Why Smart Homes Are a Cybersecurity Target. And the VLAN Fix

The honest version of this conversation is one that many integrators avoid because it implicates the default installation practices of the industry. Cameras installed without VLAN segmentation. connected directly to the main home network like any other device. are not just unprotected. They are an active risk to every other device on that network. This is not a theoretical risk. It is the documented attack surface of millions of installed cameras worldwide.

A luxury home with a Crestron control system, a NAS with financial documents, personal computers, and a surveillance system all on the same flat network is a target where breaching one device means having a path to all of them. The surveillance system. which the client installed to protect the property. is frequently the weakest link. That is wrong, and it is fixable.

The Risk Profile: What Actually Happens

The risks from unprotected surveillance cameras fall into three categories, and all three are real.

The first is manufacturer access and government compulsion. Many surveillance cameras. including Hikvision and Dahua, which remain widely installed despite U.S. government restrictions on new federal purchases, and lower-tier brands manufactured in China. establish persistent outbound connections to manufacturer cloud infrastructure. The stated purpose is remote management and firmware updates. The actual result is that the manufacturer can access the camera feed, and any government entity that can compel that manufacturer has the same access. This is not speculation. Documented incidents of Hikvision and Dahua cameras being accessed remotely through manufacturer cloud infrastructure have been reported by security researchers and government agencies. It is the reason U.S. federal agencies are prohibited from purchasing these cameras under current law.

Consumer-grade cameras from companies like Wyze and Ring, and even some commercial platforms, have documented cloud access vulnerabilities. Ring cameras have been accessed by unauthorized third parties through compromised accounts. Wyze had a documented incident where thumbnail images from cameras were exposed to the wrong user accounts. The surveillance-on-the-surveiller problem is not limited to Chinese-manufactured hardware. it is a structural issue with any camera that stores or transmits footage through a cloud infrastructure that the property owner does not control.

The second risk is botnet recruitment. An internet-connected camera with a weak or default password is a viable compute node for a botnet. The Mirai botnet, which disrupted large portions of internet infrastructure in 2016, was primarily composed of compromised IoT devices including surveillance cameras. The individual property owner does not notice that their cameras are participating in a distributed denial of service attack against a third party. the cameras continue recording as normal while their processing power and network bandwidth are consumed for malicious purposes. The property owner’s internet connection and IP address are implicated in the attack.

The third risk is lateral movement. A compromised camera on the main home network has network access to every other device on that network. A Crestron processor, a NAS drive, a personal computer, an access control controller. all of these are reachable from a camera that has been compromised. An attacker who gains access to the camera can use it as a staging point to probe other devices, attempt credential attacks, and ultimately access data or systems that have nothing to do with surveillance. The camera is the entry point; the target is everything else on the network.

The VLAN Architecture: The Correct Fix

The solution to all three risks is the same: network segmentation using VLANs. A properly designed camera VLAN eliminates manufacturer cloud access, eliminates botnet recruitment as an outbound risk, and blocks lateral movement by isolating cameras from the main household network.

The architecture is straightforward. All surveillance cameras connect to a dedicated VLAN. a separate logical network segment with its own subnet. The NVR connects to the camera VLAN to receive camera streams. Firewall rules at the gateway enforce the following:

In this architecture, cameras are effectively air-gapped from the internet while remaining fully functional as recording devices. The NVR receives streams from cameras and stores them locally. The NVR management interface is accessible from the management VLAN. the client’s primary network devices. but cameras themselves cannot initiate connections to the management VLAN. Remote viewing access goes through the NVR, not through the cameras directly.

Restrepo Innovations implements this architecture using Ubiquiti UniFi Network hardware on every surveillance installation. As a Ubiquiti UISP Pro Partner, we configure camera VLANs, firewall rules, and NVR access policies as standard deliverables, not optional add-ons. The VLAN configuration is documented in the project closeout package and is part of the system handover to the client. For a deeper look at how UniFi supports this architecture, see our article on the complete UniFi ecosystem and our networking practice page.

AI Cameras and the VLAN Requirement

AI cameras make the VLAN architecture more important, not less. This point is worth stating directly because it runs counter to the intuition that AI cameras are more sophisticated and therefore more secure.

AI cameras require more bandwidth than standard cameras because they may transmit higher bitrate streams, metadata about detected events, and telemetry data about analytics performance. More outbound data means more cloud calls if the architecture permits them. An AI camera that is allowed to send telemetry and event data to a manufacturer’s cloud is sending more information about the property. not just footage, but structured data about who approaches the property, when, how often, and from which direction. than a standard camera would send.

The correct AI camera architecture runs inference on the NVR or on an on-premises AI processing appliance, not in the camera-to-cloud path. UniFi Protect runs AI inference on the UniFi Network Video Server hardware. Person detection, vehicle detection, license plate recognition, and package detection all execute locally. No video leaves the property for AI analysis. The analytics results are stored on the NVR alongside the footage.

Verkada’s architecture is cloud-first by design. Verkada cameras process some analytics locally on the camera’s on-device processor, but the Verkada cloud platform is essential to the full analytics and access control layer. For Verkada deployments, the camera VLAN should route Verkada camera traffic exclusively to Verkada’s documented cloud endpoints using firewall rules, blocking all other outbound destinations. Verkada provides a Command Connector appliance for environments that require local-first processing. this appliance sits on the camera VLAN and manages the Verkada cloud connection, further controlling the outbound traffic path.

MFA and Signed Firmware

VLAN isolation addresses network-level risk. MFA and signed firmware address account-level and firmware-level risk respectively.

MFA on the NVR management interface means that a compromised password alone is not sufficient to access surveillance footage. An attacker who obtains the NVR password. through phishing, credential stuffing, or a data breach at a service provider. still cannot log into the NVR management interface without the second factor. For a surveillance system that holds months of footage of a luxury residence including its security posture, access patterns, and occupancy schedules, MFA is not optional. UniFi Protect supports MFA through Ubiquiti accounts and third-party authenticator apps. Verkada requires MFA as a platform-level policy.

Signed firmware prevents firmware substitution attacks. In a firmware substitution attack, an attacker pushes modified firmware to a device that replaces the legitimate operating system with one that provides backdoor access. Signed firmware requires that the device verify the firmware package against a cryptographic key before installing it. If the signature does not match, the device refuses the update. This prevents both external attackers and rogue update servers from installing modified firmware. Both UniFi Protect and Verkada implement signed firmware. Consumer cameras and unbranded cameras frequently do not.

“A surveillance camera on the main home network is not just a camera. It is a network device with a persistent internet connection and a microphone or video feed of the property interior. Treating it like a laptop that needs network isolation is the correct mental model.” __EMDASH_PROTECT_0__

If you have an existing surveillance system that was installed without VLAN segmentation, the remediation is not a new camera system. it is a network architecture update that isolates the existing cameras onto a dedicated VLAN with the firewall rules described above. If you are planning a new installation, VLAN architecture is a requirement, not an option, in a Restrepo Innovations design. Contact us at 201.405.2022 or at Calendly to discuss either scenario. For context on the full estate network architecture that supports secure surveillance, see our post on luxury home WiFi design and our surveillance practice page.