The NIS2 Directive Will Impact The Security Ecosystem Across The EU

In our increasingly digital and interconnected world, it’s little surprise that business leaders and governments are focusing on the cybersecurity of everything connected to the Internet. As the Internet of Things (IoT) expands, so do the opportunities for malicious actors to exploit devices, either as gateways to larger cyberattacks or to access data.

Indeed, the European Union Agency for Cybersecurity, ENISA, sees new threats to cybersecurity emerging because of the wealth of data that devices can now collect and the advances in AI that now make cyber-attacks more complex and scalable.

Here Comes The NIS2 Directive

The NIS2 Directive, a Europe-wide legislation that aims to improve the cybersecurity of network and information systems across the EU, goes some way in combatting the increased risk of cyber-attacks. It is a continuation of the first NIS Directive, with an expanded remit including digital infrastructure such as cameras and IoT devices. Any business that uses cameras and other connected devices will need to take additional steps to protect video network security and its data from 18 October 2024. 

Europe has had a long track record of leading the way in terms of data protection, with GDPR being a recent example. So, we can expect the NIS2 Directive to have some sway over other governments’ legislation in the coming years. It’s a savvy move for all organisations to follow the practices and guardrails put in place by the legislation, especially if they operate in, or do business with, Europe. 

Complying With The NIS2 Directive 

The NIS2 Directive focuses on two main areas: Protecting networks and information systems through proactive measures; and responding quickly when under a cyberattack.

Protecting your video network and other devices
Your video and IoT network is a unique target for hackers thanks to the data it collects, and which can be used to gain confidential information, for blackmail, or even to inform future cyber or physical attacks, through mapping out a building’s floor plan and schedules. 

Checking the fundamentals are in place to secure cameras is the first to-do on any user’s list. You can separate this into two main areas: asset management and access management. 

Asset management involves securing the hardware within your security system. That’ll include cameras, servers, and sensors. 

Of course, every device in your network will become vulnerable if its firmware isn’t kept updated. Users should check for the latest version as soon as it is installed, as some time can pass between a camera leaving the factory and its installation. Likewise, camera drivers should be updated to the latest software version. Some camera models come with factory passwords and these need to be changed quickly.

This brings us to access management best practices. Password sharing is common in many workplaces, but it can introduce significant vulnerabilities through stolen or misused passwords. Without unique login credentials, you cannot track who is in your system, and what they are doing. So, every individual needs their own access credentials for a video system. 

Individuals should be granted the level of access appropriate to their role, and that extends to a physical space too. If someone isn’t directly working on the maintenance or administration of the hardware and software, they shouldn’t have access to a server room and shouldn’t have admin rights. 

Getting the basics of video cybersecurity right will greatly reduce a system’s attractiveness to malicious actors. 

Rapid Cyber-Attack Responses
If the worst-case scenario happens and you find that someone has gained unauthorised access to your system, you’ll need to respond quickly. Where separation exists between a video network and wider IT infrastructure, containment will be relatively straightforward (hence, this is greatly advised to have in place!). 

Users should identify the affected devices and networks and, if possible, take them offline to disconnect them and prevent a widespread gateway attack. Checking audit reports will help understand who has accessed the system, what they did, and when.

It’s worth simulating an attack on your video system on a regular basis. This’ll allow you to test response times and processes, identify unused licenses or other vulnerabilities, and train your team. Under pressure, people often revert back to their habits and training, so ensuring that they understand what to do and what to avoid can make a huge difference in a cyber-attack. 
Your choice of partner matters
Partnering with a responsible manufacturer who puts cybersecurity at the core of product development can make a serious difference to cyber-resilience. 

Compliance with NIS2 Directive is just the start for anybody working in the digital realm. Governments worldwide are making concerted efforts to improve cybersecurity. Working together with a reputable manufacturer, organisations can rest assured that their video security ecosystems won’t be an easy target.

Jos Beernink is VP EMEA at Milestone Systems

Image: 

You Might Also Read:

Resilience As Regulation: Preparing For The Impact Of CER:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Mobile & On-Line Banking Cyber Security [extract]
For Many Businesses Experiencing MultiCloud Data Breach, Multi-Cloud Security Could Be The Answer »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Pervade Software

Pervade Software

Pervade Software is a global provider of dedicated compliance tracking software with monitoring & reporting capabilities.

Kernelios

Kernelios

Kernelios is a simulator-based training center and an incubator for cyber experts worldwide.

DocAuthority

DocAuthority

DocAuthority automatically discovers and accurately identifies unprotected, sensitive documents, enabling a broad yet business-friendly security policy.

GK8

GK8

GK8 is a cyber security company that offers a high security custodian technology for managing and safeguarding digital assets. Secure, Compliant and Practical.

Angoka

Angoka

Angoka provide hardware-based solutions for managing the cybersecurity risks inherent in machine-to-machine communication networks.

Ukrainian Academy of Cyber Security (UACS)

Ukrainian Academy of Cyber Security (UACS)

UACS is a professional non-profit public organization established to promote the development of an extensive network and ecosystem of education and training in the field of cyber security.

RocketCyber

RocketCyber

RocketCyber is a Managed SOC platform empowering Managed Service Providers (MSPs) to deliver security services to small and medium businesses.

BreachQuest

BreachQuest

BreachQuest brings together cybersecurity experts with decades of experience identifying security flaws, penetrating networks, and responding to incidents.

WithSecure

WithSecure

WithSecure (formerly F-Secure Business) is your reliable cyber security partner, providing outcome-based cyber security that protects and enables operations.

Moro Hub

Moro Hub

Moro Hub, a subsidiary of Digital DEWA, is a UAE-based digital data hub focused on digital transformation and operational services.

Centre for Cyber Security Research & Innovation

Centre for Cyber Security Research & Innovation

The Centre for Cyber Security Research & Innovation is Nepal's First Academic Research Institute to focus on understanding the overall Information Security of Nepalese Organizations.

HTL Support

HTL Support

HTL Support, your trusted partner for comprehensive IT support in London. We specialize in delivering top-tier IT solutions tailored to both large enterprises and small businesses.

LockMagic

LockMagic

Lockmagic is an information asset management solution to protect, track, audit and control accesses to sensitive information inside and outside your organization.

Multidisciplinary Institute for Cybersecurity and Cyber Resilience (IMC2)

Multidisciplinary Institute for Cybersecurity and Cyber Resilience (IMC2)

IMC2 brings together resources to carry out ambitious, innovative and multidisciplinary projects in the field of cybersecurity and cyber resilience.

DeepTempo

DeepTempo

At DeepTempo, we build AI models and related software that protect enterprises and service providers from sophisticated cyber threats.

Cyberdise

Cyberdise

Cyberdise is an AI-driven cybersecurity awareness solution designed for companies with complex security requirements.