Dahua Technology invests in cybersecurity and network security

In the AIoT era, the world is getting smarter. Everything is going to have an online “ID” and then connected into a vast net of IoT devices, like a laptop computer, a mobile phone, a connected thermostat, or a network security camera.

Cybersecurity in the AIoT era

According to a Markets and Markets report, IoT is extensively used by smart cars to smart manufacturing and connected homes and building automation solutions. However, currently, there are no unified global technical standards for IoT, especially in terms of communications. This results in inefficient data management and reduced interoperability mechanism and ultimately may cause reduced security in the IoT network.

The global Internet of Things (IoT) security market size is expected to grow from USD 12.5 billion in 2020 to USD 36.6 billion by 2025, at a Compound Annual Growth Rate (CAGR) of 23.9%.

Importance of cybersecurity

Various vertical industries store unprecedented amounts of data on devices like IP cameras and NVRs

Dahua Technology, a video-centric smart IoT solution and service provider, believes cybersecurity is of vital strategic importance in the age of AIoT.

In various vertical industries, such as traffic, banking & finance, hospital, and critical infrastructure, organisations collect, process, and store unprecedented amounts of data on devices like IP cameras and NVRs. A significant portion of that data can be sensitive or private information, which can be prone to cyber-attacks and the situation, is getting worse because there are more devices than people.

As a security solution provider, Dahua Technology continuously invests in cybersecurity and actively copes with network security issues.

Continuous investment & active coping

Committed to becoming a leader in cybersecurity and privacy protection in the global security industry, Dahua Technology has been developing and exploiting cybersecurity for nearly 10 years. The company keeps investing about 10% of its annual sales revenue in R&D every year, including cybersecurity.

In addition, the company put together a professional team of nearly 100 personnel to focus on cybersecurity issues. With rich experience and sufficient resources, Dahua Technology promises to be positive, open, cooperative, and responsible when it comes to cybersecurity.

Dahua Technology cybersecurity approach

1. Organisational structure

In order to achieve better efficiency and effectiveness, Dahua Technology operates a comprehensive system to cope with all cybersecurity-related issues. The system, led by the cybersecurity committee, also contains a cybersecurity & data protection compliance group, cybersecurity institute, and product security incident response team (PSIRT).

The cybersecurity committee, above all departments or teams, can call resources from the whole company, from the R&D centre to the legal department, supply chain, overseas business department, etc. when necessary. Cybersecurity Institute is in charge of building the sSDLC process and implementing the process to all Dahua product series, making sure that all Dahua products are strong against cyberattacks.

2. Security development lifecycle

Dahua adopts a bunch of professional sSDLC (Security Development Lifecycle) security software to improve product security

Dahua Technology adopts a bunch of professional sSDLC (Security Development Lifecycle) security software to improve product security. During the security design phase, STRIDE + Attack Tree + PIA is adapted to improve threat modeling. During the security realisation phase, OWASP top 10 and over 150 CWEs are used to achieve static code analysis.

During the security test phase, over 20 tools within 7 fields are applied to realise the multiple security testing. CompTIA PenTest+/Security+ are used to carry out professional penetration testing, while compliance ISO 30111&290147 and MITRE org CAN are followed during vulnerability management after the products are sold.

3. Emergency response system

Cooperation with professionals from across the globe is a great way to improve vulnerability detection. Therefore, Dahua Cybersecurity Center (DHCC) is established to solve cybersecurity issues with security vulnerability reporting, announcement/notice, and cybersecurity knowledge sharing with our global customer base in order to provide them with more robust and secure products/solutions.

Product Security Incident Response Team (PSIRT) is an integral part of DHCC. Composed of professionals ranging from marketing, supply chain, service, and legal representatives, PSIRT is responsible for receiving, processing, and disclosing Dahua product and solution-related security vulnerabilities.

Team members are on duty 7 days a week and guarantee to respond to an emergency within 48 hours. End-user, partner, supplier, government agency, industry association, and independent researchers are encouraged to report potential risk or vulnerability to PSIRT by email.

4. Personal data & privacy protection

Dahua Technology also attaches great importance to personal data & privacy protection. Complying with applicable laws and regulations such as EU’s General Data Protection Regulation, EDPB’s Guidelines on the concepts of controller and processor in the GDPR, ETSI EN 303645’s Cyber Security for Consumer Internet of Things: Baseline Requirements as well as US’s California Consumer Privacy Act, the company established the Personal Data & Privacy Protection Standard.

The standard stipulates that privacy protection methods such as de-identification, data encryption, and systematic access control, privacy-friendly setting are fully adapted to the complete data life cycle all the way from the collection, transmitting, storage to sharing, copying, and deleting.

In addition, working with world-renowned third-party institutions, Dahua Technology has received Protected Privacy IoT Product Certification and ETSI Certification from TÜV Rheinland, as well as ISO 27018 Certification and ISO 27701 Certification from BSI, which help demonstrating its capability in managing personal information and compliance with privacy regulations around the world.

5. Continuously iterating security baseline

The security baseline built a security element layout of "AAA+CIA+P", a systematic protection framework

Centered on the core principles of Security by Design and Security by Default, the Dahua security baseline initiative taps into product safety technology to provide users with adequate safety guarantees.

Based on and practicing the security and privacy design principles, the security baseline builds a security element layout of "AAA+CIA+P", forming a systematic protection framework covering physical security, system security, application security, data security, network security, and privacy protection.

7 versions of baseline and 100+ principles have been developed to adapt Authentication, Authorisation, Audit, Confidentiality, Integrity, Availability, and Privacy protection deeply into the product quality assurance system, making sure that all Dahua products enjoy the factory default security.

6. Product security centre

In order to help users clearly understand the security status and capabilities of the device, the product security centre will assist users to conveniently and quickly set up the right security configuration to suit the scenarios.

General security capabilities include privacy protection (face occlusion, information hiding, etc.), video encryption, security alarm, trusted protection, CA certification management, key management service, attack defense, and so on.

7. Cybersecurity ecosystem

Adhering to openness and cooperation, Dahua Technology keeps cooperating with international authoritative security institutions to jointly build a secure ecosystem. By rich & in-depth communicating and cooperation with institutions like TÜV Rheinland, BSI, DNV·GL, Intertek EWA-Canada, and bright sight security lab, the company stays advanced its security capabilities and systems.

In a widely networked world of IoT, cybersecurity challenges are pretty much a universal sore spot for companies globally. Dahua Technology, in the business of keeping people safe, takes cybersecurity seriously from head to toe.

With a mindset that emphasises cybersecurity and all the resources that it can allocate to establish, carry out and strengthen the cybersecurity approach, Dahua Technology plans to stay positive, open, responsible and improving for the matter of cybersecurity.