A security installer will ask for a spare port on your office switch, and it is almost always a mistake to give them one. Cameras and door controllers are internet-connected computers running vendor firmware that is rarely patched, frequently shipped with default credentials, and often configured to reach outward to a manufacturer’s cloud. Put them on the same network as your file server and you have handed an attacker a route in through a device your IT provider does not manage and your installer does not monitor.
Network segmentation means placing physical security devices on their own VLAN, with firewall rules that define exactly what they may talk to, rather than on the same flat network as workstations and servers. It is the single control that makes everything else on this page survivable.
Cameras are computers, and they are the worst-maintained computers in the building
An IP camera runs an embedded Linux build, a web server, a streaming stack and often an RTSP service. It has an administrator account, a firmware version, and a set of open ports. That is a server, sold as a fitting.
The difference is that nobody owns it. Your MSP does not know it exists because it was installed by the security contractor during the fit-out. The security contractor commissioned it three years ago and has not touched it since. The firmware has not been updated because updating it requires someone to log into a controller that nobody has the password for. Meanwhile the device sits on the same subnet as your accounting system.
The ACSC’s Information Security Manual builds its media, patching and procurement guidance around the assumption that someone is accountable for each device. For physical security hardware in an SMB, usually nobody is. Naming an owner is step zero.
Segment first, argue about brands later
The design is not complicated and it does not require expensive hardware.
Put cameras, recorders, door controllers and intercoms on a dedicated VLAN, separate from staff, servers, guest wi-fi and printers. Deny that VLAN any access to your production network by default. Then open only what is genuinely required: the recorder needs to reach the cameras, an administrator workstation or a jump host needs to reach the recorder’s management interface, and time sync needs to work.
Block outbound internet access from the camera VLAN unless a specific device needs it for a specific reason. Many cameras will happily phone home to a manufacturer’s cloud relay by default, which is how “we never opened a port” turns into a device reachable from outside. If a cloud-managed platform genuinely requires outbound access, allow it to named destinations rather than to the whole internet.
Never port forward to a recorder or camera. If someone needs remote viewing, put it behind a VPN or use the vendor’s authenticated cloud relay with multi-factor authentication on the account. Port forwarding a network video recorder to the internet is the specific configuration behind most publicly indexed camera feeds.
This is a normal capability on any competent SME network gear. It is worth deciding the switching and firewall platform you choose before the security tender goes out, so the installer is designing into your network rather than around it.
Default credentials and remote access are the two failure modes
Two configuration failures account for most compromises of physical security systems.
The first is credentials. Devices ship with a documented default login, and installers routinely set one shared password across a whole site so any technician can get in. That password ends up on a label inside the recorder, in the installer’s job notes, or in a text message. Require unique credentials per device, stored in your password manager, and require the installer to hand over the administrator accounts at practical completion rather than retaining sole possession of them. If an installer will not give you the admin account for equipment you own, that is the answer to whether you should engage them.
The second is remote access. Many systems include a vendor remote support capability enabled by default, sometimes as a peer-to-peer tunnel that traverses NAT without any firewall rule. Turn it off unless you have consciously decided to use it. Ask specifically: does this system establish any outbound connection to the vendor, and can the vendor access my footage.
Multi-factor authentication belongs on every management portal in this stack. If the platform does not support it, that is a procurement signal.
Supply chain and firmware risk is real, and it is not evenly distributed
Cheap IP cameras are cheap for reasons that matter. Many are white-labelled from a small number of original manufacturers, which means a vulnerability in one brand’s firmware often affects a dozen brands you have never heard of. Support lifecycles are short or undefined. Security advisories may not be published in English, or at all. Some governments have restricted particular manufacturers from their own networks on national security grounds, and while those restrictions do not bind a private Australian business, they are a signal about the vendor’s engineering and disclosure practices.
The ISM’s guidance on cyber supply chain risk management is the right frame. Before purchase, ask: who actually manufactures this, how long will firmware updates be published, where are security advisories posted, and what is the process for applying an update. A vendor who cannot answer the second and third questions is selling you an unpatchable device.
The trade-off is honest: reputable brands with published support lifecycles cost more per camera, sometimes considerably. Segmentation reduces the blast radius of the cheap option but does not eliminate it, because the recorder still holds your footage and the cameras still see your premises.
PoE and cabling: specify it before the walls close
Power over Ethernet is the reason camera installs look simple and then are not.
The IEEE 802.3 standards define the power classes: 802.3af (Type 1) delivers up to 15.4 W at the switch port, 802.3at (Type 2, commonly called PoE+) up to 30 W, and 802.3bt (Types 3 and 4) up to 60 W and 90 W. A fixed indoor dome will run happily on 802.3af. A pan-tilt-zoom camera, a camera with a heater or blower for outdoor use, or an intercom with a screen will need PoE+ or better.
The mistake is budgeting per port and not in total. A switch may support PoE+ on every port and have a total power budget that cannot sustain all of them at once. Add up the actual draw of every device plus headroom, and size the switch to that figure, not to the port count.
Cabling is the part you cannot change later. Run Cat6 as a minimum and Cat6A where you may want higher speeds or longer PoE runs, because heat rise in bundled cable under PoE load is a real constraint. Respect the 100 m channel limit, which includes patch leads at both ends, and plan a midspan cabinet where a run would exceed it. Terminate everything into the comms room on a patch panel and label both ends. Pull spare cable to every camera and reader position while the ceiling is open, because the second visit costs more than the cable.
Cabling that connects to the telecommunications network is regulated, and the instrument changed recently, so check what your installer is quoting against. The current rules are the Telecommunications (Cabling Provider) Rules 2025, made by ACMA under subsection 421(1) of the Telecommunications Act 1997, registered as F2025L00386 and in force from 31 March 2025. They repealed the Telecommunications Cabling Provider Rules 2014, so a quote or a compliance pack still citing the 2014 rules is out of date.
Three obligations matter to you as the customer. Under section 21, the cabling work must be performed by a registered cabling provider holding the class of registration that covers the work, or by someone who is directly supervised at all times by such a provider, and that supervisor accepts full responsibility for the work. Under section 23, the work must comply with the Wiring Rules, which the instrument defines as AS/CA S009:2020 Installation Requirements for Customer Cabling. Under section 25, the registered cabling provider who performed or supervised the work must, as soon as practicable after it is completed and whether or not they have been paid, prepare a statement that gives their name, contact details and proof of registration, identifies the cabling work, and states that it has been completed and complies fully with the Wiring Rules. They must give that statement to the customer who engaged them, keep a copy for at least one year, and produce it to ACMA on request. The only work excluded is the trivial kind, such as running or removing jumpers on a distribution frame or replacing a plug, socket or module.
The practical version: if your security installer cannot hand you that statement at handover, you have not been given the compliance evidence the rules require, and you have no documented basis for the cabling in a building you are responsible for. Ask for it in writing, and file it with the as-built.
Structured cabling, PoE loads, camera positions and door hardware all belong in the fit-out plan before the walls close, alongside the data and power design.
Door hardware has a further constraint that is not an IT decision. Electric locks on egress paths must fail in whichever direction the building surveyor and fire engineer require. Get that determination in writing before the hardware is ordered.
Sizing storage without guessing
Storage sizing is where vendor calculators produce confident numbers from invented assumptions. Do it in this order instead.
Decide the retention period first, from a policy position rather than a hardware position, driven by why you are recording: incident investigation, insurance claims, workplace safety, or a specific contractual requirement. Write down the reason, then set the period.
Then measure the bitrate rather than estimating it. Install one camera of the model you intend to buy, in a position representative of the busiest scene you will cover, and record its actual bitrate across a full working day and a full night. Bitrate varies enormously with resolution, frame rate, codec (H.265 is materially more efficient than H.264), scene complexity and motion, and infrared illumination at night. A camera pointed at a still car park and one pointed at a busy warehouse aisle behave nothing alike.
Then multiply measured average bitrate by the number of cameras of that class and by the retention period in seconds, repeat per camera class, and sum. Decide whether recording is continuous or event-triggered, because that assumption can change the total by an order of magnitude and it also changes what you can prove after an incident. Add headroom for RAID parity, operating system and database space, and the cameras you will add within the life of the recorder.
Finally, decide what happens to footage preserved beyond the retention window for an incident under investigation. Exported evidence needs a defined location, access control and its own retention rule, or it lives on a manager’s desktop forever.
Footage is personal information, and Victoria has surveillance law
Two separate legal regimes apply, and businesses tend to know about neither.
Victorian surveillance law. Under section 7 of the Surveillance Devices Act 1999 (Vic), a person must not knowingly install, use or maintain an optical surveillance device to record visually or observe a private activity to which the person is not a party, without the express or implied consent of each party to the activity. The penalties are substantial: for a natural person, up to two years imprisonment or a fine of up to 240 penalty units or both, and for a body corporate up to 1,200 penalty units.
The definitions do the work here. An “optical surveillance device” is any device capable of being used to record visually or observe an activity. A “private activity” is an activity carried on in circumstances that may reasonably be taken to indicate the parties desire it to be observed only by themselves, and it expressly excludes an activity carried on outside a building, and any activity carried on in circumstances where the parties ought reasonably to expect it may be observed by someone else.
In practice that means a signed camera covering an open-plan office floor, a reception area or a car park is generally outside the prohibition. Cameras in toilets, change rooms, showers, first aid rooms, prayer rooms and parents’ rooms are where businesses get into trouble, and no signage cures it. The Act deals with listening devices and private conversations separately, which is why the microphone built into most IP cameras deserves a deliberate decision rather than a default. Most businesses should disable audio recording and document that they did.
Victoria does not have a standalone workplace surveillance Act in the way New South Wales does, so the Surveillance Devices Act and the Privacy Act do the work between them.
Privacy law. Footage of an identifiable person is personal information. That brings the Australian Privacy Principles into play for any business the Privacy Act covers: collect only what is reasonably necessary for a function or activity, notify people at or before the point of collection, keep it secure under APP 11, and destroy or de-identify it when it is no longer needed under APP 11.2. Do not assume the employee records exemption covers surveillance footage, because it is narrower than most employers think and it does nothing at all for customers, contractors and visitors.
If a recorder is stolen or a cloud video account is compromised, that is a data breach, and it may be a matter for the Notifiable Data Breaches scheme if it is likely to result in serious harm.
Practical steps: put clear signage at every entrance and in every monitored area, cover CCTV in your privacy policy, put a camera position plan in your documentation with the justification for each position, and angle cameras so they do not cover a neighbour’s property or a public footpath any more than necessary.
Where the system is cloud-hosted, the questions about where that footage is stored and who can reach it are exactly the same questions you should ask of any SaaS vendor.
Retention, access and who is allowed to look
Retention has to be a written rule, not a function of when the disk fills up. Set a period, document the reason, and configure the system to enforce it. Continuous retention “in case we ever need it” is an APP 11.2 problem, and it grows the consequences of any breach.
Access is where the real risk sits. Live viewing and recorded playback should be separate permissions. Playback should be limited to a small named group, ideally requiring a second person’s approval for anything beyond a defined operational purpose. Export must be logged, with the reason recorded. Review the access log periodically, because unmonitored access to footage of staff is a workplace issue long before it is a legal one.
Write down who may authorise release of footage to Victoria Police, an insurer or a lawyer, and what form of request is required. Deciding that during an incident, at the counter, is how it goes wrong.
When a recorder reaches end of life, remember it is a device full of personal information, so destroy the recorder’s drives properly rather than sending the unit back on a lease return.
Access control should be tied to identity, so offboarding closes the door too
Most SMB access control systems are islands. Cards are issued from a separate database with its own administrator, and when someone leaves, the person disabling their Microsoft 365 account has no visibility of the door system. The account is gone in minutes and the card still opens the back door six months later.
Fix it in one of two ways.
The better option is to buy an access control platform that integrates with your directory. If the system supports SAML or SCIM provisioning against Microsoft Entra ID, then disabling or deleting the user account revokes their door credential automatically, and group membership can drive which doors they can open. That makes one action, taken by one person, close both the login and the door. Mobile credentials on a phone are easier to revoke than a plastic card, and they cannot be lent to a mate at the pub as easily.
The realistic option, where integration is not available or not affordable, is to make credential revocation an explicit line item on your offboarding checklist, with a named owner, a required evidence step (a screenshot of the disabled credential), and a quarterly audit that reconciles active cards against active employees. That audit is dull and it is the only thing that catches contractors, casuals and the cards issued to people who left two employers ago.
Either way, run a quarterly reconciliation of the card list against your HR list. Every business that does this for the first time finds active credentials for people who no longer work there.
What to put in the installer’s scope
Write these into the tender rather than discovering them at commissioning.
- All devices to be placed on a dedicated VLAN nominated by the client’s IT provider, with no default gateway unless specifically approved
- No port forwarding, and no vendor remote access enabled without written approval
- Unique administrator credentials per device, handed to the client at practical completion, with no installer-retained shared password
- Firmware versions recorded at handover, and a documented update procedure with the vendor’s published support lifecycle
- Audio recording disabled unless specifically requested in writing
- An as-built document listing every device, its IP address, MAC address, model, firmware version, cable run and patch panel port
- Confirmed PoE class per device and a total switch power budget calculation
- Camera position plan showing coverage and confirming no coverage of toilets, change rooms or similar spaces
- Cabling installed by an appropriately registered cabler, tested and certified, with results provided
- A commissioning handover session with the client’s IT provider present
Point ten costs an hour and prevents most of the problems above.
If you are fitting out, relocating, or you have inherited a camera system nobody can log into, we design the network segmentation, run the cabling and comms room work in-house, and hand you documentation you can actually use. Call 1300 028 324 or get in touch at https://techassist.au/contact/. Bring us in before the security tender closes, not after the ceiling goes back up.