What happened?
Certified Security Operations Center GmbH (CSOC), together with Axis Communications, has established so-called audit logs for network cameras in the security sector. The aim is to make processes within the camera itself traceable – an area that has so far remained largely invisible for professional surveillance systems. While network traffic and infrastructure log data have long been centrally monitored, information about who logged in or whether parameters were changed was missing from the cameras themselves.
The details
CSOC operates a Security Operations Center (SOC) and monitors IT and OT infrastructures of mid-sized companies around the clock – from small businesses to organizations relevant to critical infrastructure (KRITIS). The Managed Detection and Response (MDR) approach used combines automated detection with human expertise. The underlying principle: without data, no analysis – the more transparency, the better the protection.
Joerg Lammerich, Managing Director at CSOC, describes the previous gap in concrete terms: "We could see the camera's network traffic, but not what was happening inside the camera. Who logged in? Were parameters changed? We were missing this relevant information." As an example, he cites someone changing a camera's frame rate – this creates "blind spots" in the recording, making it deficient. During a forensic search, important information would then be missing, such as who entered a security area and with what authorization.
According to Axis, privileged users such as administrators, maintenance staff, or external service providers pose an increased risk, as they have deep technical knowledge and extensive access rights. Whether due to malicious intent or configuration errors, such changes often went unnoticed without audit logs.
Audit logs are immutable, chronological records of all security-relevant activities on a device, secured through encrypted transmission and signature. They cannot be disabled by local users. Among other things, the following are documented:
- Changes to configurations and parameters
- Access to live or archived video data
- User and role changes
- System events and software interventions
According to the manufacturer, Axis cameras provide detailed audit logs via three channels: an event stream to VMS systems for real-time monitoring, the VAPIX Audit Log API for targeted administrative queries via HTTP/HTTPS, and remote syslog via TLS for encrypted integration into SIEM and monitoring platforms. According to the company, this data flows seamlessly into CSOC's existing SOC infrastructure – encrypted, audit-proof, and forensically analyzable.
Context
Video security systems and access control are no longer isolated systems, but parts of a large networked IT system – and thus a potential attack vector. The technology behind audit logs is not new; it has long been standard in classic IT. What is new is its application in the field of video security.
Particularly in cases of insider threats or indirect attacks, such as through compromised credentials, audit logs are, according to Axis, the decisive piece of evidence for manipulation at the device level. They form the basis for threat detection along the entire chain of evidence – from the camera through data transmission to storage and display. This turns a potentially invisible manipulation into a traceable process that, depending on the degree of change, can also trigger a proactive alert.
Practical tips
The following approaches for operators of video security systems can be derived from the use cases described:
- When employees leave the company, access credentials should be consistently deactivated, and any further use of them should be monitored via audit logs – the system can automatically raise an alarm in this case.
- Changes to security-relevant camera parameters such as contrast or frame rate (FPS) should be reported in real time via the control center to detect blind spots in the recording at an early stage.
- Integrating camera audit logs into existing SIEM and monitoring platforms via remote syslog over TLS enables centralized, encrypted analysis together with other network data.
- In combination with "software sealing," every change can be clearly attributed to a user, a point in time, and a device – this also supports forensic analyses that can reach back years.
Outlook
Through audit logs, cameras at CSOC become documented, monitorable, and forensically usable elements of the overall architecture. This transforms purely reactive monitoring – in which incidents were only detected after the fact – into a proactive approach, in which unknown firmware, suspicious connections, or unauthorized configuration changes become immediately visible.
This approach also gains relevance through regulatory frameworks: according to Axis, audit logs support requirements from KRITIS, NIS-2, and ISO 27001. For operators of security-critical infrastructures, traceability at the device level is therefore likely to become not just a technical convenience feature in the future, but increasingly also a compliance issue.
