Securing Your System Against Unauthorised Access to Verkada
Verkada provides a powerful, cloud-based enterprise security camera solution. However, like any system that holds sensitive data, it is a target for malicious actors. A widely publicised security incident highlighted the critical importance of robust user and administrative security practices. Understanding how unauthorised access can occur is the first step to properly securing your organisation's assets.
This guide provides actionable steps and best practices to significantly harden your Verkada deployment against unauthorised access and ensure the privacy of your video feeds.
The Nature of the Threat: Understanding the Past Incident
It is crucial to understand that the major 2021 Verkada breach was not caused by a vulnerability in their encryption or a brute-force attack on a camera. The incident stemmed from the compromise of high-level administrative credentials. The attackers gained access to a "Super Admin" account, which had legitimate, albeit overly permissive, access to internal maintenance tools.
This highlights the most critical aspect of modern cloud security: the primary threat is often not a flaw in the system, but the compromise of the credentials used to access it. Therefore, securing your account is just as important as securing the cameras themselves.
Step 1: Enforce Mandatory Multi-Factor Authentication (MFA)
This is the single most effective measure you can take. Multi-Factor Authentication adds a second layer of security to the login process. Even if an attacker steals a user's password, they cannot access the account without the user's physical second factor (like a code from an authenticator app).
- How to Implement: As an administrator in the Verkada Command platform, navigate to the Admin > Security section. Here, you can enforce MFA for all users or for specific roles.
- Best Practice: Enforce MFA for all users, without exception. There is no valid reason for any user, from a part-time viewer to a full administrator, to not have MFA enabled.
Step 2: Implement the Principle of Least Privilege (PoLP)
Do not give users more access than they absolutely need to perform their duties. Defaulting every user to an "Admin" role is a significant security risk.
- Audit User Roles: Review every user in your organisation. Who needs to be an admin? Who only needs to view a single camera feed?
- Create Granular Roles: Use Verkada's "Roles" feature to create custom permission sets. For example, create a "Front Desk" role that can only view the lobby camera during business hours, but cannot export footage or change settings. Create a "Regional Manager" role that can view all cameras in their region but cannot create new users.
- Regular Reviews: Schedule a quarterly or bi-annual review of all user accounts and their assigned roles. Remove users who have left the organisation and downgrade permissions for those whose roles have changed.
Step 3: Monitor and Audit Access Logs
Verkada's platform provides comprehensive audit logs that track user activity. Use them to your advantage.
- What to Look For: Regularly check the audit logs for suspicious events. This could include:
- Logins from unrecognised IP addresses or geographical locations.
- Multiple failed login attempts for a single account.
- Permission changes or role escalations.
- Access to sensitive cameras outside of normal business hours.
- Set Up Alerts: Configure alerts to be notified immediately of high-priority events, such as a new administrator being created or a user being locked out of their account.
By treating account security with the same seriousness as physical security, you can significantly reduce the risk of unauthorised access to your Verkada system and maintain the integrity and privacy of your organisation's video data.