. The recommendation applies to Vietnamese and foreign organizations and individuals involved in research, development, production, evaluation, selection and use of camera equipment.
Illustration photo.
The document recommends the application of basic network information security technical requirements for surveillance camera equipment using network protocols (referred to as camera equipment). For higher level network information security technical requirements, organizations and individuals shall consider and decide based on their specific characteristics and practical needs.
Accordingly, surveillance cameras must have product user manuals for users. To ensure information security for users, surveillance cameras must have authentication management features including brute force attack prevention and secure password management.
Specifically, the camera needs to have a system management function that allows changing the lock time, the number of failed logins, and the duration of consecutive failed logins. Only inform the user of successful/failed logins without other content as a basis for brute force attacks. At the same time, there is a function to control secure and different passwords for each camera device, and at the same time, there is a function to authenticate many different types of objects such as users or devices.
The camera device interface allows connection and management of the camera device via a network connection; the camera device's physical interface is used to access the device's functions via a network connection; the camera device's physical port or wireless connection interface allows communication with the camera device via a physical connection. For example: Ethernet port; USB port; Wifi...
Camera devices, user interface applications have a timeout option that allows the application to be automatically logged out after a period of time and creates a secure session key.
The operating status of the camera device includes parameters, options, functions that have been initialized, and default settings according to the manufacturer's design. This mode is activated immediately after the camera device is installed and started for the first time.
Camera devices and associated services must have at least the ability to set up and configure locations in Vietnam for data processing, storage and exploitation (such as: on memory cards/peripheral devices, cloud computing services located in Vietnam, etc.) to ensure compliance with Vietnamese laws on personal data protection.
During the initialization, setup, and configuration of the device, there must be an interface that informs the user about the location (country) where the data collected by the camera device and associated services are stored and processed.
At the same time, there is a function that allows users to delete data collected and stored on the camera device. There is a function that notifies users of successful/failed data deletion on the device when performing the deletion function. There is a function that confirms users' agreement to delete data before performing the deletion.
The camera device must have the following features: Check the validity of input data entered by the user or through the programming interface; prevent the processing of input data that violates the pre-defined filter conditions according to the manufacturer; check the validity of data to prevent attacks on the device interface.
In case the device has to be restarted due to an error (except for hardware errors), the device is guaranteed to operate normally on the next restart./.
Thao Anh - Portal of Ministry of Information and Communications
Source
Comment (0)