Your CCTV Recorder Is a Small Server With a Big Blind Spot

Most small businesses treat CCTV like a light fitting. It was installed, it works, and nobody thinks about it again until something goes missing. The camera above the door gets all the attention. The recorder in the comms cupboard — the little black box with the flashing lights — quietly becomes an unmanaged server on your network. And like any server, it has logins, firmware, storage and a history of shortcuts.

That is the blind spot. Not the lens. The box behind it.

Start with the box, not the lens

Find the recorder. It might be a DVR, an NVR, or a small PC running camera software. Note the make, model and where it sits on the network. If you cannot answer those three questions in under five minutes, that is your first finding.

Ask the same question of the person who installed it: what is the admin username, and who else has it? If the answer is a shrug, a former employee's mobile number, or a password written on the underside of the unit, you have work to do. None of this is unusual. It is just rarely examined.

The password that shipped with it

Default admin logins are still a gift to anyone scanning a network. Manufacturers have improved, but plenty of recorders in UK offices still accept admin/admin, admin/12345, or a model-specific default that is printed in the manual. Change the admin password to something long and unique, stored in your password manager — not on a sticky note behind reception.

Then look for other accounts. Installers often leave a second admin login so they can support the system remotely. That is not automatically bad, but you need to know it exists. If the installer has gone out of business, disable the account or reset it. If they are still around, confirm who holds it and what happens when they leave.

Your phone app is a door in the wall

Many CCTV phone apps are convenient because they punch through your firewall using port forwarding, UPnP or a manufacturer's cloud service. Convenience is fine. Silent convenience is not.

Check your router for rules that forward ports to the recorder. Check whether UPnP is enabled. If the app uses a cloud relay, confirm the recorder's firmware is current and the app account has a strong password and, where available, multi-factor authentication. A camera system exposed directly to the internet is not a small business security problem; it is an open invitation.

The safer default is to remove direct inbound access and use the manufacturer's cloud service or a VPN. If neither is possible, at least restrict access by IP address and keep the firmware patched.

Keep cameras off the accounts network

A camera recorder should not share a flat network with your accounts system, your file server and your Microsoft 365 admin console. If a recorder is compromised, the attacker should not be able to wander sideways into the business.

Put the CCTV kit on its own VLAN or, on a small site, its own switch and firewall rule. A guest Wi-Fi network is not a substitute unless it is properly isolated and you understand what it allows. If you are on one flat network today, that is a project, not a five-minute fix — but it belongs on the list.

The 45-minute audit

Set a timer and work through this in order. You will not fix everything in 45 minutes, but you will know what you are dealing with.

1. Locate and identify the recorder. Make, model, IP address, and who installed it.
2. Log in as admin. Change the default password if it is still there. Record the new one in your password manager.
3. List the accounts. Remove old installer logins unless there is a signed support agreement. Check for shared logins.
4. Check firmware. Note the version and the manufacturer's latest release. If updates are manual, schedule one.
5. Review remote access. Look for port forwards, UPnP rules and cloud apps. Remove anything nobody can explain.
6. Check storage and retention. How many days of footage do you keep? Is it overwriting automatically? Is the disk healthy?
7. Confirm network separation. Is the recorder on the same network as business data? If yes, plan the move.
8. List who can view footage. Owners, managers, reception, the installer. Remove anyone who does not need it.
9. Find the paperwork. More on that below.

Retention, access and the GDPR bit

CCTV footage of identifiable people is personal data. As a business, you are the data controller. That means you need a lawful basis, a clear retention period, a way to handle subject access requests, and a privacy notice that tells people cameras are running. If you record audio, say so — audio changes the picture and is often switched on by accident.

Write down why you have cameras, how long you keep footage, and who can see it. A simple one-page record of processing is better than a vague memory. If you use an installer to manage the system, check whether they are a data processor and whether you have a contract that covers access, deletion and security.

This is not about turning a small office into a compliance department. It is about being able to answer basic questions without guessing.

The fix list for this week

Change the admin password. Disable or document the installer account. Update the firmware. Remove unexplained port forwards. Put the recorder on its own network segment. Check the phone app account. Write down the retention period. Keep a short list of who can view footage. And tell your insurer and your IT support provider where the recorder lives.

The camera above the door is doing its job. The box behind it needs a check-up too.