Dahua Cybersecurity: Common Criteria EAL 3+ and ETSI EN 303 645 Explained

Dahua network cameras have achieved Common Criteria EAL 3+ certification (May 2024), and its IP cameras and recorders meet ETSI EN 303 645, the European cybersecurity baseline for connected consumer devices (August 2022). Dahua also lists ISO/IEC 27001, ISO/IEC 27701 and FIPS 140-2. Here's what these certifications mean in plain English, and the practical steps that keep any CCTV system secure.

Why cybersecurity matters for CCTV

Every IP camera and recorder is a small computer on your network. A poorly secured device can expose footage, become a way into the rest of the network, or be recruited into attacks on other systems. Independent certification checks that a manufacturer's devices and processes meet a recognised bar.

Common Criteria EAL 3+ (May 2024)

• Common Criteria is an international standard for evaluating IT security, recognised by 31 countries in the CCRA arrangement, including the UK, US, Germany, the Netherlands and Japan.
• EAL 3+ ("methodically tested and checked", with additions) looks beyond the product to the development environment, production, supply chain, vulnerability assessment and staff security.
• Dahua's evaluation was carried out by SGS Brightsight in the Netherlands under the Dutch NSCIB scheme.

ETSI EN 303 645 (August 2022)

• A European standard setting baseline security for consumer IoT devices, covering 13 areas plus data protection.
• Areas include no universal default passwords, keeping software updated, secure communication, minimising the attack surface and protecting personal data.
• It underpins much of the thinking behind the UK's Product Security and Telecommunications Infrastructure (PSTI) rules for connected products.
• Dahua describes a privacy-by-design approach with data minimisation, privacy-friendly defaults, masking, encryption and face occlusion.

What certification does and doesn't do

Certification shows a product and its maker meet a defined standard at a point in time. It doesn't make an installation secure on its own; how the system is set up matters as much. That's why we always recommend the basics below, whichever brand you choose.

Five steps to a secure CCTV system

• Strong, unique passwords on every recorder, camera and app account.
• Keep firmware up to date on cameras and recorders.
• Don't port-forward recorders to the internet; use the manufacturer's P2P app or a VPN.
• Separate the CCTV network from office or guest Wi-Fi where you can, for example with a VLAN on a managed switch.
• Turn off services you don't use and review user accounts regularly.

Dahua equipment from Zenith Security Co

We supply Dahua cameras, recorders, intercoms and alarms. Our IP camera buying guide and NVR buying guide help with choosing equipment, and our technical support team can advise on secure set-up.

Our take

Independent certification is a sensible thing to look for when choosing any connected security product, and CC EAL 3+ in particular looks at the whole supply chain, not just the device. But the biggest risks in real installations are still default passwords, old firmware and recorders exposed to the internet, and those are in the installer's and user's hands.

Questions about securing your system? Call 01902 902251. We ship nationally to England, Scotland and Wales.

Quick questions

What is Common Criteria EAL 3+?
An internationally recognised security evaluation level covering a product's design, development, production and supply chain.

What is ETSI EN 303 645?
A European cybersecurity baseline for consumer connected devices, covering passwords, updates, secure communication and data protection.

Which Dahua products are certified?
Dahua announced CC EAL 3+ for its network camera series, and ETSI EN 303 645 for its network cameras and video recorders.

Is a certified camera automatically secure?
No. Strong passwords, firmware updates and good network practice are still essential.

Sources: Dahua MENA press releases, 11 August 2022 and 16 May 2024.