Issuing a set of basic cybersecurity requirements for surveillance cameras.

On May 7th, the Ministry of Information and Communications issued a Decision on the Basic Network Security Requirements for Surveillance Cameras. This recommendation applies to Vietnamese and foreign organizations and individuals involved in the research, development, production, evaluation, selection, and use of camera equipment.

Illustrative image.

This document recommends applying basic network security technical requirements to surveillance camera devices using network protocols (hereinafter referred to as camera devices). For higher-level network security technical requirements, organizations and individuals should consider and decide based on their specific characteristics and practical needs.

Accordingly, surveillance cameras must have user manuals. To ensure user data security, surveillance cameras must have authentication management features, including brute-force attack prevention and secure password management.

Specifically, the camera needs system administration functionality that allows changing the lockout time, the number of failed login attempts, and the duration of consecutive failed login attempts. It should only provide users with information about successful/failed logins, without revealing other details that could be used for brute-force attacks. It should also have secure password control functionality that is different for each camera device, and the ability to authenticate multiple types of entities, such as users or devices.

The camera device's interface allows for connection and management via a network connection; the camera device's physical interface is used to access its functions via a network connection; the camera device's physical port or wireless interface allows communication with the camera device via a physical connection. Examples include: Ethernet port; USB port; Wi-Fi...

The camera device and user-interaction application have a timeout option that allows the application to be automatically logged out after a certain period of time and creates a secure session key.

The operating status of the camera device includes parameters, options, and functions that have been initialized and set to default settings as designed by the manufacturer. This mode is activated immediately after the camera device is installed and started up for the first time.

Camera equipment and related services must have at least the functionality to allow the setup and configuration of data processing, storage, and exploitation in Vietnam (such as on memory cards/external devices, cloud computing services located in Vietnam, etc.) to ensure compliance with Vietnamese law on personal data protection.

During the initialization, setup, and configuration of the device, there must be an interface that informs the user about the location (country) where data collected by the camera device and related services are stored and processed.

Simultaneously, it includes a function that allows users to delete data collected and stored on the camera device. It also provides notifications to the user upon successful or unsuccessful data deletion. Furthermore, it requires user confirmation of data deletion before proceeding.

The camera device must have the following features: Validate input data entered by the user or via a programming interface; prevent the processing of input data that violates predefined filtering conditions set by the manufacturer; validate data to prevent attacks on the device's interface.

In the event that the device needs to restart due to an error (excluding hardware errors), the device is guaranteed to function normally on the next startup.

Thao Anh - Ministry of Information and Communications' Electronic Information Portal

Source