The video is working, the recorder sees the camera, and the installation is nearly finished. Before handing it over, there is another question to answer: who can connect, what can they change, and which parts of the connection are actually protected?
ITVDesk provides security controls for camera access, local administration, encrypted communication, stored configuration, and audit records. This checklist explains how to use those controls in a production VMS/NVR deployment without treating a successful live view as the end of the security review.
ITVDesk security development is guided by applicable DISA Application Security and Development STIG requirements. The steps below address practical deployment choices, including matters that also depend on Windows, the network, and the receiving video system.
1. Decide Which Systems Should Reach the Camera
Start with the expected connections: the recording server, authorized viewing clients, and the administrators who need management access. Use host and network firewall rules to limit access to those systems where practical.
Do not expose camera services to the Internet simply to make an internal VMS connection work. For remote sites, plan a controlled network path and document which services need to cross it. An application's security controls do not replace network segmentation or operating-system maintenance.
2. Keep Authentication Enabled and Assign Appropriate Roles
Use dedicated camera accounts rather than sharing a general administrator login between operators and recording systems. Keep ONVIF and RTSP authentication enabled for the connections that require it.
In ITVDesk, the network account role affects what a client can do:
- User: viewing and supported event, playback, and search operations.
- Operator: media configuration and PTZ operations in addition to the access needed for normal operation.
- Administrator: system, network, and account administration.
Choose the lowest role that supports the intended workflow, then test the actual VMS connection. A recorder that changes encoder settings may need more access than a viewing-only client. Keep administrative credentials separate from everyday viewing credentials.
3. Review Passwords Already in Use
Use long, unique passwords for local administration and camera accounts. ITVDesk offers a policy requiring at least 15 characters for new or changed Local UI and supported ONVIF/RTSP/Web Management account passwords.
Enabling that policy does not replace existing passwords. Review accounts created before the policy was enabled and change their passwords as needed. Update the matching credentials in the VMS/NVR as part of the same planned change.
Local UI password changes also include password-history protection. Do not assume that the same history rules apply to network accounts; they are separate account contexts.
4. Protect Local Administration Separately
Enable Local UI Protection where access to the workstation must not allow unrestricted changes to ITVDesk. TOTP two-factor authentication is available for protected local UI accounts.
TOTP protects local application access; it is not an additional code that an ONVIF camera client can supply. Keep local administrative access and network camera credentials distinct when documenting the deployment.
ITVDesk provides independent Local UI and Network Account Lockout controls. Enable and configure the relevant controls according to your security policy, and test them with a designated test account. A recorder repeatedly retrying an outdated password can otherwise create an avoidable access problem.
5. Verify Management and Media Protection
There are several connections to consider, and their names should not be treated as interchangeable:
- ONVIF over HTTPS: protects supported camera management and service communication through TLS.
- RTSPS: protects RTSP session control through TLS. Check how the negotiated media is transported as well.
- SRTP: provides encryption and authentication for RTP audio/video media with compatible clients.
- RTSP-over-HTTPS tunneling: provides a TLS-protected tunnel for compatible clients through the camera's HTTPS service.
Confirm the connection mode used by the receiving system, not just the options selected in ITVDesk. In particular, do not infer media encryption from an HTTPS management connection or a secure-looking device status alone.
After verifying compatibility, use HTTPS only (disable standard HTTP) per camera and Use RTSPS only (disable standard RTSP) for the streaming service where your deployment requires secure-only access. Check any enabled tunneling paths too. Test live view, recording, playback, events, and audio features that the installation actually uses before removing a working connection method.
6. Use Your Own Certificates and Plan Their Replacement
For production, import an appropriate certificate and private key rather than relying on the bundled default pair. Configure trust on the connecting systems and use an address covered by the certificate.
ITVDesk Certificate Management can validate and save a certificate pair, apply it to all cameras, or support individual camera certificates. Applying a replacement to active services can briefly disconnect clients, so plan the change and verify that the recorder reconnects.
Keep a secure backup of the original certificate and private key. Record who owns renewal and replacement. Review the default-certificate recovery policy as well: a strict deployment may require fallback to remain disabled rather than allowing an unexpected certificate to appear after a recovery event.
7. Review Snapshot and Browser Access
Still images can contain the same sensitive information as live video. Review whether each stream needs snapshot access. ITVDesk provides a per-stream control for snapshot generation and network retrieval; disable it where snapshots are not required, then check the effect on the VMS preview workflow.
Web Management is an Administrator-only interface. Use HTTPS and restrict network access to the people and systems that need it. ITVDesk automatically signs out Web Management after 10 minutes of inactivity; that sign-out does not stop separate ONVIF or VMS/NVR streams.
8. Make Security Audit Part of the Handover
Review Security Audit for supported authentication, administrative, and configuration events. Decide who will check the records and what should happen when repeated failed access or an unexpected change is noticed.
On Windows, ITVDesk can forward Security Audit events to the Windows Application Event Log. If the organization uses Windows Event Forwarding or another collection system, configure that collection separately and verify that a test event reaches its destination. Enabling forwarding in ITVDesk does not by itself configure central collection or retention.
Keep the workstation and recording systems correctly synchronized so that audit entries and recorded video can be compared meaningfully.
9. Protect Stored Data and Test Recovery
ITVDesk uses AES-256-GCM authenticated encryption for protected stored data, with additional Windows protection for stored secrets and imported TLS private keys. Keep operating-system file permissions, disk access, and backup access restricted as well.
Before an upgrade or recovery exercise, back up the required configuration and original certificate material securely. Windows-protected data can depend on the Windows installation, so copying application files to a different machine is not a complete recovery plan.
Document and test the supported recovery procedure for your installed version. For isolated networks, include offline licensing and a controlled way to obtain and verify updates.
10. Check the Finished System, Not Just the Settings
Use a pilot installation to verify the intended access boundaries. Confirm that the authorized VMS connects, the selected account can perform its required operations, and an unauthorized request is rejected. Where secure-only operation is required, check that the corresponding plain connection is no longer accepted.
Repeat the operational checks after a restart and a VMS reconnect. Include certificate trust, account changes, audit collection, and configuration recovery in the handover record. Record the ITVDesk version and receiving-system version so the same checks can be repeated after an upgrade.
Where STIG Fits into the Deployment
The DISA Application Security and Development STIG is a reference for ITVDesk security development and hardening work. Access controls, password policies, protected storage, secure communication, and audit capabilities are part of that work.
A completed checklist is not a formal STIG assessment or a certification. Applicable requirements still need to be evaluated against the installed software version, operating environment, organizational policy, and deployment evidence.
Detailed technical security documentation is available to business partners on request. For a public overview, see ITVDesk Security Features and the Security Changelog. Report suspected product vulnerabilities to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite..