How Does FLIR Ensure My Security System Is Cybersecure and NDAA-Compliant?

Network breaches, compromised user information, regulatory fines, and lost consumer confidence are concerns that keep system integrators and end users up at night. The question that security personnel want technology suppliers to answer is, “How will you keep my security system cybersecure?” By choosing to work with FLIR Systems, customers partner with a leader in cybersecurity committed to conducting frequent cyber risk assessments as well as adopting the latest technologies and protocols, and staying compliant with the latest policies, such as the John S. McCain National Defense Authorization Act (NDAA). Below are key reasons why system integrators and end users can rely on FLIR's solutions, such as its security cameras, for heightened cyber protection and greater peace of mind.

NDAA-Compliant Security Cameras

Beyond utilizing equipment with cyber defenses, it matters where integrators source their product components and devices from. Sixty-four percent of integrators say a vendor's country of origin affects their decision to buy or recommend a product, as reported in the 2019 Security Business State of the Industry study.

One catalyst for this is the NDAA, which was signed into law on August 13, 2018. Section 889 of this bill prohibits government agencies from procuring or using equipment, such as security cameras, produced by specific companies for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes. Consequently, many manufacturers and integrators have turned to trusted vendors like FLIR.

Backed by proven cybersecurity improvements, NDAA compliance, and technology features that optimize performance in harsh weather and environmental conditions, these FLIR security cameras are ideal for cyber-hardened security systems for critical infrastructure and government applications.

Cybersecurity and NDAA-Compliant Features of FLIR Camera Solutios 

FLIR takes cyber threats seriously when it comes to its camera solutions. To ensure full compliance with NDAA and other security standards, FLIR development incorporates cybersecurity considerations as an integral part of the process, along with internal and external vulnerability tests, stringent code reviews, and rigorous IT protocols. Key cyber defense features built into the latest FLIR software and hardware solutions include:

• IEEE 802.1x Authentication: Safeguards Ethernet LANs, or the edge security network, from unauthorized users whose credentials do not match the authentication server.
• Transport Layer Security (TLS) Protocol: Acts as a cryptographic protocol between cameras and video management systems to ensure connections between equipment and servers are secure and private.
• Hypertext Transfer Protocol Secure (HTTPS): Enables secure communication over a computer network; this communication protocol is encrypted via TSL.
• User Authentication: Enforces a strong password policy and forces default passwords to be changed on first use
• No Backdoor Accounts: Ensures there are no backdoors on FLIR cameras; for remote support cases, FLIR technical support will download firmware to the device to allow for troubleshooting and then re-download non backdoor firmware once the session is closed.
• Access Control via Firewall: Protects application servers from untrusted networks and traffic; enables users to “allow” services they are using and “block” those they are not. Services that can turned on or off include Real Time Streaming Protocol (RTSP), Universal Plug and Play (UPNP), Nexus Discovery, Nexus SDK and Internet Control Messaging Protocol (ICMP).
• Digest Authentication: Ensures only an encrypted version of a password is saved on the server so that it cannot easily be decoded.
• Firmware Updates: Offers additional features and security improvements through regularly scheduled updates; includes a firmware handshake mechanism so that only FLIR approved software can be uploaded.
• Configuration Lockdown: Protects against multiple failed log-in attempts.

All new FLIR security solutions are designed with these enhanced data security features, including the Quasar™ Premium Bullet and Premium Mini Dome, FR-345-EST, Quasar™ 4K IR PTZ, and United VMS 9.0.

Penetration Tests

Besides being compliant with NDAA, what is vital to staying cybersecure is staying current on the latest risks. A key facet of FLIR’s cybersecurity strategy is to continually run tests on all products and firmware to identify the newest threats. Equipped with this data, FLIR can ensure that its solutions, cameras, and systems have the latest defense features to mitigate these threats.

FLIR does this by conducting internal penetration tests where FLIR technicians attempt to breach FLIR cameras. Another internal best practice is that engineers reguarly use the Nessus scan tool to regularly check FLIR products for all known vulnerabilities, generate reports on findings, and make technological adjustments as needed.

FLIR also works with the industry’s top cybersecurity experts for third-party penetration tests, including those aligned with the NDAA requirements. FLIR contracts these consultants to evaluate and try to hack FLIR solutions. By having both internal and external reviews, FLIR is able to build more precise cyber defense and security technologies into its camera solutions.

On-Premise Video Storage and Closed Networks

Recent cyber breaches have shed light on the risks of cloud-based video storage. Cloud-based video storage—where video is hosted and stored on a remote online server using the Internet—has greater exposure and opportunity for login credentials to be compromised as well as for attacks by external hackers.

For highly secure facilities in critical applications or entities managing sensitive information, on-premise video storage offerings—such as FLIR servers, storage, and clients—and closed networks offer a strong alternative to the cloud. On-premise storage solutions are when all servers and client workstations are located on-site. Only authorized company personnel can review and manage the video. No one outside of the network can access the video data.

Additionally, when edge devices are on a closed network separate from a customer’s corporate network, the security solutions are separated from external, Internet, and remote access. This ultimately strengthens the security system’s defense against outside attacks.