FW: Securing a Barracuda DVR video surveillance system?

["Paul Marsh" <pmarsh () nmefdn org>]

 Jeff:

        If they have not purchased the product yet have them check out
Honeywell's RapidEye product.  I was in the very same boat as you.  The
security vendor installed the product then told the customer sure you
can view it remotely.  The vendor had no clue as to how to do it so I
was called in.  Here let me put this 2 ton elephant in your lap I'll be
right back, ouch.

Thanx, Paul

-----Original Message-----
From: Jeff Davis [mailto:jeff () dynamictelecard com]
Sent: Monday, July 25, 2005 11:38 AM
To: security-basics () securityfocus com
Subject: Securing a Barracuda DVR video surveillance system?

I have a company that wants to run a 'Barracuda DVR video surveillance
system' and use the remote viewing capabilities.

I was curious is anyone on the list has
experience in trying to secure this.

I just got a copy of the installation instructions, and there is no
mention of how to secure this.

In fact its basically run the install, open a bunch of ports on your
router.

For the client it tells it only works in IE, and then to change your
security settings so that IE prompts you to allow downloading and
initialization of unsigned ActiveX controls.

I contacted the company and asked some
questions about the software.
I got what I expected.

"The webserver is proprietary..."
"The database is proprietary..."
..etc...

I did get told that they prefer that you
*not* run any anti-virus software on the box, because some of them
interfere with the surveillance software and also degrade performance.

If anyone has more info on this,
I would greatly appreciate you sharing.

Thanks,

Jeff



The information in this transmittal (including attachments, if any) is privileged and confidential and is intended only 
for the recipient(s) listed above. Any review, use, disclosure, distribution or copying of this transmittal is 
prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please 
notify me immediately by reply email and destroy all copies of the transmittal. Thank you.