Cameras, equipment trackers, environmental sensors and gate controllers have become routine on construction sites. They deter theft, document progress and improve safety. They are also small computers that often ship with weak default passwords, rarely receive updates and sit directly on the jobsite network.
Attackers know this. Internet-connected cameras and similar devices are frequently found by automated scans and taken over, either to watch a site or to use as a stepping stone into a larger network.
The Common Problems
- Default credentials. The factory username and password are published online.
- Open ports to the internet. Someone enabled port forwarding so a supervisor could view the camera from home.
- No updates. Firmware is installed once and never touched again.
- Shared networks. Cameras sit on the same network as laptops and the accounting system.
- No inventory. No one knows how many devices are on site or who installed them.
- Unmanaged accounts. The installer's account remains active after the project.
Step 1: Keep an Inventory
For each device record the location, make and model, serial number, IP address, firmware version, who manages it and which vendor supports it. An inventory is the foundation of everything else.
Step 2: Put Devices on Their Own Network
The most valuable single step is network separation. Place cameras and sensors on a dedicated network or VLAN, separate from the one used by laptops and tablets. Configure the router or firewall so that:
- Devices can reach only the services they need, such as a cloud video platform.
- Devices cannot initiate connections to company computers.
- Staff devices can reach the camera system only through approved methods.
If a camera is compromised, the attacker is contained to a network that holds nothing else of value.
Step 3: Replace Default Credentials
Change every default password to a unique, strong one, and store it in a password manager. If a device does not allow changing the default, replace it or isolate it very tightly. Disable unused accounts and services such as old remote management protocols.
Step 4: Avoid Direct Internet Exposure
Do not forward ports from the internet to cameras or recorders. Use a method that does not expose the device directly, such as a vendor cloud service with multi-factor authentication, or a secure remote access connection that requires sign-in before reaching the device.
Step 5: Choose Vendors Carefully
Before buying, ask:
- Does the vendor release security updates, and for how long?
- How are updates delivered?
- Is data encrypted in transit and at rest?
- Where is video stored, and who can access it?
- Does the vendor support multi-factor authentication on its cloud accounts?
- What happens to the data and accounts if you cancel?
Low-cost devices from vendors with no update track record can become a long-term liability.
Step 6: Plan for Updates and Monitoring
Schedule periodic firmware checks, and apply updates during low-risk times. Where possible, monitor device health and alerts, such as devices going offline, which can indicate tampering, power failure or connectivity problems.
Step 7: Mind Privacy and Policy
Video of workers and neighbors raises legal and policy questions. Post signage where appropriate, define who can view footage and how long it is retained, and check requirements with counsel for your location and customer contracts. Restrict viewing and export rights to people who need them.
Step 8: Decommission Properly
At project end, remove devices, reset them to factory defaults, delete cloud accounts or transfer them properly and remove the network configuration. Devices left behind with active credentials are an easy target.
A Quick Setup Checklist
- Inventory devices and owners.
- Place them on a separate network.
- Change all default passwords.
- Disable direct internet exposure.
- Enable multi-factor authentication on cloud portals.
- Document update responsibilities.
- Define viewing and retention rules.
- Reset and remove at project end.
Getting Help
Ironfield Cyber helps contractors design secure jobsite networks that include cameras, trackers and sensors, and can review devices already in the field for exposure. If you are unsure what is plugged into your trailer network, we can help you find out.