Most advice about smart cameras stops at “use a strong password”. The National Cyber Security Centre (NCSC), the UK Government’s technical authority for cyber security, goes a step further and looks at the router that connects the camera to the internet. Its household guidance covers remote viewing, UPnP and port forwarding, and the support life of the device. This article summarises that guidance and what each recommendation costs in convenience.
Why the camera’s own settings are not the whole story
The NCSC guidance on smart security cameras explains that live feeds or images can, in rare cases, be accessed by unauthorised users, which puts privacy at risk. This is possible because cameras are often configured so the owner can access them while away from home. The guidance identifies default passwords set by the manufacturer, which are often well known or guessable, as one cause, and says criminals can use these passwords “or other techniques” to reach a camera remotely and view live video or images inside a home.
The steps it lists are straightforward: change any default password to a secure one, keep the camera updated, and switch on automatic updates where available. For the password, it suggests connecting three random words that the owner will remember and avoiding the most commonly used passwords. It also notes that camera software is sometimes called firmware, so owners should look for the words update, firmware or software in the app.
Turning off remote viewing
One of the more unusual recommendations is that people who do not need the feature that lets them view camera footage via the internet should disable it. The NCSC is candid about the cost: doing so may also stop the camera sending alerts when movement is detected, and could stop it working with smart home devices such as Alexa, Google Home or Siri. The choice is therefore a trade-off. A camera used only to record to a local card may not need remote access at all; a camera bought precisely for alerts on a phone does.
UPnP and port forwarding on the router
The guidance also asks readers to check their router. It explains that many routers use technologies called UPnP and port forwarding to let devices find one another within a network, and that criminals can exploit these technologies to potentially access devices such as smart cameras. It says owners should consider disabling UPnP and port forwarding, checking the router’s manual or the manufacturer’s website for how to do so.
Two caveats appear in the NCSC’s text. Some routers already have UPnP disabled by default, in which case nothing needs to be done. And disabling UPnP may prevent certain applications and devices from working, such as online gaming, media servers and other smart devices; owners who need those must decide whether to give up some security by allowing UPnP and port forwarding. Older cameras may need a different approach: the guidance says their password may have to be changed by typing the camera’s IP address into a browser, and that the address can be found in the router’s list of connected devices.
Support dates and the UK’s basic requirements
The NCSC’s separate guidance on smart devices in the home says owners should, if possible, avoid buying devices that are no longer supported by the manufacturer or whose support period will end soon, because out-of-support devices are easier to hack or may stop working. It suggests treating the support date as a “use by” date. It also notes that from 29 April 2024, UK law requires all smart devices to meet basic cyber security requirements, including stating the product support end date. The site’s guide to the PSTI Act 2022 explains those requirements in detail.
A practical order of checks
- Passwords and updates first. These are the two steps every NCSC page leads with; the site’s guide to account takeover adds the account-side detail.
- Decide about remote viewing. Keep it only if alerts or live checks matter enough to justify the exposure.
- Review the router. Look at UPnP and port forwarding, bearing in mind the NCSC’s warning that other devices may rely on them.
- Consider a separate network. The guide to putting smart security devices on a separate Wi-Fi network covers a complementary measure.
Frequently asked questions
Does the camera guidance cover baby monitors? Yes. The NCSC describes smart cameras as the security cameras and baby monitors used to monitor activity in and around the house.
Will disabling UPnP break my camera? The NCSC says it may prevent certain applications and devices from working, so it is worth testing after the change.
The bottom line
The NCSC’s household guidance treats a smart camera as part of a home network: change default passwords, apply updates, disable remote viewing if it is not needed, and consider disabling UPnP and port forwarding on the router, accepting that some alerts and devices may stop working. It also advises checking how long a device will be supported. Which steps are worth the inconvenience depends on how the camera is used. This is general information, not personalised technical advice.