Harden a video system: an operational baseline
Reduce exposure and prove which identities can do which operations.
Updated
Principle and limits
Start with an inventory of devices, firmware, services, owners and network paths. Give people and integrations separate identities where supported. Apply least privilege, unique credentials, restricted management access and encrypted transport where the product supports it. A device behind a firewall still needs maintained firmware and controlled local access. NIST guidance supplies a baseline, not a certification of this deployment.
Worked example
Create an operator account that can view its camera group but cannot change users or firmware. Test the permitted action and then attempt the forbidden action using an approved test account. A hidden button is insufficient: the server or device must reject the request. Repeat for an integration account and for a disabled former user.
Installation and acceptance
Disable unnecessary services, restrict outbound destinations and record time synchronization and logs. Check recovery of configuration backups and the revocation of remote support access. Maintain an update and end-of-support plan. Record unavailable security capabilities as constraints requiring mitigation or another product, rather than claiming that segmentation solves every weakness.