Surveillance: CCTV, Motion Sensors, and Logging

Surveillance systems serve three security functions: deterrence (visible cameras discourage unauthorized behavior), detection (monitoring alerts security staff to ongoing incidents in real time), and forensic evidence (recordings document what happened during and after security incidents for investigation and legal proceedings). A well-designed surveillance system supports all three functions and integrates with access control logs to provide a complete picture of physical security events.

CCTV (Closed-Circuit Television) cameras vary by form factor and capability. Fixed cameras cover a specific area continuously. PTZ (Pan-Tilt-Zoom) cameras can be remotely controlled to follow subjects. Dome cameras conceal the viewing direction. Bullet cameras are visible deterrents with long-range lenses. Camera placement should cover all entry and exit points, high-value asset areas, and hallways. Overlapping fields of view eliminate blind spots that attackers can exploit.

Camera effectiveness depends on image quality. Resolution must be sufficient to identify individuals — typically 1080p or higher for identity verification at doorways, lower resolution for wide-area coverage. Low-light and IR cameras maintain visibility in dim conditions. Wide dynamic range (WDR) cameras handle high-contrast scenes (e.g., bright sunlight at an entrance with a dark interior). Poor image quality makes footage forensically useless even if it captured the right area.

Surveillance footage is recorded and stored in two ways. DVRs (Digital Video Recorders) receive analog camera signals and digitize them for storage. NVRs (Network Video Recorders) receive digital IP camera streams over the network. NVR systems enable remote access to footage, easier integration with analytics software, and flexible camera placement without dedicated cabling. Both require sufficient storage capacity — high-resolution cameras generate 10-40GB per day per camera, requiring planned capacity for the required retention period.

Motion detection cameras record only when movement is detected, reducing storage consumption. Modern IP cameras and NVR systems include video analytics that go beyond simple motion: tripwire detection (alert when a virtual line is crossed), loitering detection (alert when a person remains in an area too long), object removal detection (alert when an object like a server disappears from a rack), and crowd detection. These reduce reliance on human monitoring of dozens of camera feeds simultaneously.

Attackers may attempt to disable surveillance systems by spray painting lenses, covering cameras, or cutting network cables. Good surveillance design includes: tamper detection alerts triggered when a camera's view is obstructed or the camera is physically moved, redundant recording paths (camera-local SD card backup plus NVR), UPS power backup for cameras and NVR, and secured cabling runs in conduit. The NVR should immediately alert when any camera goes offline unexpectedly.

Passive Infrared (PIR) motion sensors detect changes in infrared radiation caused by the heat signature of a moving body. They are widely used for triggering alarms and camera recording. Thermal imaging cameras detect heat signatures in complete darkness and can identify people hiding behind objects or in low-visibility conditions. Thermal cameras are used at perimeter fencing to detect intruders at night without visible lighting that would alert them to the surveillance presence.

Maximum security value comes from integrating surveillance with access control systems. When a badge access event occurs, the system automatically retrieves the camera feed from that door at that timestamp. Security staff can immediately verify that the person entering matches the badge holder's photo — detecting badge cloning or badge sharing. Denied access events automatically trigger PTZ camera repositioning to capture the face of whoever attempted unauthorized entry.

Retention policies determine how long surveillance footage is kept. Common minimum retention periods: 30 days for general office areas, 90 days for data centers and secure areas, and 1 year or longer when required by regulation (PCI-DSS requires 3 months for systems in scope). Footage should be stored on systems with write-once or tamper-evident storage so recordings cannot be altered or deleted after an incident. Legal holds may require extending retention when litigation is anticipated.

IP cameras themselves are network-connected devices that must be secured. Common vulnerabilities: default credentials (admin/admin is the default on many camera brands), unpatched firmware with known CVEs, Telnet/HTTP management instead of SSH/HTTPS, and unencrypted video streams that can be intercepted. Compromised IP cameras have been used in large DDoS botnets (Mirai). Best practices: change default credentials, segment cameras on a dedicated VLAN, patch firmware regularly, and use encrypted RTSP streams.

Technology alone cannot replace human judgment in physical security. Security guards provide deterrence through visible presence, respond to alarms, conduct patrol sweeps, and manage visitor access. Guards monitoring surveillance stations should be equipped with standard operating procedures (SOPs) defining exactly what to do for each alarm type — rather than relying on individual judgment under pressure. Guards should rotate monitoring assignments every 20-30 minutes to maintain alertness, as human attention degrades rapidly during monotonous video monitoring.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: CCTV surveillance serves deterrence, detection, and forensic evidence functions, motion detection and video analytics reduce alert fatigue by intelligently detecting specific conditions, and IP cameras must be hardened and isolated on dedicated VLANs to prevent them from becoming attack vectors. Next up we explore data center environmental controls — HVAC, fire suppression, and power redundancy.