The above recommendation was made by Mr. Tran Dang Khoa, Deputy Director in charge of the Department of Information Security ( Ministry of Information and Communications ) at the seminar on "Basic network information security standards for surveillance cameras" organized by VietNamNet newspaper in coordination with the Department of Information Security on May 22.

Three key points of the criteria set for security with surveillance cameras

Based on a clear understanding of the risks and dangers of information security loss from surveillance cameras, since 2022, the Ministry of Information and Communications has advised the Government to issue Directive 23 on strengthening the work of ensuring network information security and information security for surveillance camera equipment.

Carrying out the tasks assigned by the Prime Minister in this Directive, on May 7, the Ministry of Information and Communications issued a 'Set of criteria on basic network information security requirements for surveillance cameras'.

Mr. Tran Dang Khoa.jpg
Deputy Director in charge of the Department of Information Security (Ministry of Information and Communications) discussed at the seminar on May 22. Photo: Le Anh Dung

According to Mr. Tran Dang Khoa, when building the criteria set, the Department of Information Security carefully studied international experience and found a rather difficult point: up to now, no agency, organization or country has issued a separate information security standard for surveillance camera equipment.

The European Telecommunications Standards Institute's 'ETSI EN 303 645 v2.1.1 (2020-06)' standard was selected as a reference, as it has appropriate requirements. However, this standard is not comprehensive and detailed, only providing general regulations for consumer IoT devices, so the Information Security Department met and discussed with many businesses to develop a set of criteria.

"The issuance of the 'Set of criteria on basic network information security requirements for surveillance cameras' is an effort, harmonious combination and openness of state management agencies with camera manufacturing enterprises and network information security enterprises", shared a representative of the Department of Information Security.

Technical, management and awareness are the three main points focused on in the set of criteria on basic network information security requirements for surveillance cameras. In particular, in terms of technology, the set of criteria provides requirements to ensure safety for not only camera equipment but also camera-related applications.

Regarding management, the requirements are set out with the aim of facilitating users to better manage their camera devices. For example, the criteria set out the requirement for user documentation, thereby helping users know what features the camera has. Or the regulation of not using default passwords from the initialization and configuration steps of the camera device will also help users minimize risks.

Emphasizing the importance of raising users' awareness of information security, a representative of the Department of Information Security said that currently, many users' awareness is still limited. Although they are regularly warned about risks, know that they need to change their passwords, update software, etc., many people still do not care and do not perform these operations.

“We have provided guidance and criteria, but if people do not follow them, it will be meaningless. Therefore, when developing the criteria, we wondered how to change users' habits when the criteria are issued. Only then can we deal with the problem of insecurity of surveillance cameras,” said a representative of the Information Security Department.

Replace high-risk camera equipment as soon as possible

Responding to many people's concerns about whether there is a 'retroactive' approach to camera devices currently circulating on the market that still pose risks, Deputy Director of the Department of Information Security Tran Dang Khoa said that the criteria set is a technical guideline so it is only recommended for application, not mandatory.

Danger of data loss from smartphones and surveillance cameras 1-1.jpg
For cameras that are considered high risk, users need to have a replacement plan as soon as possible. Illustration: Internet

Currently, the Department of Information Security is coordinating with businesses and experts to develop a 'National technical regulation on basic network information security requirements for surveillance camera equipment'. The regulation is expected to be issued in 2024.

When there are standards, cameras manufactured in Vietnam and cameras imported from abroad into Vietnam will be required to be inspected, evaluated, certified to meet the requirements before being put on the market and supplied to Vietnamese users. When there are standards, the safety issue of surveillance camera equipment will be basically resolved.

According to Mr. Tran Dang Khoa, this set of criteria is a step to see how the market and society evaluate and accept it, thereby moving towards applying national technical regulations on basic network information security requirements for surveillance camera equipment.

Although the application of the requirements in the newly issued criteria is not mandatory, the Department of Information Security still recommends that to ensure the safety of their information and data; organizations and individuals need to review and have a roadmap to soon replace unsafe cameras. In particular, for cameras that are considered to be at high risk, users need to have a plan to replace them as soon as possible.

Once again affirming the importance of raising user awareness, the head of the Information Security Department noted: With an information system in general, and surveillance camera equipment in particular, to use it safely, the first thing is still awareness. A device is not at risk, but without proper awareness and skills, information security is still lost.

"Therefore, to help users gain awareness and skills, it is necessary to focus on propaganda so that users see that they must also be aware of protecting their organizations and individuals," a representative of the Department of Information Security pointed out.

There will soon be basic network security standards for surveillance cameras.

There will soon be basic network security standards for surveillance cameras.

According to the Department of Information Security (Ministry of Information and Communications), this year, the 'National technical regulation on basic network information security requirements for surveillance camera equipment' will be issued. At that time, businesses will be forced to comply with the requirements.
Vietnamese users benefit from safety regulations with surveillance cameras

Vietnamese users benefit from safety regulations with surveillance cameras

Security experts all agree that the Ministry of Information and Communications' issuance of a set of criteria on basic information security requirements for surveillance cameras will help protect information and data, bringing benefits to users.
Important premise to gradually eliminate unsafe surveillance camera equipment

Important premise to gradually eliminate unsafe surveillance camera equipment

The Ministry of Information and Communications' issuance of a set of criteria on basic network information security requirements for surveillance cameras is a premise to gradually eliminate unsafe camera products and equipment from the Vietnamese market.