Novus NHDR 4000 Series Service manual

Security settings recommendations
for NHDR and NVR 4000 series
Novus recorders

All rights reserved © AAT Holding S.A.
Security settings recommendations for NHDR and NVR 4000 series Novus recorders
2
TABLE OF CONTENTS
Table of contents
1. Preliminary informations .................................................................................................... 3
2. Initial configuration............................................................................................................. 3
2.1. Accounts and access .................................................................................................... 3
2.1.1. Recommendations regarding access to the system............................................... 3
2.1.2. Detailed configuration.......................................................................................... 4
2.2. Network Configuration................................................................................................ 6
2.2.1. LAN configuration ............................................................................................... 6
2.2.2. HTTPS connection configuration......................................................................... 7
2.2.3. Devices access restrictions ................................................................................... 8
2.2.4. Remote access to device – VPN........................................................................... 9

Security settings recommendations for NHDR and NVR 4000 series Novus recorders
All rights reserved © AAT Holding S.A.
3
PRELIMINARY INFORMATIONS
1. Preliminary informations
The following instructions describe the recommended settings of the Novus NHDR or NVR 4000
series recorder to properly protect access to the device and data processed on it.
Areas:
• initial configuration
• permissions settings / accounts managing
• password policy
• device network configuration
• remote access
2. Initial configuration
2.1 Accounts and access
2.1.1. Recommendations regarding access to the system
• the recorder should be located in a safe place preventing unauthorized access (e.g. server room,
locked room, etc.)
• the system should be updated regularly by security patches
• each of the system users should have their own personal account, which can be easily linked to a
specific person
• system privileges should be granted based on the consent of the system owner or authorized
person
• once every six months there should be a verification of active accounts in the system
 verification should be carried out by the system owner or authorized persons
• administrator access should be granted only to the person responsible for system configuration
• the built-in administrator account should be properly secured and used in case of emergency
 the administrator account name should be changed from the default "admin" to another
 account password should be written down and properly secured (sheet of paper, PenDrive
or other medium located in a safe place, e.g. safe)
 account password
 random
 10-15 characters long

All rights reserved © AAT Holding S.A.
Security settings recommendations for NHDR and NVR 4000 series Novus recorders
4
INITIAL CONFIGURATION
 contains a minimum 2 special characters
 contains a minimum one number and one upper case letter
 does not contain dictionary words
 does not contain the username in the password
 it is recommended not to enable the function unlock pattern
• password policy and recommended password settings for other account
 password policy
 random
 minimum length of 8 characters
 contains a minimum 2 special characters
 contains a minimum one number and one upper case letter
 does not contain dictionary words
 does not contain the username in the password
• it is recommended not to configure the „Email” settings in the „Network” recorder menu
2. 1. 2. Detailed configuration
In the „System” recorder menu, select the „Multi-user” submenu.
The icon in the „User Edit” column allows to activate a new user account. The icon in the
„Permission” column allows to define its permissions.

Security settings recommendations for NHDR and NVR 4000 series Novus recorders
All rights reserved © AAT Holding S.A.
5
INITIAL CONFIGURATION
New account activation
Menu -> System -> Multi-User -> User Edit
User permission settings
Menu -> System -> Multi-User -> Permission

All rights reserved © AAT Holding S.A.
Security settings recommendations for NHDR and NVR 4000 series Novus recorders
6
INITIAL CONFIGURATION
2. 2. Network Configuration
2. 2. 1. LAN configuration
It is recommended to have physical access to the recorder (connected mause and monitor). It is
important especially for access with administrator privileges to configure the device.
Recommendations for remote access:
• it is suggested to set the recorder static IP address
• it is recommended to prepare a separate LAN subnet dedicated only to the monitoring system to
provide adequate protection against unauthorized access
• remote access to devices located in a dedicated subnet (such as a recorder, cameras) should be
secured by a firewall filtering traffic at the L3 and L4 level
 remote access to the recorder possible only from a dedicated device
 open network ports
 HTTP – 80 TCP port
 HTTPS – 443 TCP port (recommended communication port with the recorder)
 Server port – 9000 TCP port
 RTSP – 554 TCP port
 for security reasons it is not recommended to set the public IP address on the device and
share it directly from the Internet
 in the case of required access to the device from another location or directly from the
Internet, it is recommended to use an encrypted VPN tunnel
Detailed network configuration
Select the „General” submenu in the „Network” recorder menu. The „General” tab has TCP / IP
settings.

Security settings recommendations for NHDR and NVR 4000 series Novus recorders
All rights reserved © AAT Holding S.A.
7
INITIAL CONFIGURATION
2. 2. 2. HTTPS connection configuration
To enable logging into the administration panel using HTTPS protocol, log in to the recorder through
the browser, enter „Remote settings” and select „HTTPS” in the „Network” section.
In the next step, enable HTTPS encryption and select the „Certificate Type”. It can be used the
„Default” type of recorder certificate or upload another certificate and key by selecting the „Custom”
option.
All changes should be confirmed using „Save” button.

All rights reserved © AAT Holding S.A.
Security settings recommendations for NHDR and NVR 4000 series Novus recorders
8
INITIAL CONFIGURATION
After starting HTTPS encryption, run a browser and connect to the recorderusing the prefix „https://”.
In the Internet Explorer browser, expand the MORE INFORMATION button and click on CONTINUE
TO THIS WEBSITE (NOT RECOMMENDED). After that, the recorder login page should open.
2. 2. 3. Devices access restrictions
According to the above recommendations, in order to provide adequate protection against unauthorized
access, it is recommended to prepare a separate LAN subnet dedicated only to the monitoring system.
In addition, remote access to devices located in a dedicated subnet (such as a recorder, cameras) should
be secured by a firewall that filters traffic at the TCP / IP level.
The additional solution is to use IP filtering. This functionality is available directly on the device. It
allows to define devices that will be able to connect to the device remotely. The rule can be set by
adding the IP address of the trusted device (L3 layer).
To configure the list, enable the filtering function in the „Network” menu, „IP filtering” submenu.
Then enable „Alow white list” and add IP addresses which will be able to connect to the device
remotely.
After defining the list, all changes have to be accepted by „Apply” button.

Security settings recommendations for NHDR and NVR 4000 series Novus recorders
All rights reserved © AAT Holding S.A.
9
INITIAL CONFIGURATION
2. 2. 4. Remote access to device – VPN
According to the above recommendations, the preferred option of remote access to devices from /
through untrusted networks (e.g. Internet) is to set up a VPN tunnel that will protect communication
between devices.
VPN architecture:
1. P2S VPN (Point to Site) – in case of connecting to the device directly from a user station located
in an untrusted network. This station should have an application installed to set up session. The
tunnel is usually set up for the purposes of logging in to the system once.
2. S2S VPN (Site to Site) – in case of connecting to a device from a trusted network (e.g., a second
company location). A tunnel set up permanently between locations on edge devices.

All rights reserved © AAT Holding S.A.
Security settings recommendations for NHDR and NVR 4000 series Novus recorders
10
INITIAL CONFIGURATION
1. P2S VPN scheme (Point to Site)
Point to Site VPN
2. S2S VPN scheme (Site to Site)
Site to Site VPN