Construction sites rely on cameras and drones more than ever. Time-lapse cameras document progress, security cameras deter theft, and drones capture aerial surveys and inspections. The footage can protect you in a dispute and help you manage progress. It can also create exposure if it is poorly secured: unauthorized access to live feeds, leaked images of a client's facility, or camera systems that become an entry point to your network.
This guide covers the practical steps for managing the technology, footage, and policies around jobsite cameras and drones.
Treat cameras as networked computers
Every internet-connected camera, recorder, and sensor is a small computer. Many ship with default passwords, outdated firmware, and features that expose them to the internet. Attackers actively scan for such devices.
Camera hardening checklist
- Change default credentials on every camera and recorder, and use unique passwords stored in a password manager.
- Update firmware at installation and on a schedule.
- Disable unneeded features, such as direct internet exposure, unused remote viewing protocols, and guest accounts.
- Use a separate network for cameras, isolated from laptops and company systems.
- Restrict remote viewing to a secure, authenticated method with multi-factor authentication where available, instead of open ports.
- Create named user accounts, so you can see who viewed what.
- Record who installed it, who supports it, and when it should be removed.
Vendors and cloud services
Many camera systems send video to a cloud service. Before choosing one, ask:
- Who can access our footage at the vendor, and under what conditions?
- Where is it stored, and for how long?
- How is it encrypted in transit and at rest?
- How do we remove access for former employees and contractors?
- What happens to the footage when the contract ends?
Footage as a business record
Footage can become evidence in a theft claim, a safety investigation, or a schedule dispute. Decide in advance:
- Retention. How long do you keep routine footage, and when do you preserve it longer? Consider contract requirements and discuss legal needs with your attorney.
- Access. Who may view and export it?
- Chain of custody. If footage may be used as evidence, keep the original and log who handled copies.
- Deletion. Delete on schedule, unless a hold applies.
Privacy and customer sensitivity
Cameras may capture workers, neighbors, and sensitive customer areas. Consider:
- Notifying workers that cameras are in use, and where.
- Avoiding views into adjacent private property.
- Honoring customer restrictions on photography, which are common in healthcare, government, energy, and industrial facilities.
- Following any state or local rules on recording, particularly regarding audio. Ask counsel if unsure.
For secure or critical facilities, a customer may prohibit cameras and drones entirely, so check the contract before deploying.
Drone considerations
Operations and regulation
Commercial drone operations in the United States are regulated by the Federal Aviation Administration, with requirements for pilot certification and rules for where and how you may fly. Confirm that your operators are properly certified and that flights comply with current rules, including airspace restrictions.
Data handling
- Store flight data securely, with access limited to those who need it.
- Use encrypted storage on the controller, tablets, and memory cards, and protect the apps that manage flights.
- Control accounts for drone software, with MFA and individual logins.
- Be cautious with imagery of critical infrastructure. Facilities such as energy sites may have sensitivity restrictions.
- Apply retention rules to survey and inspection data, just as with other project records.
Equipment security
Keep firmware and apps updated, and understand where the manufacturer's software sends data. Some customers restrict certain drone brands, so confirm requirements in advance.
Protect the people managing the system
A camera system is only as secure as the accounts that control it. Use unique logins, remove access when people leave a project, and review the user list at least quarterly.
Plan for an incident
If you suspect a camera system has been compromised, disconnect it from the network, change credentials, review access logs, and check whether it was used to reach other systems. If footage may have been exposed, consult counsel about notification obligations to customers.
Include cameras in closeout
When a project ends, remove devices, wipe stored footage according to retention rules, reset equipment to factory settings, close cloud accounts, and archive necessary records.
Support from Ironfield Cyber
Ironfield Cyber helps contractors and energy companies secure the networks behind jobsite cameras and field devices, and review vendor and retention practices. If you are about to deploy cameras across several sites, we can help you set a standard configuration.