A small office finds its cameras and recorder exposed to the internet by UPnP and port forwarding, and fixes it with a camera VLAN and a remote-access gateway
An independent insurance agency of 14 staff in one office in Broward County, a leader in its segment.
- Scale
- 1 office, 8 PoE cameras, 1 network video recorder, 9 UPnP mappings and 4 manual port forwards before, 0 after, 1 inbound UDP port for the gateway, 3 VLANs
- Engagement
- One day to find and close the exposure, then two weeks to rebuild the office network and remote access
The challenge
The agency's cameras and recorder had been installed by an alarm vendor, who set up remote viewing by forwarding ports on the internet router so the owner could watch from a phone. The router also had UPnP switched on, so devices on the office network could open further ports to the internet without anyone being asked. A routine external check of the office's public address found the recorder's login page, its video stream port and the router's own administration page reachable from anywhere. The recorder's own log showed about 2,300 failed sign-in attempts from around the world in the previous 30 days.
Security cameras are computers that happen to have lenses. They run old operating systems, ship with default passwords and are often installed by a vendor whose goal is that remote viewing works on the first visit. The usual way to make that work is to open a port on the router, and the more convenient way is UPnP, which lets devices ask the router to open ports for them.
Both turn a private device into a public one. Automated scanners look for recorder login pages and camera streams all day, and a device on the internet is found within hours. We usually start with the outside view, checking what the office's public address answers to, because it shows what an attacker sees and takes about ten minutes.
Closing the ports was the easy part, so it was done on the first day. Making remote viewing work again without them took the rest. The design gives the cameras a network of their own where they can talk to the recorder and nothing else, and it puts one carefully protected entry point, a WireGuard gateway, in front of the whole office. The owner still opens an app on a phone, but the app now reaches a gateway and not a camera.
Small offices rarely have an IT department, so the handover is part of the project. A one-page diagram, a note on what to do when a camera drops off and an alert for new inbound rules mean the next vendor visit cannot quietly undo the work. This illustrative case shows that a fix for a small office can be a day of work and still be a real one.
What our team delivered
- Same-day containment: the four port forwards were removed and UPnP was turned off on the router, which closed 13 openings at once. The router's UPnP table had listed 9 mappings created by devices, including the recorder, a printer and a video-game console. The recorder's password was changed and an external check confirmed no camera service answered from the internet
- A review of what the recorder held and who had been in: its sign-in log, the accounts configured on it, its firmware version and whether any footage had been exported. The recorder was running firmware more than two years old and still had the factory administrator account. Firmware was updated, the default account was replaced with named accounts and the cameras' own default passwords were changed to long unique ones kept in the agency's password manager
- Three VLANs on a managed PoE switch: staff, guest Wi-Fi and cameras. The cameras and recorder sit on their own VLAN, the cameras can reach only the recorder and a time server, and the recorder has no route to the internet. Staff devices can reach the recorder's viewing interface on a single port, and nothing on the camera VLAN can start a connection to staff devices
- Remote access through a gateway instead of a port forward. A WireGuard endpoint on the office firewall is the only inbound service, using one UDP port, with a key per person and device. The owner connects from a phone, opens the recorder's address on the camera VLAN and sees live video. A lost phone is handled by removing its key. WireGuard stays silent to anyone who does not hold a valid key, so a scan of the port finds nothing to attack
- Vendor and cloud features reviewed one by one. The recorder's built-in cloud relay and peer-to-peer feature were switched off because remote viewing now runs through the gateway. The alarm vendor receives a time-limited remote-support arrangement when needed instead of a permanent forward
- Firewall rules reduced to named allows with default deny between zones, router remote administration disabled, firmware auto-update enabled on the firewall and access points, and an alert if a new inbound rule or a new port mapping appears. A recorder and camera firmware check is scheduled twice a year
- A short handover for the office manager: what changed, how to connect from a phone, what to do if a camera goes offline and a one-page diagram of the three networks
Result
An external scan of the office's address now finds one UDP port that does not respond without a valid key, and no recorder, camera or router page. The recorder's failed-login count fell from about 2,300 a month to zero, and the owner can still watch from a phone in three taps. A camera that is compromised in the future has no route to the internet and no route to staff computers. Remote access through a gateway is only as safe as the keys and the device that holds them, and footage recorded before the fix could have been viewed, which the agency reviewed with its counsel. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 2 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Access to one app, not to the network
Zero trust network access replaces the all-or-nothing VPN. The identity provider proves who you are, the device agent proves the laptop is healthy, the policy engine decides, and the enforcement point opens a tunnel to that single application and nothing else.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.