Securing Your Surveillance: Why IP Cameras Need Network Segmentation

Ask any business owner in Boca Raton or Delray Beach how their security cameras connect to the network, and most will say, "Same as everything else — it's all on the office Wi-Fi." That answer used to be harmless. Today it's a liability. Physical security installers plug cameras, NVRs (network video recorders), and door access panels into the same network as workstations, printers, and servers because it's faster and cheaper. But that convenience creates what's called a "flat network" — one where every device can talk to every other device. A camera doesn't need to talk to your payroll server. On a flat network, it can.

The assumption we hear most often is "it's just a camera, what's the harm?" The harm is that a camera is a small computer running its own software, and like any computer, it can be broken into. Once it is, the attacker isn't looking at your parking lot feed — they're looking for a path to your file server, your point-of-sale system, or your customer records. A camera breach isn't a video problem. It's a network problem wearing a camera's face.

Why IP Cameras and Access Control Are Prime Targets

This isn't a hypothetical risk. The Cybersecurity and Infrastructure Security Agency (CISA) has added several IP camera vulnerabilities to its Known Exploited Vulnerabilities catalog — meaning these aren't theoretical bugs, they're actively being used in real attacks. Two examples: CVE-2019-11001 and CVE-2021-40407, both OS command injection flaws in Reolink IP cameras, letting an attacker run their own commands on the device remotely.

Beyond Reolink, some camera vendors have simply gone dark on security. CISA advisories have flagged critical, remotely exploitable camera vulnerabilities where the manufacturer never responded to coordinate a fix — leaving affected devices exposed indefinitely, wherever they happen to be installed, from homes to small offices to industrial sites. That's the pattern to watch for: consumer-grade or discontinued cameras quietly running unpatched, with no vendor plan to ever fix them.

This isn't a new problem, either. Back in 2017, a backdoor in Dahua cameras and DVRs earned a 9.8 out of 10 severity score from DHS ICS-CERT and affected more than a million devices worldwide. And it's not just obscure or older hardware — Bitsight research found more than 40,000 cameras exposed worldwide right now through unsecured HTTP or RTSP connections, streaming live footage from offices, stores, data centers, ATMs, and even hospitals to anyone who knows where to look.

A camera with a default password isn't a security device — it's an open window.

The Mirai Lesson: Default Passwords Get Weaponized, Fast

IoT default credentials aren't a theoretical weakness — they're actively scanned for and exploited by automated tools, constantly. In 2016, malware called Mirai proved this at scale: it scanned the internet for devices still using factory-default logins like "admin/admin," enslaved more than 600,000 of them — mostly home routers and cameras — into a botnet, according to research from Cloudflare and academic partners, and used it to launch one of the largest DDoS attacks recorded at the time, per CISA's US-CERT alert.

None of those camera owners knew their device had joined an attack on someone else. The lesson hasn't changed: an unmanaged camera is a device that can be hijacked and used against you — or against someone else entirely.

What Network Segmentation and VLAN Configuration Actually Do

Network segmentation means dividing your network into separate, isolated zones so devices in one zone can't freely talk to devices in another. Think of it as building interior walls in a building that used to be one open room. A VLAN (virtual local area network) is the tool that makes this practical — it lets you create those separate zones using the switches and equipment you likely already have.

The technical piece that makes this work is IEEE 802.1Q VLAN tagging. It labels network traffic so that devices stay isolated from each other even when they're plugged into the same physical switch. You don't need a separate box of hardware for every zone — you need correct configuration.

The National Institute of Standards and Technology (NIST) has published detailed guidance on this exact problem. NISTIR 8228, on managing IoT device cybersecurity risk, identifies limiting what a device can reach on the network as one of the core mitigations for IoT risk — precisely because these devices often can't be secured or patched the same way a laptop or server can. NIST's own emphasis: the ability to restrict what an IoT device can communicate with is critically important, especially given how many of these devices now sit on business networks.

In our experience, this is the single most useful mental model for a business owner to carry around: a camera or access panel should only ever be able to talk to the handful of systems it actually needs — its own recorder, its own management console — and nothing else. If a device can technically reach your file server but never needs to, that path should simply not exist on the network.

How Segmentation Protects Your Cameras, Access Control, and Business

CISA's own advisories on IP camera vulnerabilities recommend exactly this approach: minimize how much a camera or control system is exposed to the internet, place it behind a firewall separate from your business network, and if remote access is needed, use a secure VPN rather than exposing the device directly.

Here's what that actually buys you. If a camera on its own VLAN gets compromised, the attacker's lateral movement is strictly contained within that zone, making it exceptionally difficult to pivot to your main systems. They can't easily reach your payroll system, your point-of-sale terminals, or your customer database, because the network itself is built to block that traffic. For a retail strip in Boynton Beach or Delray Beach running seasonal tourist transactions through POS systems near a camera network, that separation is the difference between losing a video feed and losing card data.

The same logic applies to ransomware. Most ransomware doesn't start on your file server — it starts somewhere weaker and spreads. Segmentation shrinks that blast radius dramatically, because the compromised device has far fewer places to go.

There's a business case here too, beyond security. What cyber insurance requires increasingly includes proof that you've segmented sensitive systems and limited lateral movement across your network. Being able to show an underwriter — or an auditor — that your cameras and access control sit on isolated VLANs makes those conversations much shorter.

Getting Started: Segmenting Surveillance Networks in South Florida

Getting this right doesn't require ripping out your existing cameras. It starts with an audit: what cameras, NVRs, and access panels do you have, and what are they currently plugged into? In our experience, most businesses are surprised to find security hardware sharing a switch — and a network — with the front-desk computer.

From there, a few concrete steps make a real difference:

1. Place cameras and access panels on a dedicated VLAN, separate from workstations and servers, using a managed switch.
2. Use a firewall rule that blocks all traffic between the camera VLAN and your main business network — and your guest Wi-Fi.
3. Replace default camera logins with unique, camera-specific credentials immediately after installation.
4. Disable direct internet access to cameras; require a VPN connection for any remote viewing.
5. Document which devices sit on which segment, and review access logs monthly for anything unusual.

Hurricane season adds a South Florida wrinkle. When storms knock out connectivity across Broward and Palm Beach County, businesses scrambling to restore service sometimes reconnect cameras and access panels quickly, plugging them into whatever's available to get eyes back on the building — exactly the kind of rushed, flat setup that creates risk in the first place. It's worth building segmentation in before the next storm, not during the scramble afterward. And ongoing patch management matters everywhere, because some vendors simply never issue a fix for known flaws — segmentation may be the only real protection you get in that case.

This is exactly the kind of work a managed IT partner should be doing alongside your physical security setup, not as an afterthought. VLAN configuration and setup paired with ongoing security monitoring turns "it's just a camera" into a properly contained part of your network. If you're already working with us on physical security, existing TechPro security customers can have this segmentation reviewed as part of their current plan.

Frequently asked questions

How do I secure IP cameras from hackers?

Start by isolating cameras on their own VLAN, disabling default credentials, and keeping firmware current. CISA also recommends placing cameras behind a firewall separate from your business network and using VPN for any remote access rather than exposing them directly to the internet.

What is network segmentation for security cameras?

Network segmentation means placing cameras, NVRs, and access control panels on a separate VLAN from computers and servers. Even if devices share the same physical switch, 802.1Q VLAN tagging keeps their traffic isolated, so a compromised camera can't reach the rest of your network.

Can someone hack my business security cameras?

Yes — CISA has listed multiple actively exploited IP camera vulnerabilities, and Bitsight identified over 40,000 cameras worldwide exposed via unsecured access. Many attacks succeed simply because devices use default passwords or sit on the same network as everything else.

Do I need a separate network for my surveillance system?

For most businesses, yes. NIST's IoT security guidance recommends restricting what these devices can communicate with, which in practice means segmenting cameras and access panels from your core business systems so a breach in one area can't spread to another.

How do I prevent a ransomware attack through security cameras?

Segmentation is the key defense — it is designed to block a compromised camera from serving as an open doorway to your servers. Pairing that with firmware updates, credential hygiene, and monitoring closes most of the paths ransomware actors use to pivot from IoT devices.

Is my access control system vulnerable to cyber attacks?

If your door access panels sit on the same flat network as workstations, they carry the same risk profile as any other unsegmented IoT device. Vulnerabilities in unmanaged camera and access hardware — some rated near the top of the severity scale, per CISA and DHS ICS-CERT advisories — show how a single unpatched device can expose an entire network if nothing separates it from the rest.

If your cameras, door access, and office network are all sharing the same flat setup, it's worth a second look — before someone else finds the gap first. Our South Florida IT support team can walk through your current setup and show you exactly where the risk sits. Get in touch for a free IT assessment.