Tuesday, January 24, 2012

CCTV in Retail Industry

Naturally, security and safety, crime prevention and investigation remain critical issues underpinning the design, specification and operation of CCTV systems in shopping centers, and the appropriate selection, training and development of the individual CCTV operator is a prerequisite to maximizing the effective use of the whole installation.

In addition to monitoring CCTV, Control Room operators might also be overseeing the continual access of delivery vehicles, handling customers, car parking queries or making a series of announcements over the Public Address system.

Indeed, the CCTV installation managed from a modern shopping centre Control Room isn’t solely focused on crime and security. CCTVs so-called ‘wider values’ can be seen in functions such as:

• regularly measuring the shopping center’s ‘lifeblood’ in terms of pedestrian footfall, flows and hotspots, monitoring specific promotions and, perhaps, supporting rent review negotiations (these may be considered the direct commercial benefits of cameras);
• monitoring and managing staff performance and Health and Safety issues, providing examples for training and development or dealing with insurance claims (in other words, CCTVs ‘human’ or ‘personnel’ advantages);
• Camera installations may be programmed automatically to focus on individual pieces of equipment in the event of malfunction or in alarm conditions such as a fire extinguisher sprinkler head breakage, an open cashbox to a pay-on-foot machine or activity in a remote, normally ‘untrafficked’ corridor or plant room area (i.e. the equipment monitoring functions)

CCTV licensing and regulation

Various statutes affect the operation of CCTV in public space areas, the two most notable being the Private Security Industry Act 2001 and the Data Protection Act 1998

The SIA requires all operators of Public Space Surveillance (PSS) CCTV systems to be licensed. A shopping centre CCTV system will generally fall within this requirement, and a PSS license will be required if equipment is either deployed into fixed positions or has a pan, tilt and zoom capability where the operator is required to do any of the following:

• proactively monitor the activities of members of the public, whether they’re in public areas or on private property;
• use cameras to focus on the activities of particular individuals, either by controlling or directing cameras at an individual’s activities;
• use cameras to look out for particular individuals;
• Use recorded CCTV images to identify individuals or to investigate their activities.

However, the PSS license isn’t required where camera images are monitored solely to identify intruders/trespassers at a site and track their activities, and for the protection of vehicles or buildings against theft or damage to that property or premises, and not specifically to monitor members of the public who may enter that property. Here, staff would need the basic SIA security license.

The operational requirement

Depending on the incumbent manager’s level of security knowledge, a security consultant may be used to assist with devising the operational requirements. They must have a proven track record, be independent and possess Professional Indemnity insurance.

The first step is to define the problem be it a security threat, a public safety issue or another kind of vulnerability. This is the Level 1 operational requirement. Once CCTV has been decided upon as the best response, specific issues relating to surveillance can be addressed at Level 2.

Development here helps the centre manager to further define (and refine) areas of concern (with reference to the Level 2 Operational Requirement Checklist), understand operational issues and responses, decide on suitable system requirements and identify any managerial implications.

The initial and most important question to be addressed with any CCTV system is: ‘What do I need to see?’ closely followed by: ‘Why do I need to see it?’ The choice of cameras in particular depends on the nature of the activity to be observed.

When ‘defining the problem’, each key location should be considered in turn and the main activities to be observed at each place noted. The purpose of the observation should then be defined do you wish to monitor a wide area for activity, or do you need a high resolution view that enables the identification of individuals? Who monitors the system, where are they monitoring it and how should they respond in the event of an activity? Thought needs to be given to the totality of functions to be fulfilled. Overloading operators can make for lapses in concentration and inefficiencies of system use.

Attention should then be focused on the features of the CCTV/recording system itself. With advice from the local police, the CCTV manager should decide on a suitable retention time for the application’s images, and the appropriate level of metadata (for example time, date, camera number marking) as part of the operational requirement.

When purchasing and commissioning a CCTV recorder it’s vital to inspect the quality of recorded images and the live view. There could well be a substantial difference between the two. Adjusting the settings to increase retention times will result in a reduction of stored image quality (‘best storage’ settings offer you the lowest quality recorded video).

Digital recording and evidence


In most cases a CD or DVD writer will suffice for exporting single images and short video clips under about ten minutes in duration. For exporting longer video clips (and for large-scale archiving), the system should provide one of the following:

• the ability to export video to an external ‘plug-and-play’ hard drive via a USB or Fire wire connection;
• network port;
• Removable hard drive.

The exported video sequence may be in a non-standard format. If this is the case, it’s important to ensure that the manufacturers provide additional software such that video may be replayed on a standard computer.

The operational requirement highlights various issues that a CCTV operator should consider during the commissioning stages. Of course, any legislative or licensing requirements ought to be fully investigated to ensure adequate compliance.
Maintenance of the installed system should be considered at this stage, including who’s responsible and who will pay any associated costs. This should cover emergency maintenance such as breakage or damage, so too routine cleaning and alignment of cameras.

Specification and tendering tips

Once the operational requirement has been completed, a security specification must be compiled wherein the full requirements of the system will be listed. The situation where a single contractor assesses a site, designs a system and then produces a proposal should always be avoided.

Where the on-site manager knows exactly what is to be tendered for, then the project is on a firm footing from the start. Even if resulting proposals produce a bewildering array of jargon, close reference to the original tender document will allow the manager to see whether or not the contractor is providing what’s actually required.


***

Friday, December 23, 2011

Stuxnet

Stuxnet is a computer worm that targets industrial control systems that are used to monitor and run large scale industrial facilities like power plants, dams, assembly lines and similar 0perations.

How Stuxnet Worm Works

Stuxnet looks for industrial control systems and then changes the code in them to allow the
attackers to take control of these systems without the operators knowing. In other words, this threat is designed to allow hackers to manipulate real-world equipment, which makes it very dangerous.

It’s like nothing
we’ve seen before – both in what it does, and how it came to exist. It is the
first computer virus to be able to wreak havoc in the physical world. It is
sophisticated, well-funded, and there are not many groups that could pull this
kind of threat off. It is also the first cyberattack we’ve seen specifically
targeting industrial control systems.

The worm is made
up of complex computer code that requires lots of different skills to put it together. Symantec security experts estimate it took five to ten people to work on this project for six months. In addition, knowledge of industrial control systems was needed along with access to such systems to do quality assurance testing; again indicating that this was a highly organized and well-funded
project.

"We've definitely never seen anything like this before," said Liam O’Murchu,
Researcher, Symantec Security Response. "The fact that it can control the
way physical machines work is quite disturbing."
W32.Stuxnet
Explained
Download the updated W32.Stuxnet Dossier, November 2010 (PDF)
Read
the Symantec Security Response Blog post on the W32.Stuxnet Dossier

Watch the video "Stuxnet: How It Infects PLCs"
Update: The infection
figures below were produced using telemetry data generated by Symantec
products, and are therefore weighted towards countries with a larger Symantec
install base. For more comprehensive and up-to-date infection figures,
generated from traffic going directly to W32.Stuxnet command and control
servers, please see
our
blog from July 22
or our W32.Stuxnet
whitepaper
.
We have received some queries recently
regarding the new rootkit threat being called “Tmphider" or
"Stuxnet.” This threat, discovered recently, has been garnering some
attention due to the fact that it uses a previously unseen technique to spread
via USB drives—among other interesting features. We have compiled some of the
questions we have been receiving along with our current responses. Analysis of
the threat is still ongoing and we will update this blog with more information
as appropriate.
Q) Am I protected against this threat?
A) Yes, Symantec added
detection for this threat on July 13. The threat is detected as
W32.Stuxnet,
you can read some details of the threat
here.
Q) I've heard that there are multiple files
associated with this threat. Any details?
A) Yes, there are
multiple files associated with the threat. The files consist of the threat
installer and the rootkit component. They are both detected as
W32.Stuxnet.
Here are the file names of these components:
~WTR4141.tmp
~WTR4132.tmp
Mrxcls.sys
Mrxnet.sys
In addition, the threat creates associated
shortcut/link files on a system. Here are some examples:
Copy of Shortcut
to.lnk
Copy of Copy of Shortcut
to.lnk
Copy of Copy of
Copy of Shortcut to.lnk
Copy of Copy of
Copy of Copy of Shortcut to.lnk
Q) Who is being targeted by this threat?
A) While our analysis
is ongoing, we've seen that a significant proportion of machines seeing this
threat are in South East Asia. The “Others” category has a listing of 50+
countries, but their visibility of this threat is minimal.
Q) Does the threat use a new, unpatched
(zero-day) vulnerability?
A) The threat is
indeed using a previously unseen vulnerability to spread using removable
drives. The vulnerability have been confirmed by Microsoft who have released a
security
advisory
for this issue
Q) Do you know what OS platforms are seeing
the attacks?
A) Our in-field data
shows that multiple versions of Windows are seeing these malicious files.
However, not all versions may be vulnerable to the exploit being used. Here is
a breakdown:

Q) Does the threat in question contain a
rootkit? What does it hide?
A) Yes, the threat
does contain a rootkit component that it uses to hide two types of files:
All files that end
in '.lnk'.
All files files
that start with '~WTR' and end with '.tmp'.
The threat has a user and kernel mode
rootkit. The '.sys' files mentioned above are used in kernel mode; the '.tmp'
files are used to hide the files via user mode.
This means that when a system is infected,
you will not be able to see the files that are copied to the USB drive because
they are being hidden by the rootkit. However, our product will still detect
these files.
Q) What does the threat do?
A) The link files,
mentioned above, are part of the exploit and are used to load ~WTR4141.tmp,
which in turn loads ~WTR4132.tmp. The threat contains many different functions.
Our analysis of these functions is currently ongoing; however, we can confirm
at this time that the threat is using some DLLs from Siemens for the product
'Step 7' to access SCADA systems. It uses a predetermined username and password
to connect to the database associated with the SCADA systems to obtain files
and run various queries to collect infromation. It may also gather other
information relating to servers and the network configuration.
Q) Do you detect the .lnk files used in this
attack?
A) Yes, we have
released a signature set that is designed to detect the .lnk files used in this
attack. These files are detected as
W32.Stuxnet!lnk,
from Rapid Release definitions July 16, 2010, revision 035 onwards.
Q) Will turning off AutoPlay protect me
against this threat?
A) No, unfortunately
this worm exploits a newly discovered and unpatched vulnerability in the way
that Windows Explorer handles .lnk files. This feature is unrelated to
AutoPlay, so turning AutoPlay off will not help prevent being compromised in
this attack. That said,
turning off AutoPlay
is generally a good idea.
--------------------
Update: Changed threat name
from W32.Temphid to W32.Stuxnet.