According to an employee with knowledge of the system, the password to the Louvre's video surveillance system was simply "Louvre" at the time of the robbery last month.
Usually, there’s a network for IP cameras, with a central server holding the video. There’s then, usually, a firewall to anything outside that, and frequently just a hardline to a monitoring system. (another computer with lots of monitors, typically.)
I hate to say it man, but this assumes someone is going above and beyond to lock down the cameras.
I used to have a milestone implementation where I work. There was a security PC in a security office that has the cameras on and always logged in but nobody shuts down requests for camera access for other users. The flimsiest of justification is all that is necessary for the highest level of leadership to give the go ahead. We do manufacturing and everyone thinks these low quality grainy security cameras are a replacement to going on the floor and actually watching how things are working so dozens of non-security people had access.
When I started everybody was using the same local account to log in. I migrated us to AD authentication (with exception of the security PC) but anybody could still technically reach the camera system from the network.
Absolutely anybody could just enter the IP of a camera on the network though and view what it sees. Every camera had default passwords. We even had some fun brands like Hikvision that were banned in 2022 by the FCC. We had a firewall from the outside world, but a guest network that was not isolated at all.
We’ve migrated to a different solution that cost hundreds of thousands of dollars and over a year of replacing cameras, but still probably a third of people in the org have access to the cameras for bullshit reasons and leadership doesn’t care to shut it down. Thankfully none of them are admins and nobody but myself and a couple of others have any kind of admin level permissions now, but my point is that it’s the wild west out there in terms of IT processes… and often Shadow IT from groups like a security team that isn’t truly tech-savvy ends up running something like this.
If money didn’t flow like water due to a total lack of purchasing controls and nobody complaining about expenditure at the time, we’d still be using the same old security cameras. I can’t imagine the Lourve having much of a budget. museums are run like shitty nonprofits and are held together with string and bubblegum in the US.
I hate to say it man, but this assumes someone is going above and beyond to lock down the cameras.
I used to have a milestone implementation where I work. There was a security PC in a security office that has the cameras on and always logged in but nobody shuts down requests for camera access for other users. The flimsiest of justification is all that is necessary for the highest level of leadership to give the go ahead. We do manufacturing and everyone thinks these low quality grainy security cameras are a replacement to going on the floor and actually watching how things are working so dozens of non-security people had access.
When I started everybody was using the same local account to log in. I migrated us to AD authentication (with exception of the security PC) but anybody could still technically reach the camera system from the network.
Absolutely anybody could just enter the IP of a camera on the network though and view what it sees. Every camera had default passwords. We even had some fun brands like Hikvision that were banned in 2022 by the FCC. We had a firewall from the outside world, but a guest network that was not isolated at all.
We’ve migrated to a different solution that cost hundreds of thousands of dollars and over a year of replacing cameras, but still probably a third of people in the org have access to the cameras for bullshit reasons and leadership doesn’t care to shut it down. Thankfully none of them are admins and nobody but myself and a couple of others have any kind of admin level permissions now, but my point is that it’s the wild west out there in terms of IT processes… and often Shadow IT from groups like a security team that isn’t truly tech-savvy ends up running something like this.
If money didn’t flow like water due to a total lack of purchasing controls and nobody complaining about expenditure at the time, we’d still be using the same old security cameras. I can’t imagine the Lourve having much of a budget. museums are run like shitty nonprofits and are held together with string and bubblegum in the US.