Securing IP cameras and access controllers on a business network.
An IP camera or a door controller is a small computer with a network port, and most are installed once and never touched again. Securing them comes down to five things: know what is there, change every default, keep them on their own network segment, keep them off the open internet, and keep their firmware current.
- Sheet
- Guide
- Published
- 21 October 2026
- Last updated
- 21 October 2026
- Written by
- Gentex AU
These devices are not laptops.
They sit on the same network as the accounts PC, and nobody logs into them.
A laptop gets updates, antivirus and a person who notices when it misbehaves. A camera on a carpark pole gets none of that. It runs a web server, a video stream and often a cloud connection, on firmware that was current the day it was installed.
Three things make that a risk. Many devices ship with a known default login, or a setup page that asks for none. Many connect to the maker’s cloud service by default, so a phone app can reach them from anywhere. And an outdoor camera is a live network port on the outside of the building: whatever is plugged into that cable is on the network the camera was on.
An access controller adds one more. It decides whether a door opens. A controller someone else can reach is a lock someone else can turn.
Start with an inventory.
A device nobody knows about is a device nobody updates.
Most of what we support was installed by somebody else, and the first visit is spent documenting what is actually there. Cameras and door controllers are where the diagram and the cupboard most often disagree.
Record for each device
- Make and model.
- Firmware version, and the date of the maker’s latest release.
- IP address and MAC address.
- Where it is mounted, and whether its cable can be reached from outside.
- Who holds the administrator login.
- What it talks to: the recorder, the access control software, a cloud service.
Change every default.
- 01 One login per device, not one per site.
- Every camera, recorder and controller gets its own administrator password, kept in a password manager. A shared password means one leaked device is all of them.
- 02 Separate viewing from administration.
- Staff who watch footage get a viewing account. The administrator account is for changing settings and nothing else.
- 03 Turn off what is not used.
- Telnet, FTP, UPnP, the maker’s peer-to-peer cloud feature and any protocol the system does not need. Each one is a way in that nobody is watching.
- 04 Set the clock from your own network.
- Point every device at one internal time source. Footage with the wrong timestamp is harder to use as evidence, and a door log with the wrong time is harder to read.
Give them their own network.
Guest, staff, camera and door networks are kept apart. The firewall decides what crosses.
Cameras go on their own segment, and door controllers on another. The rules between segments are written as allowances: everything is blocked, then the few paths the system needs are opened.
A typical rule set
- Cameras reach the recorder. Nothing else, and not the internet.
- Door controllers reach the access control server or software. Nothing else.
- The recorder and the access server reach the time source and the maker’s update service, and are reached by the staff who use them.
- Staff devices see footage and door logs through the recorder or the access software, never by going to a camera or controller directly.
- Guest Wi-Fi reaches the internet only.
A segment without firewall rules separates the addresses, not the traffic. Our business Wi-Fi and networking page covers segmentation, and IT services covers the firewall rules once the network is in.
Keep them off the open internet.
The most common exposure is a port forward. Someone wanted to view the cameras from home, so a port on the router was opened straight to the recorder. That recorder can now be reached by anyone who scans for it, and scanning is constant.
Remote viewing goes through a VPN instead, or through a cloud service you chose on purpose and secured. Turn off UPnP on the router, so a device cannot open a port for itself.
To check, open the port forwarding table on the router. Anything pointing at a camera, a recorder or a door controller should be closed, or have a written reason beside it.
Secure the door wiring, not only the network.
The reader on the outside of the door is on the unprotected side.
- 01 Controller on the secure side.
- The controller that releases the lock is mounted inside the secured area, in the ceiling or the comms room. Never in the reader housing, and never above the door on the public side.
- 02 Encrypted reader wiring.
- Many readers talk to their controller over Wiegand, a decades-old wiring scheme that sends the card number in the clear. OSDP with Secure Channel, standardised as IEC 60839-11-5, encrypts that link and supervises it, so a cut or tapped cable is reported.
- 03 Credentials that resist copying.
- A 125 kHz proximity card carries a fixed number that cheap tools can read and copy. Encrypted smart cards and phone credentials are harder to copy. The access control page covers choosing a credential door by door.
- 04 Tamper reported, not just fitted.
- Where a reader, controller or outdoor camera housing has a tamper switch, it is wired, and the alert goes to someone who will act on it.
Keep firmware current.
Cameras and controllers get security fixes the same way laptops do, but nobody installs them. Check each maker’s security advisories every quarter. Install updates in a planned window, one device first, because a failed update on a door controller is a door that does not work.
Prefer makers who publish a vulnerability disclosure policy and say how long a model will get updates. Australia’s smart device security standard, made under the Cyber Security Act 2024, asks makers of consumer smart devices for exactly that: no universal default password, a way to report vulnerabilities, and a stated support period. Commercial equipment may sit outside it. Ask the same three questions of it anyway.
A device past its support period will not be fixed. Plan its replacement and, until then, tighten the segment it sits on.
The handover checklist.
Hold this against what your installer or IT provider gave you. Where a line is missing, ask for it in writing.
Eight things you should hold
- An inventory of every camera, recorder and controller, with firmware versions.
- The administrator login for each, held by you, and no default password left anywhere.
- A network diagram showing which segment each device is on, and the rules between them.
- No port forwards to security devices, or a written reason for each one.
- UPnP turned off on the router.
- Remote access by VPN or a named cloud service, not an open port.
- The reader wiring type at each door, and whether it is encrypted.
- Who checks for firmware updates, and how often.
Send us what you have, even if it is only a list of brands. Enquiries are read Monday to Friday, 07:00–16:00.
How we leave a site.
Administrator credentials, the configuration and the as-built documentation are handed over at commissioning. Guest, staff and camera networks are kept apart, with firewall rules between them. The recorder runs on your own network, with no ongoing fee needed to keep it recording.
Where we support the site afterwards, updates and patching are part of IT services. The physical side of the same devices, from jammers to the cables that leave the building, is in our IEMI and physical attack surface briefing.
Questions we get asked.
Should security cameras have internet access?
Is putting cameras on a separate VLAN enough?
Is it safe to view cameras in a phone app?
What is OSDP?
Related sheets.
- IT services Firewall rules, updates and patching once the network is in.
- Business Wi-Fi and networking Segmentation, switching and the firewall at the edge of the network.
- Commercial CCTV installation Cameras and a recorder that runs on your own network.
- IEMI and physical attack surface Jammers, cables that leave the building, and what fails when.
Find out what is on your network.
Send a site address and what you know about the cameras and doors. We document what is there and tell you which of these checks it passes.
- To
- Gentex AU · Tullamarine VIC
- Reply
- Phone or email, usually the same business day
- Attending
- Mon–Fri 07:00–16:00
- Licensing
- Victorian Private Security Licence