Skip to content

Final project

Ideas

  • OTP for WP
  • API key generator for webhooks (applied in a videosurveillance system)
  • Dedicated and secured network with Ubiquity for video camera surveillance system
  • API security ?
  • Encrypt passwords

Main and global idea: Thinking in how my system can resist / securing a system

Looking for all the vulnerabilities around passwords and storage in a real system for a company. * remote desktops * password list of all users/applications * cameras and IP devices on the network * API keys for automations

Hash and salt passwords

Research

Securing passwords

  1. Hash and Salt passwords From a network of around 15 computers/VM/ Hachage Hash and salt Check password leak

  2. Secure Plain text passwords document in Confluence

  3. Encrypt the info in the document with a password
  4. Hash password (with terminal)
  5. Add password in the Keychain
  6. Password communication through a service like Bitwarden One time secret
  7. Improve security for user passwords in Confluence

  8. Check the rights

  9. Using a Random Generator API

  10. Online API key generator Api key generador
  11. Online solution https://developer.auth0.com/

  12. Hosted solution https://www.keycloak.org/

  13. Secure authentification for WP SSO Plugin Keycloak

  14. Add authentification in Webhooks

  15. Securing password for IP cameras / test cameras system

Final idea: securing a IPs cameras system

System description

The system is made by the following parts: SITE 1: CHA * 10 Axis IP cameras * 3 Hikvision IP cameras * Synology server * 1 switch Ubiquity * 1 computer connected to the server to local consultation * DSM application for 1 users / 2 clients on computer desktop / 1 online consultation thourgh url * Automations through webhooks with third party online tool

SITE 2: CAR * 4 Axis IP cameras * 1 Synology server * (Desactivate Quickconnect) * Automations through webhooks with third party online tool

SITE 3: MRS * 1 Central manager server * DSM application for 2 users / 1 online consultation thourgh url

Securing it

Health system

  • Monitoring Disk and memory health with daily reports
  • Monitoring server security with daily reports –> actions
  • Monitoring CPU/GPU
  • Alerts in case of low power –> connected Shelly plug
  • Alert in case of critical memory
  • **TODO: List of all devices and softwares used for checking their vulnerabilities. **
  • Ckeck the updates for corrections

Router security

  • wpa2 –> to WPA2/WPA3
  • Network dedicated. (Hidden wifi) No others devices connected –> Network hidden and authorized IPs only
  • One IP is TP link switch –> default names and password still active –> changed + stored in keychain –> TODO Replace TP LINK switch by secured one
  • TODO –> hiding the switch IP
  • Rename administrator account / generate secure password / stored it in Keychain
  • Web access allowed only to some IP.
  • Improvements: better firewall

Access to the IP Cameras

  • https –> installing Trusted Certificates
  • Ports –> changing default ports
  • Identification –> reforcing authentification
  • Passwords –> secure passwords / secure storage / secure communication
  • Hiding cameras IPs if a scan of the network is done?

IMPROVEMENTS

–> adding Ubiquity router * Dedicated network * Firewall * Authorized IP

Server

  • https –> ok
  • Activate the firewall and Ips filtering
  • Modify port 80 –> 443 + activate cipher
  • Security features
  • Online backup
  • Encryptation of videos streams

Computers

Computer to local camera network
  • No internet access for local network
  • Dedicated process
  • Local backup
  • Old computer replaced by a new one
Computer with Synlogy client
  • New computer
  • Dedicated process

Users management

  • Double authentification
  • Workshop on how to use / Best practices / Risks –> TODO: guide for users
  • TODO: guide for new provider or third party services + searching support inside the organization to ban insecure devices and impeach the installation

Securing communications

  • Webhooks –> authentification
  • Access to the videos –> online access
  • Images in detection emails

Plan if intrusion / Integration of the requisits of the European Cyber Resilience act

TODO: Written plan on how to react and estimated damages

General

TODO: Written and shared method in the organization based on this project