TL;DR:

  • Business CCTV cameras running default passwords are actively scanned and compromised within hours of being internet-connected — change credentials and disable UPnP before deployment
  • The ICO requires most businesses using CCTV to register under the Data Protection Act and display signage — failure to comply risks fines
  • Separating cameras onto their own network segment prevents a compromised camera from being a pivot point into your main business network

CCTV is standard security kit for UK small businesses, but the cameras themselves are often the least-secured device on the network. When cybersecurity researchers scan for vulnerable devices, IP cameras consistently appear near the top of the results — and the reason is simple: most are deployed with default manufacturer credentials that never get changed.

This guide covers the key security steps for business CCTV that most small business owners and their IT providers skip.

Why CCTV Cameras Are Targeted

An IP camera is a Linux computer with a network connection and a web interface. It has the same attack surface as any other internet-connected device, but historically the weakest security hygiene.

The Mirai botnet — which in 2016 took down large chunks of the internet including Twitter and Netflix — ran almost entirely on compromised CCTV cameras and routers using default passwords. Variants of Mirai continue to circulate, and the cameras being targeted now include the same brands commonly sold to UK businesses: Hikvision, Dahua, TP-Link Tapo, Reolink, and Annke.

For a business, a compromised camera is concerning for three reasons:

  1. The video feed itself — footage of your premises, safe locations, staff, and customer areas can be viewed by attackers (and potentially sold or posted publicly)
  2. Network access — a compromised camera on your main business network gives attackers a foothold from which to reach your computers, file shares, and cloud credentials
  3. Botnet use — your cameras may be used to attack other people’s systems, potentially creating legal or reputational exposure

Step 1: Change Default Passwords Immediately

This sounds basic because it is, but it’s also the most commonly missed step. Every IP camera ships with a default username and password — usually something like admin/admin, admin/12345, or a model-specific default printed on the bottom of the device. These are published in manufacturer manuals and widely known to attackers.

Automated scanners continuously probe internet-accessible IP addresses for devices running camera firmware. A camera with default credentials that gets a public IP (through UPnP port forwarding or direct connection) will typically be compromised within hours.

What to do:

  • Change the admin password on every camera before connecting it to the network, using a unique strong password (16+ characters)
  • Store the password in your business password manager, not on a Post-it or spreadsheet
  • Do the same for the NVR (network video recorder) or DVR that stores footage
  • Change the password on the camera management software or app used to view live feeds

Step 2: Disable UPnP on Your Router

Universal Plug and Play (UPnP) is a protocol that allows devices on your network to automatically request port forwarding on your router. It’s enabled by default on most consumer and prosumer routers.

When you install an IP camera system, the camera or NVR will often use UPnP to open itself to the internet automatically — without you making any explicit decision. This is how cameras end up internet-accessible without the business owner being aware of it.

Log into your router’s admin panel and disable UPnP. Then check your port forwarding rules and remove any entries created by camera systems unless you deliberately created them and need them.

If you need remote access to your CCTV system, the right approach is to use the manufacturer’s secure cloud relay (not direct port forwarding), or set up a VPN to your network for access.

Step 3: Keep Firmware Updated

CCTV camera manufacturers release firmware updates that patch security vulnerabilities. Unlike your laptop, cameras don’t update themselves automatically — many businesses are running camera firmware that’s years out of date.

Log into your NVR or each camera’s web interface and check the current firmware version against the manufacturer’s download page. Set a reminder to check every three months.

Hikvision and Dahua in particular have had serious vulnerabilities (some rated critical, allowing complete takeover without authentication) in the past that were patched in firmware updates but only protected users who applied them.

Step 4: Put Cameras on a Separate Network

The most effective security control for a CCTV system is network isolation. If your cameras are on a separate VLAN or a separate WiFi network with no access to your business computers and servers, a compromised camera cannot reach your other systems.

This is easier than it sounds on modern routers:

  • Many business-grade routers (ASUS Business, Ubiquiti, TP-Link Omada) support VLANs via the web interface
  • Create a “cameras” VLAN with internet access (for cloud viewing if needed) but no access to your main LAN
  • Set firewall rules to block traffic from the camera network to your business network

If network segmentation sounds too technical, ask your IT support provider — it’s a standard configuration that should take under an hour. If you don’t have IT support, consider a cloud-managed router that makes VLAN setup more accessible.

Step 5: Prefer Local NVR Recording Over Pure Cloud

Some low-cost camera systems (particularly from Eufy, Ring, and similar consumer brands) record footage entirely to the cloud with no local storage option. For business use, this creates several problems:

  • Footage is stored with a third party (consider your GDPR obligations)
  • Viewing footage requires the company’s servers to be working
  • Cloud subscription costs accumulate

A local NVR (network video recorder) or DVR stores footage on-premises and gives you control over retention periods, access, and what happens if the manufacturer goes out of business or changes their terms.

If you use CCTV at your business premises (including external cameras capturing public areas), you almost certainly have obligations under UK data protection law:

ICO registration — Most organisations that process personal data — including CCTV footage — must pay the ICO data protection fee (£40–£2,900 per year depending on size). Check the ICO register at ico.org.uk.

Signage — You must display clear signs telling people they’re being recorded, who operates the cameras, and why. The ICO provides template signs.

Retention limits — Don’t keep footage indefinitely. Most businesses delete footage after 30–90 days. Document your retention policy.

Subject access requests — Individuals can request CCTV footage featuring them. You have one month to respond.

The CCTV Code of Practice from the ICO provides full guidance. Non-compliance can result in fines from the ICO, which has become more active in enforcing CCTV-related data protection issues.

Quick Security Checklist

Before you leave this page, check these off:

  • Default passwords changed on all cameras and NVR
  • UPnP disabled on router
  • Camera firmware up to date
  • Cameras on a separate network segment (or planned)
  • ICO registration in place
  • CCTV signage displayed
  • Retention policy documented

Most CCTV security failures come down to rushed installation — the camera gets mounted, connected, and left with factory settings. Taking 30 minutes to work through this list after installation will protect you against the most common attack patterns.