Chapter 6: Security & Risks

Physical security, cybersecurity, EMI/EMC risks, grounding, surge protection, and risk mitigation strategies for surveillance cabling systems.


6.1 Physical Security of Cabling Infrastructure

The physical security of cabling infrastructure is often underestimated relative to camera placement and network security. An attacker who gains physical access to a cable or cabinet can intercept data, inject signals, or simply cut connectivity. All zone cabinets must be locked with key or electronic access control, and access logs should be maintained. Exposed cable runs in public-accessible areas must be protected with conduit or armored cable to prevent tampering and accidental damage.

RiskLevelMitigation
Cabinet tampering / unauthorized accessHighLocked cabinets, access logs, tamper alarms
Cable cutting in public areasHighArmored conduit below 3 m height
Patch cord accidental disconnectionMediumLocking patch cords, cable managers
Fiber tap / data interceptionMediumFiber in conduit, optical power monitoring
Accidental cable damage during maintenanceLowClear labeling, work permits for cabinet access

6.2 Cybersecurity Risks in Surveillance Cabling

IP surveillance systems are increasingly targeted by cyber threats. The cabling infrastructure itself creates several cybersecurity risk vectors that must be addressed at the design stage. Unauthorized network access through unsecured switch ports, default credentials on cameras and switches, and unencrypted management traffic are the most common vulnerabilities. Network segmentation via VLANs, port security features (802.1X), and encrypted management protocols (SSH, HTTPS) are essential countermeasures.

Critical: Never leave unused PoE switch ports in an active, unprotected state. Disable unused ports or configure 802.1X port authentication to prevent unauthorized device connection.

Threat VectorLevelTechnical Control
Unauthorized device on PoE portHigh802.1X port authentication, MAC address filtering
Default credentials on cameras/switchesHighMandatory credential change at commissioning
Unencrypted management trafficMediumSSH, HTTPS, SNMPv3 only; disable Telnet/HTTP
VLAN hopping attacksMediumDisable trunk negotiation on access ports (DTP off)
Firmware vulnerabilities in camerasMediumRegular firmware update schedule, isolated VLAN
Physical network tap on copper cableLowConduit protection, port security monitoring

6.3 EMI/EMC Risks and Mitigation

Electromagnetic interference (EMI) is a primary cause of intermittent camera dropouts, degraded video quality, and unexplained PoE power cycling. The most common EMI sources in surveillance environments include variable frequency drives (VFDs), fluorescent lighting ballasts, high-current power feeders, and elevator motor cables. Maintaining adequate separation distances and using shielded cable in high-EMI zones are the primary mitigation strategies.

EMI SourceMinimum SeparationAdditional Mitigation
High-voltage power feeders (>480V)300 mmShielded Cat6A or fiber
Motor and VFD cables300 mmShielded cable, separate tray
Fluorescent lighting (magnetic ballast)150 mmSeparate tray or conduit
UPS output cables150 mmSeparate tray section
Elevator motor room cables500 mmFiber preferred for nearby runs
Radio/antenna cables150 mmShielded cable, grounded tray

6.4 Lightning and Surge Protection

Lightning-induced surges are the leading cause of mass camera failures in outdoor and perimeter deployments. A single lightning strike near a building can induce thousands of volts on copper cable runs, destroying cameras, switches, and patch panels simultaneously. The protection strategy relies on three layers: building lightning protection system (LPS), equipotential bonding of all metallic infrastructure, and surge protection devices (SPDs) at cable entry points.

Fiber optic backbones provide inherent galvanic isolation between buildings, eliminating the ground loop risk that makes copper inter-building runs so vulnerable. For any copper cable that exits a building or runs along an outdoor structure, SPDs must be installed at the building entry point on both the camera side and the switch side of the circuit.

Protection LayerComponentSpecificationLocation
Layer 1 — Building LPSAir terminals, down conductors, earth electrodesIEC 62305 compliantBuilding exterior
Layer 2 — Equipotential BondingGrounding bus bars, bonding conductors≥6 mm² green/yellow conductorAll cabinets and metal structures
Layer 3 — SPD (RJ45)Inline surge protector for Cat6A + PoEIEC 61643-21, <1 ns responseBuilding entry, outdoor cabinet
Layer 3 — SPD (Fiber)Fiber surge protector (for armored fiber)Metal armor grounding clampBuilding entry point

6.5 Common Design Errors and Risk Register

The following table summarizes the most frequently encountered design and installation errors in surveillance cabling projects, their probability and impact, and recommended preventive actions. This risk register should be reviewed at the design stage and used as a checklist during installation and commissioning.

Error / RiskProbabilityImpactPreventive Action
Exceeding 90 m horizontal run limitMediumHigh — link failure or degraded performanceMeasure all runs before installation; use fiber for long runs
Mixed T568A/T568B terminationsMediumHigh — link failureEnforce single standard; test all links before commissioning
Insufficient PoE budgetHighHigh — camera reboot loops, IR failureCalculate worst-case PoE load including IR and heaters
No surge protection on outdoor copperHighHigh — mass equipment failure in stormsMandatory SPD at all outdoor cable building entries
Poor fiber connector cleanlinessHighMedium — intermittent link errorsClean and inspect all fiber connectors before mating
Inadequate cabinet ventilationMediumMedium — switch overheating, PoE instabilityCalculate heat load; add fans or cooling if needed
Missing or incorrect labelsHighMedium — extended troubleshooting timeLabel all cables, ports, and cabinets at installation
No spare capacity in pathwaysMediumMedium — costly re-work for expansionProvision ≥25% spare capacity in all pathways and cabinets
← Selection & Interfaces Support & Integration →