Is the surveillance network truly separated from the internet?

To make it convenient for property staff to view cameras remotely from mobile phones, the property management of an industrial park set up public port mapping for the web management interfaces of several cameras. Within two weeks, the live feeds of these cameras were accessible online. Footage of workshops, walkways and warehouses was fully exposed. Worse still, attackers used this compromised exposed device to penetrate the park’s internal network.

The surveillance network is supposed to be one of the most private networks. In reality, it is often directly connected to the internet simply for convenience. Whether proper isolation is in place determines whether surveillance systems act as safeguards or data leakage sources.

1. An unisolated surveillance network is like an unlocked window

Exposing surveillance devices directly to the public internet brings dual risks:

• Live footage leakage: Once the login portals of cameras and NVRs are reachable over the internet, devices with weak passwords get compromised within minutes by automated scanners. Live video may be leaked, exposing workshop processes, staff movement routes and warehouse inventory.
• Compromised devices as attack pivots: Surveillance hardware generally runs outdated firmware with slow patch cycles. Once taken over, these devices become footholds for attackers to move laterally toward office and production systems.

Without isolation for the security dedicated subnet, you are essentially leaving an unlocked window on the perimeter of the park. Many managers believe opening a single port carries little risk, yet public scanning tools run nonstop. Just one exposed port can become the entry point for the whole network.

Parks usually have hundreds of surveillance points. Manually resetting passwords and upgrading firmware on every device requires massive workload. That is why “isolate first, then harden” is the practical approach: cut off public exposure to block external scanning, then carry out device-side security remediation step by step.

2. Dedicated security subnet: Independent VLAN, no public port mapping

The correct approach is to transform the surveillance network from an open, freely connected segment into an isolated dedicated security subnet:

• Deploy on independent VLANs: Cameras, NVRs and management servers are assigned dedicated address segments, logically separated from office and guest networks with no mutual visibility by default.
• Disable public port mapping: Management ports and video streaming ports of surveillance devices must not be published to the internet; external access is blocked by default.
• Segregated from business networks: Surveillance traffic runs on its own dedicated channels, without consuming bandwidth for office and production services. This prevents a single breach from endangering the entire network.

AINOPOL’s integrated connectivity-security solution runs surveillance, data, voice and IoT traffic on one unified all-optical network. Segmentation is enforced through security policies. The dedicated surveillance subnet is isolated logically and physically from the internet and office networks. The underlying two-layer flat PON architecture supports flexible fiber deployment for cameras, without requiring a separate cabling system for the security subnet.

3. Remote access via VPN + two-factor authentication

Security teams and maintenance staff do need remote viewing, but devices should never be exposed directly online. The secure workflow is:

• All external access enters the dedicated subnet through encrypted VPN tunnels.
• Two-factor authentication is enforced: users must pass dynamic verification in addition to passwords, blocking access even if credentials are stolen.
• Mandatory strong passwords and baseline validation: default factory passwords must be changed, and configurations are checked regularly against security baselines.

All these access rules are configured centrally on the Dream Gateway. Every remote connection to the security subnet is logged with user identity, timestamp and access source. Management ports remain off the public internet, and all remote maintenance uses controlled tunnels.

4. IPS protection and firewall perimeter control

Active defence is required at the subnet boundary. The Dream Gateway integrates next-generation firewall, IPS intrusion prevention and antivirus modules to detect and block abnormal traffic entering and leaving the security subnet. For industrial sites, industrial firewalls can be added to allow only whitelisted industrial protocols and drop unknown traffic. Rogue access detection also identifies and blocks unauthorized devices and illegal uplinks.

Multi-park and multi-building sites are managed centrally from headquarters. Subnet topology, security policies and alerts are visualized on a unified dashboard. Most anomalies can be resolved remotely via mobile APP, cutting on-site maintenance work.

The gap between a private surveillance system and an exposed one all comes down to proper isolation. Built on all-optical infrastructure, powered by audio & video engine, and protected by robust security capabilities, AINOPOL delivers an integrated “connectivity & security” solution. Independent VLAN segmentation, no public mapping, VPN+2FA remote access and IPS perimeter protection work together to ensure surveillance systems protect the site instead of leaking sensitive information.

FAQ

Q: If full physical isolation is required between the security subnet and office network, do old cameras need new cabling?
A: In most cases, logical isolation via VLAN can be implemented on the existing all-optical infrastructure without rewiring. Physical isolation is only evaluated and added for high-security zones according to classified protection requirements.

Q: What should we do for cameras that already have public port mapping enabled?
A: First cancel the public port mapping, migrate the devices into the dedicated security subnet, and switch remote access to VPN with two-factor authentication. A full security audit is recommended to check whether these devices have already been compromised.

Q: Are surveillance recordings considered internet access logs and required to be retained for the same retention period?
A: Video footage and internet behaviour logs are two different categories of records, subject to separate regulatory requirements. This article focuses on isolation and controlled remote access for surveillance networks. Confirm the exact retention rules with local regulatory authorities.