cctv in a serverless school

[mavhc]

Just put them on a vlan with no internet access

[psydii]

Just put them on a vlan with no internet access

Yes, fine for schools hospitals and recycling centers etc (who aren't actually in scope for the current or likely future restrictions on Hikvision).

 

Baroness Neville-Rolfe even said as much in the House of Lords (as recorded in Hansard), knocking back the amendments that would have automatically blocked various companies from further public sector contracts:

"

First, I agree with the intent behind the amendment, but the Bill’s new debarment regime makes huge progress on excluding suppliers who are unfit to deliver public contracts, including on modern slavery grounds.

 

Secondly, I take this opportunity to remind the House that last year the Government published a WMS asking departments to consider the removal of visual surveillance equipment from government sensitive sites to ensure that no such equipment is connected to departmental core networks, and to cease any future procurement for such equipment. In the other place we committed that, within six months of Royal Assent for the Bill, the Government would set out the timeline for the removal of surveillance equipment supplied by companies subject to the national intelligence law of China from sensitive sites. I reiterate that promise today.

 

Thirdly, the key issue here is where those cameras are located. The level of risk in recycling centres, leisure centres, schools or hospitals does not match the level of threat that we potentially face on sensitive sites. These are not the sites that would typically be of interest to a hostile state, and they do not contain the type of material that would be particularly useful to them.

 

Lastly, replacing devices is not the only method for mitigating risk. We should look to strengthen protective measures to ensure that devices are less vulnerable to attack. The Government are working with the National Cyber Security Centre and the newly-formed National Protective Security Authority to provide organisations with a library of advice and guidance, enhancing the protection of these devices and reducing the likelihood of compromise.

 

I thank the noble Lord for his constructive engagement since tabling his amendments. While regrettably I cannot support his amendment, I am happy to offer a clear definition of the sites that our commitments regarding physical surveillance will apply to. Our commitment will apply to government departments and cover their sensitive sites, which are: any building or complex that routinely holds secret material or above; any location that hosts a significant proportion of officials holding developed vetting clearance; any location which is routinely used by Ministers; and any government location covered under the Serious Organised Crime and Police Act 2005. While our commitment does not extend to the wider public sector, public sector organisations may choose to mirror our action—indeed, I believe that some of them have chosen to do so.

 

I am also happy to commit—and this is important—to an annual written report to Parliament detailing progress on our commitment to remove from government departments’ sensitive sites physical surveillance equipment subject to the national intelligence law of China. I hope that these commitments satisfy the noble Lord and that he will not be pressing his amendments. I thank him again for his contribution on this important matter.

Edited March 6, 2024 by psydii

[XiJ]

Sometimes the word serverless is not the best way of doing something. Sometimes doing it for the sake of it is not the best way of doing it.

 

I guess it depends how much you trust these far eastern manufacturers cloud systems.....I dont trust any of them it's been proven time and time again that manufacturers secretly leak as much data back home as possible I mean even giganto companies like sony have been caught out more than once and if they try it on imagine what all the smaller companies try on too!

 

This! Remember cloud is just somebody else’s computer.

 

Moving file storage off site to something like 365 or Google is a pretty decent change with many benefits. What does moving CCTV Off site gain you? I’d look for some secure remote access / cloud front end but keep everything else onsite.

 

Some people seem obsessed with serverless - when really I believe that it should only be used to serve a need. Or when it’s a better option than on prem hardware.

 

I do believe a lot in the cloud - somethings just require a bit of local control tho.

[Mr.Ben]

There is a time and place for serverless. CCTV probably isn't it yet.

 

We still keep NVRs on site, with access through a centralised remote platform (using Unifi).

 

It's the only equipment that we have on site now, but there isn't a stand out reason to put it in the cloud.

[chazzy2501]

Ha, was logging in to Meraki and they have an advert for their cloud cameras. (serverless cameras, as they market them) Expensive products but might be perfect for you.

[jblackburnHWGA]

Ha, was logging in to Meraki and they have an advert for their cloud cameras. (serverless cameras, as they market them) Expensive products but might be perfect for you.

 

Thanks. I'll have a look. I'm having a look at paxton as well as we will being using their door system. The data sits on the camera i think and then you access it from a central console.

[PotNoodleTech]

Thanks. I'll have a look. I'm having a look at paxton as well as we will being using their door system. The data sits on the camera i think and then you access it from a central console.

 

Better check it's stored encrypted on each camera then or one camera stolen = data loss

[jblackburnHWGA]

Better check it's stored encrypted on each camera then or one camera stolen = data loss

Yes will do. Not so bothered on the data loss its just kids walking around. We mostly use the internal cctv for behaviour. Encrypted though 100%.

[mavhc]

If the camera is encrypting, where's the key?

[paulkerton]

Just put them on a vlan with no internet access

 

Until they want site staff to be able to monitor it from home.

[jblackburnHWGA]

If the camera is encrypting, where's the key?

logic 101 there. Errrr in the cloud

They look ok to me. More importantly they look easy for someone else to manage.

 

Our Paxton10 system combines access control with video surveillance and management on a single platform, however it can also be run as a dedicated video surveillance system.

Users can access their system via the online web user interface from anywhere in the world with an internet connection, or manage their system on the go with the Paxton Connect app. The video management functionality of Paxton10 collects and stores the video captured by the cameras installed on site, and provides an interface to view both live video and access recorded footage.

The software makes it easy to access video footage with an extensive range of functionality, including motion detection, video export, bookmarking and smart search. The footage can also be linked to access events to provide a comprehensive record of the movement of users, visitors and vehicles around the site.

[mavhc]

Until they want site staff to be able to monitor it from home.

 

VPN...

[psydii]

VPN...

But but but if you let a vpn in, then those zero-day laden foreign IoT devices will find a way to break out!

 

Since I'm not sure the site team being able to remote into the cctv is really worth the paperwork, the data protection part of my brain is tempted to lean into that actually:

"if you want remote access, buy something that isn't considered a national security risk"

 

At the moment if any alarms go off at night a security/premises company get the call and handle things, and to wake up the Head of Facilities / Business Manager if its serious enough to warrant urgent decision making.

Last time there was a fire, they had the good grace to wait until the morning-after* before asking me to conjure up remote access.

 

*Sunday morning mind you.

Edited March 7, 2024 by psydii

[p858snake]

Yes will do. Not so bothered on the data loss its just kids walking around. We mostly use the internal cctv for behaviour. Encrypted though 100%.

 

And if the person that is captured in the footage is on, for example a child protection order or similar?

Edited March 8, 2024 by p858snake
s/Any/And/

[mavhc]

But but but if you let a vpn in, then those zero-day laden foreign IoT devices will find a way to break out!

 

Only if your vpn is terrible surely.

 

Is the attack vector the camera hacks the laptop? Someone on the planet would probably notice that

[psydii]

Only if your vpn is terrible surely.

 

Is the attack vector the camera hacks the laptop? Someone on the planet would probably notice that

 

I was poking fun at the notion they are a state sponsored security threat. Not to be taken too seriously in the context in which we here on Edugeek operate.

 

But yes. If they were (a state funded security threat), then having the cameras drop a zero-day on to the viewing laptop is exactly the sort of thing I would do if I was tasked with breaking out from their isolated network. FWIW nation state hacking groups do keep secret zero-day vulnerabilities and exploits for (almost) precisely this sort of activity, but they don't burn them with low value targets like a School's Premises Manager's laptop.

 

Of course VLAN them off (just like we do with all IoT devices) because 1) We don't want the headache of the DPIA around them phoning "home" to somewhere out side of the purview of GDPR 2) We probably aren't going to keep the firmware up to date, so we need restrict inbound network traffic to be allowed only from trusted systems / services. 3) we don't want the students probing them because they've got enough time to figure out how to do something we haven't even conceived of.

 

Also (and I am again leaning into the unproven/undemonstrated "nation state threat actor" piece for funsies) updating the firmware simply increases the chance they have an up to date cache of zero-day exploits ready to drop on your users!!

 

I think I've now spent more time writing in this thread than I have spent securing the vlan where our cameras are running.

[Disease]

This! Remember cloud is just somebody else’s computer.

 

Moving file storage off site to something like 365 or Google is a pretty decent change with many benefits. What does moving CCTV Off site gain you? I’d look for some secure remote access / cloud front end but keep everything else onsite.

 

Some people seem obsessed with serverless - when really I believe that it should only be used to serve a need. Or when it’s a better option than on prem hardware.

 

I do believe a lot in the cloud - somethings just require a bit of local control tho.

 

This in a nutshell.

 

What's going to happen when the cloud providers say, oh we have decided to put our prices up 60% because of XYZ.

[TheHyperTechie]

I had a demo/meeting with verkada a while back, and to be fair they looked awesome. But pricing was scary...

[Disease]

I had a demo/meeting with verkada a while back, and to be fair they looked awesome. But pricing was scary...

 

We have the Verkada vape senors, they are very good but the ongoing costs are expensive, we didn't go for the cameras as we have an extensive system anyway.

[mattysmith80]

This has been an ambition of mine for quite a while. We have 35 schools in our Trust and the Data Protection Office regularly gets subject access requests which involves requests for CCTV footage.. Currently he then has to speak to each school, get them to access the system, download it, share it and then find a way to blur faces etc out... also as a Trust we are the data controller so it appeals to me to have all my CCTV data in one place, if thats cloud or server or both then ill look into it...

 

Ive now tested both Verkada and Merkia Cloud cameras... both excellent bits of kit, you can have all your schools in one place, set alerts for movement, set alerts if someones tampering with the gear etc... My only problem is that the camera and licence model is expensive especially when you eventually get to 35 schools.

 

We are. currently just about the try Paxton 10 cameras and system out, its appeal is that its that Hybrid middle ground, you buy a server that manages upto 1000 cameras, it has web access and offers much of the features of Verkada and Meraki without he ongoing subscription... The beauty of it too is that you can then integrate your door access into the same platform, and alarm, fire systems, even lighting.. So it offers sooooo much

It also allows you to utilise your existing camera estate and bring them into the platform, meaning you could adopt schools very quickly and have everything in one place alot quicker that doing the Verkada and Meraki route..

 

We havnt made a full decision on things yet, we need to test the Paxton system fully before making any final judgement

[mavhc]

Installing CCTV means now you have to add it to SAR? Fun. I assume you can ignore general moving between classes in corridors and only include specific incidents involving them

[psydii]

Installing CCTV means now you have to add it to SAR? Fun.

 

Yes. This is why when you get an "give me *everything*" request, the DPO crafts a careful response to get them to agree to a limited set of data, even if that set of data ends up including the 80,000 emails that had their child's name in them. Typically the DPO response will offer an understanding of what they mean, and within that will not even mention CCTV, Door, or IT Audit data. The data subject gets the data they want, and we don't have a mare trying to execute (well except for those 80,000 emails they insisted upon).

 

Of course you can also get requests that explicitly request CCTV or logs, and there the DPO crafts a careful response to narrow down the scope to a very narrow time period, or location, again so the data subject gets what they want/need and we don't have to flog ourselves to death executing the request.

[psydii]

Them: Psydii can you hop on a call with the architects about a new site we're opening. They need to know what spec to work to.

Me: New Site?

Them: Yeah were just finalizing the details before they start work.

Me: [[grumbles profanities in BSF]] Yeah sure. When's the call?

Them: In 15 minutes.

 

 

Anyway, while speed reading the DfE's School Output Specification Generic Design Brief (December 2023), I came across "Section 4.8.4 CCTV" which seems relevant this thread:

 

https://assets.publishing.service.gov.uk/media/65803d561c0c2a000d18cf3c/GDB_GenericDesignBrief-A-C17.pdf

[aac]

Have a look at the Verkada CCTV solution if you don't want to host an NVR.

[Jaan]

We're Verkada here. Which is cloud, no NVR/DVRs. We also went dedicated switch gear as we didn't have the port capacity to drop onto our current "data" switching.

 

We have a fs.com sfp+ "core" switch with fs.com edges. No NVRs/DVRs....it all connects to our firewall on a different port/network. we've only had it 3 months, not enabled everything yet, waiting on SLT to make some decisions......

 

its been great so far....day and night.... got rid of 15 NVR/DVRs .... slight decrease in camera numbers 180 now from 200, mainly due to us using fisheye to cover areas that would need 3/4 cams .... but we also have the vape sensors...... which have highlighted a issue we didn't realise was so bad!

 

All footage is stored locally to cameras, with the option to upload to the cloud if required for data retention archiving etc etc.

 

Very impressed with it...... Just glad it wasn't my money!