Hikvision Network Security Hardening Guide
This guide introduces users to the security features of Hikvision network devices and how to use and manage them safely. While it provides a general safety overview, users should select security settings appropriate to their actual situation. The configuration paths referenced here are based on a camera device running firmware version 5.7 as an example — some settings and navigation paths may vary depending on the device version.
For more cybersecurity information, visit the Hikvision Official Cybersecurity Center. For feedback, email [email protected].
Contents
- 1. Introduction
- 2. Standard Configuration
- 2.1 Activate the Device by Setting a Strong Password
- 2.2 Time Synchronisation
- 2.3 System Upgrade
- 2.4 Backup
- 2.5 System Restore
- 2.6 Remote Syslog
- 2.7 Configure Basic Network Settings
- 2.8 Disable DDNS
- 2.9 Choose SNMPv3
- 2.10 IEEE 802.1X
- 2.11 HTTPS and HTTPS Browsing
- 2.12 Certificate Management
- 2.13 Certificate Expiration Alarm
- 2.14 HTTP(S) Authentication
- 2.15 RTSP Authentication
- 2.16 ONVIF
- 2.17 Enhanced SDK Service and Security Mode
- 2.18 TLS Version
- 2.19 Secure Real-time Transport Protocol
- 2.20 Enable WebSockets
- 2.21 Encrypted Transmission (Plug-In Enabled)
- 2.22 Disable UPnP™
- 2.23 Disable SSH
- 2.24 Set IP Address Filter
- 2.25 Set MAC Address Filter
- 2.26 Account Security Settings
- 2.27 User Access Control
- 2.28 Enable Illegal Login Lock
- 2.29 Enable Control Timeout Setting
- 2.30 Sustaining System Security
- 3. Appendix
1. Introduction
This document is written as a general security hardening guideline for users to protect their own devices. Measurements should be taken into consideration depending on the application scenarios. If issues arise after implementing any of the recommended security enhancements, reverting to default settings may resolve them.
1.1 Passwords
Passwords are a critical part of securing network devices. To protect your system from unauthorised access, it is essential to create strong, unique passwords and follow best practices for password management.
How to create a strong password
- Use at least 8 characters. Longer passwords or passphrases are more secure because they are harder to guess.
- Include at least three of the following character types: numbers, uppercase letters, lowercase letters, and special characters.
- Avoid including the following items in your password: your account’s username, “123”, “admin”, 4 consecutive digits in ascending or descending order, or 4 consecutive repeated characters.
- Do not use passwords commonly found in password breach lists, such as “1qaz2wsx”, “p@ssword”, or similar risky choices.
The Password Phrase Method
A passphrase is a memorable sentence or phrase that is difficult for others to guess. Here are some tips for creating a strong but memorable passphrase:
- Choose a phrase that has numbers.
- Use only the first letter in each word.
- Maintain the original case of each letter, just as it appears in the phrase.
- Use actual numbers whenever possible. Use “2” for “two” or “to” and “4” for “four” or “for”.
- Include punctuation.
Example: “My flight to New York will leave at three in the afternoon!” becomes MftNYwla3ita!
General password/security tips
- Avoid using dictionary words in any language.
- Do not use sequences or repeated characters.
- Change the password at a recurring interval.
- Do not allow browsers to store passwords.
- Do not type passwords on computers that you do not control.
- Never share your password or send it by email.
- Never respond to an email asking for personal information. (Hikvision will never ask for your personal information in an email.)
- Keep your software updated and be cautious with email attachments and links.
2. Standard Configuration
This section outlines the minimum recommended settings for small monitoring systems, using a network camera as the example throughout. The following configuration is recommended for home, office or small business scenarios. Configurations will differ based on the network and the size of the system you are installing.
All device configuration presented in this article is performed via a web browser except for some activation steps.
2.1 Activate the Device by Setting a Strong Password
Before using your device, you must activate it by creating a strong password. Activation can be performed via web browser, SADP software and client software. Before activating, make sure your PC and device are on the same LAN (see Appendix A).
2.1.1 Activation via Web Browser
Steps:
1. Enter the default IP address of your device (e.g. 192.168.1.64) into the address bar of the web browser, and press Enter to access the activation page.
2. Create a strong password and enter it into the password field.
3. Confirm the password.
4. Click Activation to save the password and access the Account Security Settings page.
5. We strongly recommend that you immediately select and fill in three security questions. The answers to these questions should not be the same. After filling in, enter your reserved email address.
6. If you don’t want to set this now, you can click Not Set Temporarily.
2.1.2 Activation via SADP Software
SADP software can detect devices on your network, activate them, and modify network configurations. You can download SADP from the Hikvision official website.
Steps:
1. Run the SADP software to search for devices on your network.
2. Check the device status in the device list and select your inactive device.
3. Create a strong password and enter it into the password field, then confirm it.
4. Click Activate to activate the device.
2.1.3 Activation via iVMS-4200
iVMS-4200 is a client software that supports activation for multiple device types. Download it from the Hikvision official website.
Steps:
1. Run the client software to see the control panel.
2. Click Device Management to enter the Device Management interface, then click OnlineDevice to find devices.
3. Check the device status in the device list and select your inactive device.
4. Click Activate to enter the Activate interface.
5. Create a strong password and enter it into the password field, then confirm it.
6. Click OK to complete the activation process.
2.2 Time Synchronisation
From a security perspective, accurate date and time settings are essential for secure video recording and system logging. You can synchronise the device time using either an NTP server or manually.
Navigation: Configuration > Common Settings > Time Settings or Configuration > System > System Settings > Time Settings
2.2.1 NTP Time Synchronisation
For accurate and reliable time settings, use a Network Time Protocol (NTP) server to synchronise your device’s clock. The NTP server and your device must be on the same network.
Steps:
1. Go to the Time Settings page, select your time zone, and choose NTP Time Sync.
2. Enter the NTP server’s IP address or domain name, port, and synchronisation interval.
3. Click Test to check connectivity. If successful, click Save.
2.2.2 Manual Time Synchronisation
If no NTP server is available, you can configure the time manually or sync it with your local computer.
Steps:
1. Go to the Time Settings page, select your time zone, and choose Manual Time Sync.
2. Set the date and time manually or click Sync with computer time to match your local computer.
3. Click Save to apply the settings.
2.3 System Upgrade
Firmware is the software that enables and controls the functions of your network device. To ensure you have the latest security updates and bug-fixes, always use the most recent firmware version.
2.3.1 Check the Current Firmware
To check your current firmware version, go to: Configuration > System > System Settings > Basic Information.
2.3.2 Upgrade the Device to the Latest Firmware Version
You can download the latest firmware package from the official Hikvision firmware website.
Steps:
1. Go to: Maintenance and Security > Maintenance > Upgrade.
2. Choose your upgrade method:
- Upgrade File: Select the exact path to the upgrade package.
- Upgrade Directory: Select the directory containing the upgrade package.
3. Click the Folder icon to select the upgrade file and then click Upgrade to start.
2.4 Backup
Backing up your device’s parameters is essential for quickly restoring it to its last stable state in case of failure.
Steps:
1. Go to Maintenance and Security > Maintenance > Backup and Restore.
2. Click Export and then enter the password for this backup file.
3. Click OK, and the configuration backup file will be automatically downloaded.
To restore from a backup:
Steps:
1. Click the Folder icon, select the backup file.
2. Click Import, enter the password you previously set for the backup file.
3. Click OK to start the import.
2.5 System Restore
Resetting the device to its factory defaults can return it to a known, clean state, which is essential for the secure use of the device. Before you start configuring the device, be sure it is in a factory-default state. You should also restore the device to its original factory state whenever you must erase user data or retire the equipment.
Steps:
Go to Maintenance and Security > Maintenance > Backup and Restore.
- Restore to Default Settings: Clears all data except network parameters and user accounts.
- Restore to Factory Settings: Resets all functions and parameters to factory defaults.
192.168.1.64). Be aware of this change before proceeding.2.6 Remote Syslog
Hikvision network cameras support sending logs to a remote syslog server, which can better preserve the logs and facilitate centralised auditing. The syslog standard is based on RFC 3164. Be sure to set up a remote syslog server that supports RFC 3164 beforehand.
Steps:
1. Go to Maintenance and Security > Maintenance > Security Audit Log.
2. Click Advanced Configuration, enable the Log Upload Server, and set the log server parameters. Enabling Encrypted Transmission is also recommended so that data sent to the log server is encrypted.
3. Click Save to apply the settings.
2.7 Configure Basic Network Settings
Steps:
1. Go to Configuration > Network > Network Settings > TCP/IP.
2. Enter the required network parameters: IPv4 Address, Subnet Mask, Default Gateway and DNS Server.
3. Click Save to apply the network settings.
2.8 Disable DDNS
Hikvision network devices support Dynamic Domain Name System (DDNS), which allows remote access by mapping a dynamic IP address to a fixed domain name. While DDNS can be convenient, it also introduces security risks by exposing your device to the internet, making it easier for attackers to find and target your system. This function is disabled by default. If you do not need DDNS service, ensure it remains disabled.
Steps:
1. Go to Configuration > Network > Network Settings > DDNS.
2. Ensure the Enable switch is turned off.
2.9 Choose SNMPv3
According to the principle of minimising network exposure in cybersecurity, SNMP service is disabled by default. Keep it disabled when not in use.
If SNMP is required, always enable SNMPv3, which offers significantly stronger security than SNMPv1 or SNMPv2c. SNMPv3 supports authentication and encryption, helping protect management data from interception, spoofing, and tampering. Earlier versions transmit data in plain text, making them vulnerable to compromise.
Steps:
1. Go to Configuration > Network > Network Settings > SNMP.
2. Ensure that “Enable SNMPv1” and “Enable SNMPv2c” are turned off, and turn on the Enable switch of SNMPv3.
3. Configure the SNMPv3 settings. For maximum security, select the security level as auth, priv, use SHA as the authentication algorithm, AES as the private key algorithm, and set strong passwords.
4. Click Save to apply the settings.
2.10 IEEE 802.1X
Hikvision network devices support IEEE 802.1X port-based network access control, utilising EAP-TLS as the authentication method. This feature ensures that only authorised devices can connect to the network by validating their certificates.
This function is disabled by default. For enhanced security, we strongly recommend selecting EAP-TLS as the protocol type. For optimal security, authenticate your device with a client certificate signed by a certificate authority (CA) trusted by both the device and the authentication server.
Steps:
1. Go to Configuration > Network > Network Settings > 802.1X.
2. Turn on the Enable switch.
3. Choose EAP-TLS as the protocol type, enter the Identity field (max 32 characters) and pick the certificates. Refer to Section 2.12 for certificate configuration.
4. Click Save.
2.11 HTTPS and HTTPS Browsing
HTTPS can provide confidentiality and integrity when a website and its associated web server are communicating. HTTPS is enabled by default. Moreover, on Hikvision network devices you can enable HTTPS Browsing (also known as HTTPS Redirection) so that every access to the device’s web interface is automatically redirected to HTTPS, ensuring that all communication is encrypted.
Steps:
1. Go to Configuration > Network > Network Service > HTTP(S).
2. Ensure the Enable switch is on and turn on the Enable HTTPS Browsing switch.
3. Select the appropriate server certificate. Refer to Section 2.12 for certificate configuration.
4. Click Save.
2.12 Certificate Management
When the device is activated, a default certificate will be automatically generated. You can also create and use your own certificate.
2.12.1 Create Self-signed Certificate
Steps:
1. Go to Maintenance and Security > Security > Certificate Management.
2. Click Create Self-signed Certificate.
3. Enter the Certificate ID, Public Key Length, Country, Domain/IP, Validity Period and other information. We strongly recommend setting the public key length to the highest value supported by the system (2048 in this case).
4. Click Save and the self-signed certificate will be successfully created.
2.12.2 Create CA Certificate
Steps:
1. Select the certificate that you wish to use for CA certification and click Create Certificate Request.
2. Fill in the required information in the popup window and click Save.
3. You will see a Certificate Details page. Copy the PEM-formatted CSR content into a plain text file, then save it with a .csr file extension (e.g. request.csr).
4. Submit the generated CSR file to a third-party certification authority. Once you receive the issued certificate (usually in .crt or .pem format) from the CA, import it into your device by clicking Import.
5. Upload the CA certificate you received and click Save.
2.13 Certificate Expiration Alarm
Certificates have a validity period. If expired, they may disrupt encrypted communication and authentication processes, thereby creating security vulnerabilities. Hikvision devices support a certificate expiration alarm mechanism, which can alert users in advance to update certificates and avoid service interruptions.
Steps:
1. Go to Maintenance and Security > Security > Certificate Management.
2. Turn on the Enable Certificate Expiration Alarm switch.
3. Set corresponding parameters and choose your preferred notification method.
4. Click Save.
2.14 HTTP(S) Authentication
Hikvision network devices support two authentication modes (digest and digest/basic) and three digest algorithm options (MD5, SHA256 and MD5/SHA256). For the highest level of security, we strongly recommend using digest authentication mode with the SHA256 algorithm.
Steps:
1. Go to Configuration > Network > Network Service > HTTP(S).
2. Select digest as the authentication mode and SHA256 as the digest algorithm.
3. Click Save to apply the settings.
2.15 RTSP Authentication
For the highest level of security, we strongly recommend using digest authentication mode with the SHA256 algorithm.
Steps:
1. Go to Configuration > Network > Network Service > RTSP.
2. Select digest as the authentication mode and SHA256 as the digest algorithm.
3. Click Save to apply the settings.
2.16 ONVIF
Hikvision network cameras support the ONVIF (Open Network Video Interface Forum) protocol, which enables interoperability between network video devices and third-party video management systems (VMS). This protocol is disabled by default to minimise potential exposure on the network.
Enable ONVIF only if you need to integrate the device with a third-party VMS or software that requires it. For authentication security, we strongly recommend using digest authentication, as it transmits a hashed version of the credentials instead of plain text.
Steps:
1. Go to Configuration > Network > Platform Access > ONVIF.
2. Select Digest as the authentication mode.
3. Click Save to apply the settings.
2.17 Enhanced SDK Service and Security Mode
Enabling the SDK service allows the camera to be accessed through client software. For improved security, the Enhanced SDK Service uses the TLS protocol to protect data during transmission. By default, Hikvision network cameras have the Enhanced SDK Service and Security Mode enabled. We strongly recommend using this configuration for optimal security.
Steps:
1. Go to Configuration > Network > Platform Access > SDK Service.
2. Set SDK Protocol Authentication to Security Mode.
3. Ensure the Enhanced SDK Service is enabled (switch on). Confirm the port number and select the appropriate server certificate if needed.
4. Ensure the SDK Service is disabled (switch off).
5. Click Save to apply the settings.
2.18 TLS Version
Transport Layer Security Protocol (TLS) provides confidentiality and data integrity between communication applications. Hikvision network cameras support TLS 1.1, TLS 1.2 and TLS 1.3, with TLS 1.2 and TLS 1.3 enabled by default.
Because TLS 1.1 and earlier versions have known security vulnerabilities (such as the BEAST attack), it is recommended to disable TLS 1.1 and use TLS 1.3 (which offers enhanced security features like forward secrecy) or TLS 1.2 (with strong encryption suites).
Steps:
1. Go to Maintenance and Security > Security > TLS.
2. Ensure TLS 1.2 and TLS 1.3 are enabled and TLS 1.1 is disabled.
3. Click Save to apply the settings.
2.19 Secure Real-time Transport Protocol
Hikvision network cameras support Secure Real-time Transport Protocol (SRTP). If your video management system is compatible, we highly recommend enabling SRTP to replace unencrypted RTP video streaming. By default, the device uses AES256 for encryption.
Steps:
1. Go to Configuration > Network > Network Service > SRTP.
2. Select the appropriate Server Certificate and set the encryption algorithm to AES256. Refer to Section 2.12 for certificate configuration.
3. Click Save to apply the settings.
2.20 Enable WebSockets
If the Web Plug-In is not installed, you can enable the WebSocket(s) service so that the camera’s video stream can be transmitted over WebSocket(s) and viewed in a web browser. When HTTPS is enabled, enabling the WebSockets feature can encrypt the video stream transmitted via WebSockets.
Steps:
1. Go to Configuration > Network > Network Service > WebSocket(s).
2. Enable the WebSockets function and enter the required port number. At the same time, disable the insecure WebSocket service.
3. Click Save to apply the settings.
https://192.168.1.64 in your web browser. Otherwise, the live view feature will not work.2.21 Encrypted Transmission (Plug-In Enabled)
Certain web browsers may restrict the display of device functions (e.g. Live View) and therefore require a plug-in to work. When a Web Plug-In is installed, video data is no longer transmitted via the WebSocket(s) protocol. In this scenario, setting Protocol Type to HTTP can make video stream transmitted via RTP-over-HTTPS, which is an encrypted transport.
Steps:
1. Click the Plug-In button at the top of the configuration page to check whether the Web Plug-In is installed.
2. If installed, go to Configuration > Local. Set Protocol Type to HTTP.
3. Click Save to apply the settings.
https://192.168.1.64 in your web browser. Otherwise, the video data will not be encrypted.2.22 Disable UPnP™
Universal Plug and Play (UPnP™) is a networking protocol that enables automatic port forwarding on routers. This function is disabled by default; if your device does not rely on cloud-based or remote services (e.g. hosted video monitoring), it is recommended to disable UPnP™ to reduce potential security risks.
Steps:
1. Go to Configuration > Network > Network Service > NAT.
2. Ensure the Enable UPnP™ switch is in the off position.
3. Click Save to apply the settings.
2.23 Disable SSH
Secure SHell (SSH) is a network protocol that provides secure command-line remote access and device management over unsecured networks. SSH is disabled by default on Hikvision devices. While SSH can be useful for advanced configuration and troubleshooting, it should remain disabled unless specifically required.
Steps:
1. Go to Maintenance and Security > Maintenance > Device Debugging > SSH Settings.
2. Ensure the Enable switch is in the off position.
3. Click Save to apply the settings.
2.24 Set IP Address Filter
Enabling IP address filtering restricts device access to only authorised users, helping to prevent unauthorised access.
Steps:
1. Go to Maintenance and Security > Security > IP Address Filter.
2. Turn on the Enable switch.
3. Choose the filter type:
- Blocklist: IP addresses on this list cannot access the device.
- Allowlist: Only IP addresses on this list can access the device.
4. Based on your security strategy, select either Blocklist or Allowlist. Click Add, enter the IP address you want to filter, and click OK.
5. Click Save to apply the settings.
2.25 Set MAC Address Filter
MAC address filtering is a network security feature that helps control which devices can connect to your system. By specifying allowed or blocked MAC addresses, you can enhance access control and reduce unauthorised connections.
Steps:
1. Go to Maintenance and Security > Security > MAC Address Filter.
2. Turn on the Enable switch.
3. Choose the filter type:
- Blocklist: Devices with MAC addresses on this list will be denied access.
- Allowlist: Only devices with MAC addresses on this list will be permitted access.
4. Based on your filtering strategy, select either Blocklist or Allowlist. Click Add, enter the MAC address, and click OK.
5. Click Save to apply the settings.
00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5F.2.26 Account Security Settings
Security Question and Reserved Email are two methods that support you to reset your password when you forget it. These recovery methods can be set up during device activation or configured later through the account settings.
Steps:
1. Go to Configuration > System > User Management > User Management.
2. Select the user account you want to configure, then click Account Security Settings at the top of the page.
3. Choose the security questions and provide corresponding answers. Be sure to remember the answers — they will be required if you use this method to reset your password.
4. Enter a reserved email address. This is a pre-designated administrator or system recovery email used for password reset or verification purposes. Do not use a personal or unverified address.
5. Click OK to save your settings.
2.27 User Access Control
2.27.1 Set Permission Level for Users’ Roles
Hikvision network devices support three user roles: Admin, Operator, and User. The Admin account has full control, including the ability to create, modify, or delete other user accounts and assign specific permissions.
It is recommended to assign roles according to the principle of least privilege, granting each user only the access necessary for their responsibilities.
Steps:
1. Go to Configuration > System > User Management > User Management.
2. Click Add to create a new user.
3. Enter the User Name, select the User Type and set the Password.
4. Enable or disable specific permissions based on the access you want to grant.
5. Click OK to save the new user account.
To modify an existing user’s permissions, click the Modify icon next to the corresponding user account, modify the permissions as needed, then click OK to apply the changes.
2.27.2 Remove Inactive User Accounts
To maintain system security, it is important to regularly remove user accounts that are no longer in use. Inactive accounts can pose a security risk if left unmanaged.
Steps:
1. Locate the user account you wish to remove in Configuration > System > User Management > User Management.
2. Select the account and click the Delete button or the Delete icon next to the corresponding user account.
3. Confirm the deletion to complete the process.
2.28 Enable Illegal Login Lock
Hikvision network devices include a security feature that automatically blocks an IP address from logging into a specific user account after repeated failed login attempts. This helps protect against brute-force attacks. This function is enabled by default.
Steps:
1. Go to Maintenance and Security > Security > Login Management.
2. Ensure the Enable Illegal Login Lock switch is on.
3. Set the number of allowed failed login attempts and define the lockout duration as needed.
4. Click Save to apply the settings.
2.29 Enable Control Timeout Setting
The control timeout feature automatically logs out a user after a period of inactivity, helping to prevent unauthorised access. By default, this feature is enabled and the system will log out after 15 minutes if no operation is performed.
Steps:
1. Go to Maintenance and Security > Security > Login Management.
2. Ensure the Control Timeout switch is on.
3. Set the desired timeout duration. For enhanced security, shorter timeouts are recommended.
4. Click Save to apply the changes.
2.30 Sustaining System Security
Securing network devices is an ongoing process that requires vigilance, regular updates, and adherence to best practices. By following the recommendations and configuration steps outlined in this guide, users can significantly reduce cybersecurity risks and strengthen the overall security posture of their Hikvision network devices.
Every network environment is unique. It is important to assess your organisation’s specific requirements and adjust security settings accordingly. Stay informed about the latest security advisories and firmware updates from Hikvision, and review your security configurations periodically to ensure continued protection.
For further information, technical support, or updates to this guide, please visit the official Hikvision website: https://www.hikvision.com.
3. Appendix
A. Set Your PC and Device to the Same LAN
Here we use a Windows 11 PC and a device whose factory IP is 192.168.1.64 as an example.
Steps:
1. Connect the device directly to the PC using a network cable and power it on.
2. On your PC, open Control Panel > Network and Internet > Network and Sharing Center.
3. Click Change adapter settings, locate the network interface that is physically connected to the device — normally the Ethernet adapter.
4. Right-click that adapter, click Properties, then double-click Internet Protocol Version 4 (TCP/IPv4). Fill in the IP address, Subnet mask and Default gateway fields:
- IP address: If the device’s default IP is
192.168.1.64, set the PC’s IP to any address from192.168.1.2to192.168.1.253(excluding192.168.1.64). Example:192.168.1.2. - Subnet mask: Use the same subnet mask as the device (e.g.
255.255.255.0). - Default gateway: This field can be left empty.
5. Click OK to apply the settings.
