Surveillance & Biometric Systems
Cameras and biometrics are often treated as premium controls even when they are poorly placed, weakly monitored, or operationally disconnected from access control. A modern physical assessment should validate what these systems actually see, how quickly anyone responds, and whether checkpoint design makes spoofing or bypass easier than the owner thinks.
Assessment Goal
Camera Architecture Review
What To Validate
- • Approach coverage to badge doors, elevators, and stairwell exits
- • PTZ timing and whether operators can realistically track movement
- • Lighting, backlight, and angle quality for identification
- • Whether cameras cover only the perimeter or also the post-entry objective path
Common Weaknesses
- • Wide-angle presence cameras with poor facial detail
- • Visible cameras that do not cover the route people actually use
- • PTZ cameras aimed at the wrong default scene
- • Recording without review, alerting, or retention practices that support investigations
Biometric Checkpoint Questions
| Control | Assessment Question | Failure Pattern |
|---|---|---|
| Face recognition | Is liveness checked, and can staff override low-confidence matches casually? | Convenience overrides confidence thresholds |
| Fingerprint / palm | What happens when the reader fails or the user is in a rush? | Fallback badge or manual override becomes the real control |
| Voice / intercom | Is there trusted callback or only conversational persuasion? | Social engineering defeats the checkpoint faster than technical spoofing |
ONVIF, RTSP, and Camera Network Exposure
If the engagement includes authorized camera-network validation, document whether management interfaces, ONVIF discovery, or RTSP streams are exposed on trusted segments without segmentation or strong credentials. Many “physical” camera issues become technical compromise opportunities once you reach the right switch port.
# Example authorized checks from an internal assessment segment
nmap -sV -p 80,443,554,8080,8899 10.10.20.0/24
# Look for RTSP and ONVIF exposure
nmap --script rtsp-url-brute -p 554 10.10.20.0/24
# Common review points
# - Default credentials or shared service accounts
# - ONVIF discovery responses leaking make / model metadata
# - Unencrypted RTSP streams on internal shared segments
# - Camera VLAN reachable from non-security workstationsResponse Workflow Matters More Than Sensor Count
A camera seeing you is not the same thing as a camera stopping you. During assessments, record:
- • Whether alarms or access denials generate an actionable response
- • How long it takes for local staff or guards to investigate suspicious movement
- • Whether operators can correlate visitor records, badge events, and camera views quickly
- • Whether surveillance is positioned to support prosecution, deterrence, or neither
Observation Record
A camera that sees you is not a camera that stops you. Capture both halves:
Camera or sensor identity: Make, model, location, and the scene it is aimed at, taken from the client inventory where the client will share it.
Coverage track: The route walked and the point where the camera lost the tester, with the timestamp of entering and leaving the field of view.
Response measurement: How long until a guard, operator, or employee investigated, what they did, and whether the response matched the event.
Network exposure: The exact ONVIF, RTSP, or management response captured, the segment it came from, and the time of capture.
Biometric checkpoint: Which modality was tested, whether liveness was in play, and who overrode what and under which procedure.
Retention check: How long footage and events are kept, and whether anyone reviews them. Coverage without review is a recording, not a control.
False Positives
- Camera present but not recording: Check recording state, retention, and review practice before claiming coverage. A dome with a blinking LED proves nothing.
- PTZ on patrol: A momentary blind spot during a sweep is not a fixed gap. Record the sweep interval and the dwell time before calling it a blind spot.
- ONVIF visible on a lab segment: Exposure on a test or vendor VLAN is not exposure on the production camera network. Name the segment.
- Operator override read as spoofing: A guard waving someone through, or a supervisor clearing a low-confidence match, is a process failure rather than a biometric bypass.
- One slow response: A single unattended event may fall in a shift handover. Repeat at a different hour before reporting response time as a control gap.
Testing Checklist
Coverage
- ☐ Walk the post-entry route, not just the perimeter, and note where coverage drops.
- ☐ Check lighting and backlight at the time of day the route would be used.
- ☐ Confirm the recorded image is good enough to identify a person, not just detect one.
Network
- ☐ Confirm which segment camera management and streams are reachable from.
- ☐ Check for default or shared service accounts on cameras and recorders.
- ☐ Note whether RTSP streams are encrypted and whether ONVIF discovery is exposed.
Response
- ☐ Trigger an authorised event and time the response.
- ☐ Ask how visitor records, badge events, and camera views are correlated during an incident.
- ☐ Confirm retention length and who reviews footage, and how often.
Remediation
Coverage design
- • Cover the approach to badge doors, lifts, and stairwells, and check the field of view against the route people actually walk.
- • Set PTZ default scenes and patrols around the post-entry objective path, not the lobby artwork.
Network
- • Put cameras and recorders on their own VLAN, unreachable from user segments, with management behind a jump host.
- • Replace default and shared credentials with per-device accounts, and restrict ONVIF and RTSP to the recorder.
Response workflow
- • Route access denials, forced doors, and camera analytics to a queue with a named responder and a target time.
- • Set retention to a length that supports investigations, and review a sample of events on a fixed cadence.
Verification schedule
- • Walk the blind spots quarterly and review camera firmware and credentials annually, or after any recorder replacement.