The NIS2 Directive Will Impact The Security Ecosystem Across The EU

In our increasingly digital and interconnected world, it’s little surprise that business leaders and governments are focusing on the cybersecurity of everything connected to the Internet. As the Internet of Things (IoT) expands, so do the opportunities for malicious actors to exploit devices, either as gateways to larger cyberattacks or to access data.

Indeed, the European Union Agency for Cybersecurity, ENISA, sees new threats to cybersecurity emerging because of the wealth of data that devices can now collect and the advances in AI that now make cyber-attacks more complex and scalable.

Here Comes The NIS2 Directive

The NIS2 Directive, a Europe-wide legislation that aims to improve the cybersecurity of network and information systems across the EU, goes some way in combatting the increased risk of cyber-attacks. It is a continuation of the first NIS Directive, with an expanded remit including digital infrastructure such as cameras and IoT devices. Any business that uses cameras and other connected devices will need to take additional steps to protect video network security and its data from 18 October 2024. 

Europe has had a long track record of leading the way in terms of data protection, with GDPR being a recent example. So, we can expect the NIS2 Directive to have some sway over other governments’ legislation in the coming years. It’s a savvy move for all organisations to follow the practices and guardrails put in place by the legislation, especially if they operate in, or do business with, Europe. 

Complying With The NIS2 Directive 

The NIS2 Directive focuses on two main areas: Protecting networks and information systems through proactive measures; and responding quickly when under a cyberattack.

Protecting your video network and other devices
Your video and IoT network is a unique target for hackers thanks to the data it collects, and which can be used to gain confidential information, for blackmail, or even to inform future cyber or physical attacks, through mapping out a building’s floor plan and schedules. 

Checking the fundamentals are in place to secure cameras is the first to-do on any user’s list. You can separate this into two main areas: asset management and access management. 

Asset management involves securing the hardware within your security system. That’ll include cameras, servers, and sensors. 

Of course, every device in your network will become vulnerable if its firmware isn’t kept updated. Users should check for the latest version as soon as it is installed, as some time can pass between a camera leaving the factory and its installation. Likewise, camera drivers should be updated to the latest software version. Some camera models come with factory passwords and these need to be changed quickly.

This brings us to access management best practices. Password sharing is common in many workplaces, but it can introduce significant vulnerabilities through stolen or misused passwords. Without unique login credentials, you cannot track who is in your system, and what they are doing. So, every individual needs their own access credentials for a video system. 

Individuals should be granted the level of access appropriate to their role, and that extends to a physical space too. If someone isn’t directly working on the maintenance or administration of the hardware and software, they shouldn’t have access to a server room and shouldn’t have admin rights. 

Getting the basics of video cybersecurity right will greatly reduce a system’s attractiveness to malicious actors. 

Rapid Cyber-Attack Responses
If the worst-case scenario happens and you find that someone has gained unauthorised access to your system, you’ll need to respond quickly. Where separation exists between a video network and wider IT infrastructure, containment will be relatively straightforward (hence, this is greatly advised to have in place!). 

Users should identify the affected devices and networks and, if possible, take them offline to disconnect them and prevent a widespread gateway attack. Checking audit reports will help understand who has accessed the system, what they did, and when.

It’s worth simulating an attack on your video system on a regular basis. This’ll allow you to test response times and processes, identify unused licenses or other vulnerabilities, and train your team. Under pressure, people often revert back to their habits and training, so ensuring that they understand what to do and what to avoid can make a huge difference in a cyber-attack. 
Your choice of partner matters
Partnering with a responsible manufacturer who puts cybersecurity at the core of product development can make a serious difference to cyber-resilience. 

Compliance with NIS2 Directive is just the start for anybody working in the digital realm. Governments worldwide are making concerted efforts to improve cybersecurity. Working together with a reputable manufacturer, organisations can rest assured that their video security ecosystems won’t be an easy target.

Jos Beernink is VP EMEA at Milestone Systems

Image: 

You Might Also Read:

Resilience As Regulation: Preparing For The Impact Of CER:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Mobile & On-Line Banking Cyber Security [extract]
For Many Businesses Experiencing MultiCloud Data Breach, Multi-Cloud Security Could Be The Answer »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

National Centre of Incident Readiness & Strategy for Cybersecurity (NISC) - Japan

National Centre of Incident Readiness & Strategy for Cybersecurity (NISC) - Japan

NISC was established as a secretariat of the Cybersecurity Strategy Headquarters in collaboration with the public and private sectors to create a "free, fair and secure cyberspace" in Japan.

Cyber Together

Cyber Together

Cyber Together is dedicated to advancing the cyber security industry by giving businesses access to Israel’s leaders, innovators and great minds in the field of cyber security.

Foregenix

Foregenix

Foregenix are global specialists in Digital Forensics and information security including Penetration testing and Website Security.

Kount

Kount

Kount's “decision engine” platform is ideal for managing fraud in online/telephone channels that process payments and onboard new customers.

ABL Cyber Academy

ABL Cyber Academy

ABL provide certified training courses in the field of cyber security and IT project management.

Crest International

Crest International

Crest is focused on professionalizing the technical cyber security market whilst driving quality and standards of organizations that operate within it.

Blockchain Slovakia

Blockchain Slovakia

Blockchain Slovakia is a non-profit organization that brings together researchers, developers, entrepreneurs, regulators, investors and the public to support blockchain technology in Slovakia.

A-LIGN

A-LIGN

A-LIGN is a technology-enabled security and compliance partner trusted by more than 2,500 global organizations to mitigate cybersecurity risks.

Altipeak Security

Altipeak Security

Altipeak Security provide Safewalk - a flexible and robust authentication platform through which we offer improved security to SMBs, corporates, banks, insurance companies, healthcare and more.

Thridwayv

Thridwayv

Thirdwayv helps your enterprise realize the full potential of loT connectivity. All while neutralizing security threats that can run ruin the customer experience - and your reputation.

ThriveDX

ThriveDX

ThriveDX, the world’s premier EdTech provider (formerly HackerU), champions digital transformation training as a means of empowering individuals to thrive in the age of digital disruption.

QuoLab

QuoLab

QuoLab empowers security professionals to analyze, investigate and respond to threats within an integrated ecosystem.

CyberPeace Foundation

CyberPeace Foundation

CPF is a think tank of cybersecurity and policy experts with the vision of pioneering Cyber Peace Initiatives to build collective resiliency against CyberCrimes and global threats of cyber warfare.

Appsec Phoenix

Appsec Phoenix

Appsec Phoenix is an end to end vulnerability management platform that focuses on workflows, threat feed, and real time data.

Sensity

Sensity

Sensity is a company that offers an AI-driven solution to detect and verify deepfakes and other forms of identity fraud.

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Auto-ISAC provides a forum for companies to analyze and identify threats sooner and share solutions that enhance vehicle cybersecurity.