Have to remove hikvision from network - any alternatives?

[pooley]

Just been informed by our LA team that hikvision devices will be banned from LA networks including schools.

 

They gave us 2 options, Get a seperate network/isp installed just for cctv or replace the 12 cameras and an NVR.

 

Can't find anything around the £100 a camera price for the same model/quality hikvision kit.

 

Anyone using good cctv kit that doesn't cost the earth?

 

Cheers

 

Si

Edited June 9, 2023 by pooley

[kennysarmy]

Just been informed by our LA team that hikvision devices will be baned from LA networks including schools.

 

They gave us 2 options, Get a seperate network/isp installed just for cctv or replace the 12 cameras and an NVR.

 

Can't find anything around the £100 a camera price for the same model/quality hikvision kit.

 

Anyone using good cctv kit that doesn't cost the earth?

 

Cheers

 

Si

 

Banned?

[pooley]

Yeah banned *

 

 

Edited origianl post for spelling

[Kitkatninja]

Just been informed by our LA team that hikvision devices will be banned from LA networks including schools.

 

Have you received official notification? If, yes, are you able to share that please?

 

In Wales (I assume that you're there), does your school share the same network as your Council/LA?

[Fazza]

I know the UK Government has banned them in all of their buildings - are you linked in physical way to your LA?

 

 

Would creating VLANs on your network thus separating out the Hikvision be an option?

[Davit2005]

In any case how would simply moving cameras to a different network or ISP even deal with the issue whoever the manufacturer, it is a bit vague?

 

One experience I saw many years back was when a CCTV installer accessed another network from the internet on one of our maintenance office PCs to get the web plugin, the camera showed the area above a retail till that was enough to make me think WTF.

[jadzea]

We use Unifi cameras - decent quality and easy for staff to use via the web interface for the Unifi NVR.

[Andycat]

Our supplier refuses to install Hik now and installs Hanwah or Dahua at the cheaper end. Chinese not allowed but apparently Korean fine.

 

The Hanwah are effectively Samsung apparently...

[Davit2005]

The only issue I have with Unifi is that you seem to have to allow remote access to get email notifications these days, unlike the old Unifi Video where you could set your own email server.

 

Synology disk station is another option I guess but you have to pay per camera for the licenses, only a few licenses come free but you can choose a variety of different cameras.

Edited June 9, 2023 by Davit2005

[PotNoodleTech]

Yes we have been told not to install any new camera systems at all (hikvision were not named) until the LA recieve/create some guidance.

 

They have not banned existing kit, or told us to remove existing cameras as that is unfeasible given school budgets.

 

It's pretty ironic as up until last week the LA have actually been having contractors install hikvision systems and a new school that's on the way is literally being cabled up for all hikvision right now.

 

Surely as long as it is non cloud enabled and behind all your usual LA firewalls - it is technically safe??

 

Meanwile the LEA are fine with installing

Chinese Servers

Chinese PCs

Chinese Chromebooks

Chinese phones and tablets

Chinese network switches

Chinese WAPs

Chinese firewalls

Chinese routers

etc

etc

etc

 

Either way, it's a knee jerk political reaction based on purely politics not technical issues which is not how LAs should be behaving IMHO.

Edited June 9, 2023 by PotNoodleTech

[ZeroHour]

The only issue I have with Unifi is that you seem to have to allow remote access to get email notifications these days, unlike the old Unifi Video where you could set your own email server.

 

I have a UDM-SE with a couple of cameras on it, the Network app lets me specify a custom server instead of their cloud server to send notifications but I dont know if that affects the protect app. It *should* be a console setting rather than app setting but UI keep changing things and forgetting to move things.

[DrCheese]

Unifi CCTV is rubbish at scale, don't do it. The lack of ONVIF support is the biggest red flag.

[ITGURU]

VLAN it off and dont expose to the internet. I've been advised by a supplier (and seen evidence) of hik systems compromised with messages on the screen of which this is the article.

CCTV hacked by Faxociety : r/homesecurity (reddit.com)

[pooley]

To try and answer some qestions.

 

Our LA provide our network/VOIP/internet infrastrucure, therefore can dictate at a security level what devices are and aren't allowed.

 

I have officially been told via phone call that as UK Gov are removing anf banning hikvision from gov buildings, the decision has been made at LA level to follow suit and as there is a security risk devices will not be allowed to connect to LA provided networks. We currently VLAN our cctv but even this isn't enough.

 

Moving to a dedicated ISP would put the rist firmly at the HT door and he would be asked to take on the possible security risk.

 

I'll look into the suggestions for other kit, thanks.

[pooley]

Our supplier refuses to install Hik now and installs Hanwah or Dahua at the cheaper end. Chinese not allowed but apparently Korean fine.

 

The Hanwah are effectively Samsung apparently...

 

Dahua are a Chinese based company.

[gszech]

What about Paxton 10. It's an UK brand but Paxton 10 cameras are actually Hikvision cameras in disguise but they do you have Paxton firmware but the technology is still Hikvision.

 

https://www.paxton-access.com/product-types/cameras/

[Michael]

This is a typical Government response. We're banning XYZ brands, but we're not going to actively recommend/promote any safe manufacturers either.

 

Correct me if I'm wrong, but not a single person or group have reversed engineered said brands to demonstrate this is an active problem? It's all speculation.

 

Why limit this to just CCTV? A lot of Solar PV systems are also Chinese made with questionable software. This also is used in public buildings and people's homes.

[psydii]

From what I understand, it has been agreed (at committee) that the Procurement Bill 2023 will ban suppliers who are subject to "China's National Security Law" from being involved in any contracts for "public authorities". (a purchase order is a contract, and it would take quite a lot to persuade me that a School or MAT are not "public authorities")

 

This latest turn of events does not require schools (or LAs, or even government departments) to rip and replace existing systems.

 

....but I think it prudent to plan based on the expectation that day is coming.

[jmak]

Our supplier refuses to install Hik now and installs Hanwah or Dahua at the cheaper end. Chinese not allowed but apparently Korean fine.

 

The Hanwah are effectively Samsung apparently...

If the alleged problem is with goods from a Chinese manufacturer you won't do much better than a Korean supplier. They act on their concerns much more actively than we do in the UK.

 

No comment on whether concerns are justified - everyone can take their own view/risk assessment.

[Jcx500]

If you decide to install new cctv I would recommend avigilon

[Sonic007]

Seperate VLAN with Network isolation.

[Davit2005]

CCTV should always be on it's own vlan and isolated with ACLs etc. I'd go so far as to aim to block them talking to the Internet completely as well as not having them able to be accessed directly from the Internet. Edited June 12, 2023 by Davit2005

[Koldov]

For those advocating zero internet access, how do you deal with Site Agents requiring access to CCTV monitoring 24/7?

[FN-GM]

For those advocating zero internet access, how do you deal with Site Agents requiring access to CCTV monitoring 24/7?

 

This should go through a VPN anyway, regardless of the above.

[Davit2005]

We have 24/7 Security staff but even then everything is tied down for admin access to using a VPN or specific external IP addresses at an absolute minimum but can count those left on specific IP on one hand now.