The NIS2 Directive Will Impact The Security Ecosystem Across The EU

In our increasingly digital and interconnected world, it’s little surprise that business leaders and governments are focusing on the cybersecurity of everything connected to the Internet. As the Internet of Things (IoT) expands, so do the opportunities for malicious actors to exploit devices, either as gateways to larger cyberattacks or to access data.

Indeed, the European Union Agency for Cybersecurity, ENISA, sees new threats to cybersecurity emerging because of the wealth of data that devices can now collect and the advances in AI that now make cyber-attacks more complex and scalable.

Here Comes The NIS2 Directive

The NIS2 Directive, a Europe-wide legislation that aims to improve the cybersecurity of network and information systems across the EU, goes some way in combatting the increased risk of cyber-attacks. It is a continuation of the first NIS Directive, with an expanded remit including digital infrastructure such as cameras and IoT devices. Any business that uses cameras and other connected devices will need to take additional steps to protect video network security and its data from 18 October 2024. 

Europe has had a long track record of leading the way in terms of data protection, with GDPR being a recent example. So, we can expect the NIS2 Directive to have some sway over other governments’ legislation in the coming years. It’s a savvy move for all organisations to follow the practices and guardrails put in place by the legislation, especially if they operate in, or do business with, Europe. 

Complying With The NIS2 Directive 

The NIS2 Directive focuses on two main areas: Protecting networks and information systems through proactive measures; and responding quickly when under a cyberattack.

Protecting your video network and other devices
Your video and IoT network is a unique target for hackers thanks to the data it collects, and which can be used to gain confidential information, for blackmail, or even to inform future cyber or physical attacks, through mapping out a building’s floor plan and schedules. 

Checking the fundamentals are in place to secure cameras is the first to-do on any user’s list. You can separate this into two main areas: asset management and access management. 

Asset management involves securing the hardware within your security system. That’ll include cameras, servers, and sensors. 

Of course, every device in your network will become vulnerable if its firmware isn’t kept updated. Users should check for the latest version as soon as it is installed, as some time can pass between a camera leaving the factory and its installation. Likewise, camera drivers should be updated to the latest software version. Some camera models come with factory passwords and these need to be changed quickly.

This brings us to access management best practices. Password sharing is common in many workplaces, but it can introduce significant vulnerabilities through stolen or misused passwords. Without unique login credentials, you cannot track who is in your system, and what they are doing. So, every individual needs their own access credentials for a video system. 

Individuals should be granted the level of access appropriate to their role, and that extends to a physical space too. If someone isn’t directly working on the maintenance or administration of the hardware and software, they shouldn’t have access to a server room and shouldn’t have admin rights. 

Getting the basics of video cybersecurity right will greatly reduce a system’s attractiveness to malicious actors. 

Rapid Cyber-Attack Responses
If the worst-case scenario happens and you find that someone has gained unauthorised access to your system, you’ll need to respond quickly. Where separation exists between a video network and wider IT infrastructure, containment will be relatively straightforward (hence, this is greatly advised to have in place!). 

Users should identify the affected devices and networks and, if possible, take them offline to disconnect them and prevent a widespread gateway attack. Checking audit reports will help understand who has accessed the system, what they did, and when.

It’s worth simulating an attack on your video system on a regular basis. This’ll allow you to test response times and processes, identify unused licenses or other vulnerabilities, and train your team. Under pressure, people often revert back to their habits and training, so ensuring that they understand what to do and what to avoid can make a huge difference in a cyber-attack. 
Your choice of partner matters
Partnering with a responsible manufacturer who puts cybersecurity at the core of product development can make a serious difference to cyber-resilience. 

Compliance with NIS2 Directive is just the start for anybody working in the digital realm. Governments worldwide are making concerted efforts to improve cybersecurity. Working together with a reputable manufacturer, organisations can rest assured that their video security ecosystems won’t be an easy target.

Jos Beernink is VP EMEA at Milestone Systems

Image: 

You Might Also Read:

Resilience As Regulation: Preparing For The Impact Of CER:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Mobile & On-Line Banking Cyber Security [extract]
For Many Businesses Experiencing MultiCloud Data Breach, Multi-Cloud Security Could Be The Answer »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Zadara Storage

Zadara Storage

Zadara provide complete data backup and protection delivered as a fully-managed service.

My Data Recovery Lab

My Data Recovery Lab

We recover data from: HDDs, RAIDs, NAS, SSDs, USB Flash Devices, Desktop Computers, Mobile devices and other data storage media.

CryptoCodex

CryptoCodex

Cryptocodex has developed Counter-Fight, the most advanced, yet simple to implement, counterfeit detection system.

NPCore

NPCore

NPCore is specialized in defense solution against unknown APT and Ransomware and provides two-level defense on network and endpoint based on behavior.

Accredia

Accredia

Accredia is the national accreditation body for Italy. The directory of members provides details of organisations offering certification services for ISO 27001.

SafeHouse Technologies

SafeHouse Technologies

SafeHouse is a cloud-based, high-end cybersecurity platform that can secure and insure any device that is connected to it.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

NETRIO

NETRIO

If you are looking for a highly mature, exceptionally competent Managed Service Provider, NETRIO has solutions to keep your business running at warp speed with zero disruptions.

Searchlight Cyber

Searchlight Cyber

Searchlight Cyber is a leading darknet intelligence company. Working with law enforcement, industry, and end users to help protect society against the threats of the darknet.

Ermes

Ermes

Ermes – Intelligent Web Protection provides companies with a solution that effectively secures them against web threats.

Incyber

Incyber

Incyber is a fully integrated network and cybersecurity solutions provider contracted to safeguard public and private enterprise, high value data and sensitive industries.

Azerbaijan Cybersecurity Center (ACC)

Azerbaijan Cybersecurity Center (ACC)

Azerbaijan Cybersecurity Center is a state-of-the-art facility to deliver advanced cyber training programs and build the next generation of Azerbaijan’s cybersecurity professionals.

ZAG Technical Services

ZAG Technical Services

ZAG Technical Services is an award-winning information technology consulting firm delivering digital transformation solutions, IT assessments, managed services, security, and support.

Ingenics Digital

Ingenics Digital

Ingenics Digital is a recognized initiator and leading service provider in the areas of software development and embedded systems.

ELK Analytics

ELK Analytics

ELK Analytics is a specialized Managed Security Services Provider (MSSP) that focuses on endpoint security and monitoring & alerting for any type of structured or unstructured data.

Zynap

Zynap

Zynap is an Advanced AI-powered SaaS platform replicating cybercriminal tactics to predict, detect, and neutralize threats before they strike.