600-35ns01-A - Honeywell 35 Series NVR Network Security Guide-0728
600-35ns01-A - Honeywell 35 Series NVR Network Security Guide-0728
Copy Right
© 2023 Honeywell International Inc. All rights reserved. No part of this publication may be reproduced by any means without
written permission from Honeywell. The information in this publication is believed to be accurate in all respects. However,
Honeywell cannot assume responsibility for any consequences resulting from the use thereof. The information contained
herein is subject to change without notice. Revisions or new editions to this publication may be issued to incorporate such
changes. For patent information, see https://buildings.honeywell.com/us/en/support/legal/patents.
Revision
Issue Date Revisions
A 07/2023 New document.
Table of Contents
Scope ............................................................................................................... 1
Compatible SKUs .......................................................................................... 1
Application Scenarios .................................................................................. 2
Software Updates ......................................................................................... 3
Firmware Encryption .............................................................................................................. 3
Upgrade ....................................................................................................................................... 3
Downgrade ................................................................................................................................. 4
Removable Storage ...................................................................................... 4
Password Management ............................................................................... 4
Port Management ........................................................................................ 4
Account Management ................................................................................. 4
Browser Security........................................................................................... 5
Internet Explorer ...................................................................................................................... 5
Google Chrome......................................................................................................................... 6
Lockout Function ......................................................................................... 7
Session Timeout Mechanism ..................................................................... 7
HTTPS Secure Communication ................................................................. 7
Installing a Security Certificate.......................................................................................... 8
Customized Certificate Info ............................................................................................. 12
TLS 1.2 ..........................................................................................................13
Backup and Recovery ................................................................................13
Decommissioning/Disposal Management............................................14
Reset Security Question............................................................................14
Security Communication with External Systems ................................14
Accessories Security ..................................................................................15
Honeywell 35 Series Network Video Recorder Network Security Guide I
HSV Security ........................................................................................................................... 15
HSV Mobile App Security................................................................................................... 16
Vulnerability Reporting ............................................................................17
III
Honeywell 35 Series Network Video Recorder Network Security Guide
Tables
Table 1 Compatible SKUs .................................................................................................................................................................................... 1
Compatible SKUs
For compatible SKUs information, refer to the table below.
Table 1 Compatible SKUs
HN35160408R S35 16 Chs NVR 4K (8 MP) Support, H.265/H.264, 16 Chs PoE, Stream Encryption, 4 SATA, 8 TB
HN35160416R S35 16 Chs NVR 4K (8 MP) Support, H.265/H.264, 16 Chs PoE, Stream Encryption, 4 SATA, 16 TB
HN35160491R S35 16 Chs NVR 4K (8 MP) Support, H.265/H.264, 16 Chs PoE, Stream Encryption, 4 SATA, 8 TB, RAID
HN35160492R S35 16 Chs NVR 4K (8 MP) Support, H.265/H.264, 16 Chs PoE, Stream Encryption, 4 SATA, 16 TB, RAID
HN35320400NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4 SATA, 0 TB, Non-PoE, RAID
HN35320408NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4SATA, 8 TB, Non-PoE
HN35320416NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4SATA, 16 TB, Non-PoE
HN35320491NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4SATA, 8 TB, Non-PoE, RAID
HN35320492NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4SATA, 16 TB, Non-PoE, RAID
HN35640400NR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4 SATA, 0 TB, Non-PoE, RAID
HN35640492NR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 4 SATA, 16 TB, Non-PoE, RAID
HN35320800NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 0 TB, Non-PoE, RAID
HN35320808NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 8 TB, Non-PoE
HN35320816NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 16 TB, Non-PoE
HN35320832NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 32 TB, Non-PoE
HN35320891NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 8 TB, Non-PoE RAID
HN35320892NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 16 TB, Non-PoE, RAID
HN35320893NR S35 32 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 32 TB, Non-PoE, RAID
HN35640800NR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 0 TB, Non-PoE, RAID
HN35640892NR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 16 TB, Non-PoE, RAID
HN35640893NR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 32 TB, Non-PoE, RAID
HN35640894NR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 48 TB, Non-PoE, RAID
HN35640800DR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 0 TB, Non-PoE, Dual Power supply, RAID
HN35640893DR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 32 TB, Non-PoE, RAID
HN35640894DR S35 64 Chs NVR 4K (8 MP) Support, H.265/H.264, Stream Encryption, 8 SATA, 48TB, Non-PoE, RAID
This guide only introduces how to secure the data and communication of Honeywell 35
Series NVR. Total Honeywell solution is based on encrypted stream and commands
Note:
(HTTPS). If there are other 3rd party cameras or platform connections, the encryption
will be depended on the 3rd party.
Honeywell recommends that you should follow our recommended scenes to deploy NVR in a
secure environment due to:
• RTSP/RTP is the most popular live stream transmission protocol today, which is widely used
in almost all NVRs. But it also has some security risks that can be exploited to cause the risk
of sensitive data disclosure. RTSP over multicast is the same. RTSP over HTTPS is
supported and recommended on our device. To enable HTTPS only, go to Setting > Camera
>ADD DEVICES>YES.
Note: • It is recommended that you should do physical protection regularly for NVR and its
accessories.
• It is recommended that you should follow local law to legitimately use the NVR, HSV
and HSV App. When you need to collect some video recordings or snapshot data,
especially some personal data, follow the data minimization principle and post up
proper statement in the collected zone according to the local law.
Contact our technical support on how to configure the firewall, NVR, HSV and HSV App.
Software Updates
Firmware Encryption
Honeywell provides Honeywell signed and encrypted firmware. The Honeywell signing can
prevent tampered firmware being upgrade, and the encrypted firmware can prevent FW
information disclosure.
Upgrade
Ensure that your NVR firmware is up to date.
Removable Storage
Always scan HDD, USB and other storages for viruses before using them with your
NVR/HSV/HSV App.
Password Management
When you log in your NVR for the first time, you will be required to initialize the admin
password. The new password must be at least 8 characters in length, contain a mix of
uppercase and lowercase characters, and include at least one number and at least one special
character.
Honeywell recommends that you change all your passwords every 90 days for the NVR or its
accessories.
Port Management
Honeywell has implemented strict port management on Honeywell 35 Series NVR, disabling
unused or unsecured network services such as Telnet and FTP.
The following ports are required by the NVR normal functions:
• 80 (HTTP) • 30141/30142 (NVR discovery)
• 443 (HTTPS) • 30143 (Client Control)
• 8090 (FW upgrade) • 61001 (P2P)
• 1900 (UPNP) • 5353 (MDNS discovery)
• 3702 (Onvif discovery) • 161 (SNMP)
Account Management
The admin user can assign different levels of access to different user accounts. For example,
one user may only be allowed to monitor and play back video while another user may be
allowed to use various setup functions.
Browser Security
Honeywell 35 Series NVR supports logins with both Internet Explorer 11.0+ and Google Chrome
71+ web clients.
Most of us have numerous passwords to keep track of on a regular basis for both business and
personal life. It may be tempting to click Remember Password or Save Password when your
web browser prompts you, but it will put your security at risk.
• Internet Explorer saves your passwords in your browser, and it does not show your saved
passwords. However, it can be easy to find tools to expose these passwords.
• Chrome saves your passwords in your Google account. Once someone logs into your
account, all your passwords are visible. It means that if your account is hacked, the hacker
has access to all your other accounts.
Honeywell strongly recommends that do not allow your browser to remember your password, or
turn off the built-in password manager in your browser.
Internet Explorer
To stop Internet Explorer from asking to save your passwords:
1. Click the Settings menu and choose Internet options.
2. Click Content.
3. Click Settings in the AutoComplete section.
4. Uncheck Forms and Searches and User names and passwords on forms.
5. Click OK.
Google Chrome
To stop Chrome from asking to save your passwords:
1. Click in the toolbar and choose Settings.
2. Click Passwords.
3. Switch off Offer to save passwords.
Lockout Function
By default, user accounts are locked after 5 consecutively failed login attempts. The default
lockout time is 30 minutes. The lock will also be released if the device is restarted.
3. In the login window, enter your User name and Password. Click LOGIN.
4. After logging in, go to Setting > Networks > Web Mode > CA Certificate. Click
EXPORT under CA Certificate.
5. Go to the directory where you saved the certificate and double-click the certificate.
Click Open. The Certificate window opens.
6. In the Certificate window, on the General tab, click Install Certificate to open the
Certificate Import Wizard.
11. Click OK to close the wizard and return to the Certificate window.
You should now be able to reopen your browser without receiving a warning about website
security.
Then the Well-known certificate will be used instead of the original self-signed
certificate.
2. In the Certificate field, click CHOOSE FILE to select a certificate file you have
already applied from 3rd party or CA domain.
3. In the Key field, click CHOOSE FILE to select a certificate key you have already
applied from 3rd party or CA domain.
4. Click UPLOAD.
Figure 9 Uploaded Files
Then the Well-known certificate will be used instead of the original self-signed
certificate.
Note: If the certificate requirement file is exported from a device, only the
certificate file is needed to be imported.
If the certificate requirement file is exported by user self-signed or Well-
known CA, both the certificate file and the key file are needed to be imported.
TLS 1.2
All Honeywell 35 Series NVR, HSV and HSV App use TLS 1.2 only to enhance data security.
Weak algorithms such as RC4, MD5, and SHA1 are not used.
HSV Security
The HSV is a 35 Series NVR management and viewer client. It is a professional video
surveillance system designed for 35 Series NVR on managing security surveillance devices
conveniently and efficiently. It supports live view, playback, tour & task, E-Map, Event trigger
management, smart search and other services.
• Honeywell provides Honeywell signed Windows HSV software. Before you install the
software, Honeywell recommends that you verify the signature information to avoid
tampered software installation.
Right click on your software icon and select properties. Refer to the snapshots below to
check the software signing information (Details and Certificate Path information should
be the same with the snapshots).
Figure 11 Software Signature Information Verification
Vulnerability Reporting
Honeywell encourages coordinated disclosure of security vulnerabilities. Security researchers,
industry groups, government organizations and vendors can report potential security
vulnerabilities to Honeywell by choosing one of the two vulnerability types in the form below or
by emailing us with below details mentioned.
If the vulnerability affects a product, service, or solution, email us at [email protected],
with the following instructions/details.
Please encrypt using Honeywell’s public PGP key and include the following:
• Product and version
• Description of the potential vulnerability
• Any special configuration required to reproduce the issue
• Step by step instructions to reproduce the issue
• Proof of concept or exploit code, if available
• Potential Impact
For all other security issues, email us at [email protected] with the following
instructions.
Please encrypt using Honeywell’s public PGP key and include the following:
• Website URL or location
• Type of vulnerability (XSS, Injection, etc.)
• Instructions to reproduce the vulnerability
https://buildings.honeywell.com/security
+1 800 323 4576 (North America only)
Document 600-35NS01 Rev A –07/2023