|
The physical security world has come a long way to understanding the need to use cryptographically sound techniques in systems and services over the last 20 years. Examples include: abandoning Wiegand interfaces to doors; adopting OSDP; providing hardening guides; and making it a requirement to change devices for password resets. Yet today, a critical vulnerability persists in physical security systems: the widespread use of self-signed digital certificates. The explosive growth of IP security systems, led by surveillance cameras, has outpaced organizations' ability to properly manage digital keys and certificates. The result is widespread deployment of devices using authentication methods that fall short of current security standards and regulatory requirements. Understanding the Self-Signed Certificate Problem Self-signed certificates lack independent third-party validation from trusted Certificate Authorities (CAs). This creates an inherent trust problem: there is no external verification of device identity, and no way to differentiate between legitimate devices and imposters. They are vulnerable to man-in-the-middle attacks, and organizations have no practical way to determine certificate validity or manage device authentication privileges with granularity. When a device is compromised or decommissioned, there is seldom a mechanism to invalidate its certificates systematically. Key Management Failures Perhaps most concerning is the practice of using identical self-signed certificates across multiple devices or entire product lines. It is possible to deploy cameras where the same certificate and private key are used in multiple devices—analogous to using the same username and password across an entire organization. IoT devices have implemented poor random number generation or use deprecated cryptographic algorithms. Weak cipher suites such as MD5 and SHA-1 continue to appear in deployed systems. Self-signed certificates often remain valid indefinitely without rotation, creating persistent attack vectors. Then there is the looming issue of post-quantum cryptography, few if any physical security device uses these algorithms and associated certificates. Real-World Vulnerabilities The 2016 Mirai botnet attack leveraged weaknesses in IP cameras. As with any digital and software/firmware systems, documented vulnerabilities span manufacturers. The problem extends from surveillance cameras to smart door locks, network video recorders, and industrial control systems. Electronic locks have been compromised through MITM attacks that captured unlock codes. SCADA systems with self-signed certificates have been exploited, with operators unknowingly connecting to malicious interfaces. Regulatory and Standards Frameworks ISO, NIST, GDPR, PCI DSS, HIPAA, and the CA Browser Forum all provide guidance that effectively precludes or severely restricts the use of self-signed certificates in production environments. This is particularly true for Security as a Service, which crosses networks and national boundaries. A critical issue is their generic nature—self-signed certificates lack the specificity required in today's advanced analytics environment. Modern surveillance cameras vary, some do basic video capture, others employ facial recognition, behavior analysis, crowd counting, license plate reading, and real-time classification. Self-signed certificates provide no mechanism to differentiate these capabilities or encode specific analytics functions. This creates compliance challenges, as these certificates don’t reflect processing purpose, data classification levels, or privacy controls required for different analytics capabilities. Regulations governing video surveillance and biometric analytics vary dramatically by location. What is permissible in one jurisdiction may be prohibited in another. EU requirements under GDPR can differ substantially from U.S. state privacy and AI laws, which vary from California to Illinois to Connecticut. The lack of location-specific information and processing purpose details in self-signed certificates makes demonstrating compliance nearly impossible. Properly issued certificates should contain accurate location data, processing justification, analytics capabilities enabled, and metadata generation parameters—all essential for regulatory compliance and audit trails. The CA Browser Forum passed a requirement that all SSL certificates should last no more than forty-seven days starting in 2029, reflecting movement toward shorter certificate lifespans and frequent rotation—practices incompatible with typical self-signed certificate deployments. Moving Toward Proper Certificate Management The solution requires implementing proper certificate management using trusted CAs, even for internal systems. This includes certificate rotation policies, proper key generation with sufficient entropy, and certificate pinning where appropriate. Organizations must move beyond the convenience of self-signed certificates toward comprehensive public key infrastructure (PKI). The Path Forward The combination of issues with self-signed certificates makes them a risky choice. As video analytics and machine learning capabilities expand, the need for proper certificate policies that capture device location, purpose, and processing capabilities becomes even more critical. Organizations must recognize that deploying IP security systems without proper certificate management is not a technical detail to address later—it is a fundamental security requirement that should be incorporated from initial system design through deployment and ongoing operations. The physical security industry has the knowledge and tools to address this challenge; what remains is the commitment to implementation and the recognition that convenience cannot supersede security in systems designed to protect people and assets. Read IDmachines’ full whitepaper on replacing self-signed certificates here.
|
