CCTV cameras: single PSU or individual PSUs ?

[Dannyx]

Good day folks. Having installed, or at least dealt with, a modest amount of cameras as part of my current job, I came across one aspect which seems to divide us in two schools of thought: those who suggest that a single PSU run ALL cameras and those who suggest that each camera have its individual power brick. For now, we went with the second option for all our installs, which is messier and takes longer to set up, but offers better redundancy, since if one brick were to fail, the rest would still remain up, whereas with a single supply....well, if it fails, ALL cameras go out. A single supply would be easier to swap out though, because you can just have a busbar where the cameras are connected and then connect that to the PSU.

Aside from that (and possible financial aspects), the main point was picture quality/distortion. One chap suggested having a single PSU run all cameras impacts quality and causes noise on the image, though I haven't tested or witnessed this myself to confirm. He invoked some sort of "impedance mismatch", to replicate his words exactly, but we haven't gone in depth here.
So, any thoughts on this ? Both from personal experience of CCTV guys out there and from an electrical perspective ? Cheers guys.

[CapLeaker]

Re: CCTV cameras: single PSU or individual PSUs ?

I don’t bother with that. I do IP cams with Poe and Cat6.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

A single supply would be easier to swap out though, because you can just have a busbar where the cameras are connected and then connect that to the PSU.

That means you have to power each camera through a longer piece of cable as you now must "extend" the power connection to be of the same length as the "signal" cable. Individual power supplies (or, power supplied to "adjacent" cameras from a shared power supply) lets you (potentially) distribute power over a shorter run.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

I don't bother with that. I do IP cams with Poe and Cat6.

CAT6 is usually overkill for a camera.

[diif]

Re: CCTV cameras: single PSU or individual PSUs ?

A single power source is a single point of failure but using one means you can put the DVR and cameras on a UPS.
12v analogue systems are crap quality, POE IP cams are the way to go, they have a far better picture, only need one wire and can be put on a UPS even easier than 12v systems.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

A single power source is a single point of failure but using one means you can put the DVR and cameras on a UPS.
12v analogue systems are crap quality, POE IP cams are the way to go, they have a far better picture, only need one wire and can be put on a UPS even easier than 12v systems.

PoE switch is a single point of failure... It also gives an adversary a way into your network (not possible with analog cameras) -- even if only to subvert the hardware! (put 120V on camera feed and you'll just toast the video front-end but likely not propagate into the network to which the video interfaces)

OTOH, IP cameras have the added advantage of "having (flexible) smarts". While you can get analog cameras that will do motion detection, signal alarms, etc., you have to manually configure them AT the camera -- instead of "over the wire".

I have cameras and microphones integrated into my overhead loudspeakers (so I can communicate with anyone who is at/around the speaker).

[diif]

Re: CCTV cameras: single PSU or individual PSUs ?

A POE switch inside a network is not a way into a network and whilst it might be a single point of failure it will be many times more reliable than a shitty Chinese 12v supply. I binned loads of supplies in 6 months and also the cameras and DVRs the shitty quality supplies had killed.

I've yet to see a decent picture from any analogue CCTV camera.

[shovenose]

Re: CCTV cameras: single PSU or individual PSUs ?

It's 2019, if you aren't using IP cams with PoE you're doing it wrong.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

A POE switch inside a network is not a way into a network

Sure it is! Does your switch ensure that traffic originating/destined for that camera (PD) can't, instead, access other devices connected to other ports on the switch? I.e., can you unplug the switch end of the drop that services the camera (which is something an adversary could readily do) and plug in something ELSE to that port on the switch and ENSURE the switch won't let that "something else" access any other devices reachable from that switch?

How are you preventing this from happening, given that the camera is likely in a place where it can be accessed by adversaries (e.g., outside your home/business)?

Take an unused port on your router (or switch) and run it to a jack out by your front door and convince us that the other devices on your network (inside your home) are INACCESSIBLE to a casual user walking up with a laptop and connecting to that jack. I.e., you should be willing to put an unpatched MS OS on that internal network without fear that a passerby could hack it -- because the FABRIC would prevent such access.

Hint: I have two dozen (or more) external "drops" that you can walk up to day or night and attempt to do this. ALL of your traffic will be blocked from entering the switch. Additionally, traffic from the "legitimate" device expected to use each of those drops is constrained to only flow to its intended nodes -- so, even a misbehaving (i.e., HACKED) device can't talk to anything "unauthorized".

Extra credit: what happens if someone touches the business end of a Tesla coil to one of your "exposed" drops?

[stj]

Re: CCTV cameras: single PSU or individual PSUs ?

long 12v cable runs will suffer from volt-drop.
something else to think about.

[CapLeaker]

Re: CCTV cameras: single PSU or individual PSUs ?

There are alarms that monitor tampering, loss of signal etc. That is not an issue either. The IP Cams are on a separate network altogether. I also can inject DC to the IP CAM if I wanted to. The PSU's in my NVR's are at least 50% bigger than needed for various reasons. I run CAT6 because some of my runs are waay longer than they should be, plus they are direct burial. The price difference isn't that big anymore either between CAT5e and CAT6.
At the end of the day, if the PSU fails on the NVR, none of the systems are working.

[diif]

Re: CCTV cameras: single PSU or individual PSUs ?

Sure it is! Does your switch ensure that traffic originating/destined for that camera (PD) can't, instead, access other devices connected to other ports on the switch? I.e., can you unplug the switch end of the drop that services the camera (which is something an adversary could readily do) and plug in something ELSE to that port on the switch and ENSURE the switch won't let that "something else" access any other devices reachable from that switch?

How are you preventing this from happening, given that the camera is likely in a place where it can be accessed by adversaries (e.g., outside your home/business)?

Take an unused port on your router (or switch) and run it to a jack out by your front door and convince us that the other devices on your network (inside your home) are INACCESSIBLE to a casual user walking up with a laptop and connecting to that jack. I.e., you should be willing to put an unpatched MS OS on that internal network without fear that a passerby could hack it -- because the FABRIC would prevent such access.

Hint: I have two dozen (or more) external "drops" that you can walk up to day or night and attempt to do this. ALL of your traffic will be blocked from entering the switch. Additionally, traffic from the "legitimate" device expected to use each of those drops is constrained to only flow to its intended nodes -- so, even a misbehaving (i.e., HACKED) device can't talk to anything "unauthorized".

Extra credit: what happens if someone touches the business end of a Tesla coil to one of your "exposed" drops?

If it's not accessible from the outside, how is it a way in ?

You need to stop the abuse of punctuation marks and random capitalisation , it makes your bloviation particularity hard to read.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

If it's not accessible from the outside, how is it a way in ?

I suspect many of your cameras look OUT to surveil the environs of your property (yard, driveway, entryways, etc. All of those are accessible "from the outside". Or, do you ignore the exterior and concentrate your cameras on surveilling the INDOORS? Keep track of who's in your living room, kitchen, etc.?

An analog camera mounted outdoors doesn't present a security risk to your network (read my post, moron). An adversary can disable the camera or, if clever, effectively render it disabled by feeding canned video through its analog signal cable. But, the extent of his attack is limited to the loss of that signal feed.

Running a WIRED network connection to an accessible point (VoIP camera) is WORSE than running a WIRELESS device.

You need to stop the abuse of punctuation marks and random capitalisation , it makes your bloviation particularity hard to read.

You need to learn how to READ! (see above) It's not MY fault that I know so much more than you -- better education, more opportunities/experience, etc.; how should I be held accountable for YOUR stupidity?

[Spend a few years in a red/purple/blue environment or actively doing PenTest; you'll be amused at how many of your beliefs are flat out baseless!]

Now, you can go sulk as you consider how *my* "outdoor accessible" drops CAN'T be used to subvert my network. It should be a FUN challenge for you and a chance to stop inhaling flux vapors for a few moments...

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

There are alarms that monitor tampering, loss of signal etc. That is not an issue either.

Don't be lulled into thinking that. A motivated attacker can sync to your camera's (analog or IP) output and seemlessly swap over to injecting an emulated signal. You can try to minimize the ability to do this by, for example, keeping the camera in motion -- but, that just means the emulated signal has to emulate that motion!

[Present day attackers won't be sufficiently motivated to attack Joe Consumer -- until someone releases an attack kit that explicitly addresses that market! The same is not true of high dollar installations]

My "door camera" uses facial recognition and voice recognition to identify (and optionally ADMIT!) friends/colleagues. To avoid "playback" exploits (i.e., presenting a prerecorded image/audio of the "authorized" visitor's face/voice to trick the door cam into believing you're him), mine "interviews" the visitor in much the same way that a real person would (so the visitor doesn't FEEL like they are being authenticated).

This lets me verify eyes blink, mouth moves, etc. And, that the responses elicited are appropriate and current (and cant be anticipated in preparing a recording!). I even change the "voice" that is used in that dialog so an attacker can't AS EASILY recognize what is being said/asked to adjust his responses.

The IP Cams are on a separate network altogether.

Does THAT network talk to any other networked devices? I.e., how do you view the video -- do you have to position yourself at a particular "viewing station"? Chances are, you can view (and store) that video on "other devices" with relative ease -- that same convenience is what allows exploitation.

I also can inject DC to the IP CAM if I wanted to. The PSU's in my NVR's are at least 50% bigger than needed for various reasons.

That's not the point. Can I put 5KV on the "data" conductors? Under that condition, will the insulation break down and interfere with other cables run ALONGSIDE the network cable for that camera as it makes its way to its switch? Will the port on the switch fail? (how easily/quickly will the owner be able to get that fixed?) Will the failure propagate within the switch to include other parts of the switch?

[Put on the "other hat" and ask yourself how YOU -- acting in a purple role -- would subvert your own installation. There is ALWAYS a way! You have to just keep raising the amount of effort until it causes an attacker to look elsewhere -- preferably other HOMES! -- for vulnerabilities. But, remember, folks share exploits so once someone figures out a hack, you can assume that all interested parties will also have that hack!]

I run CAT6 because some of my runs are waay longer than they should be, plus they are direct burial. The price difference isn't that big anymore either between CAT5e and CAT6.

My runs are all indoors so very few "long, straight runs" (through walls, around corners, etc.). As a result, the relative rigidity of CAT6 is a real PITA to route -- it's hard enough not to kink CAT5e!

At the end of the day, if the PSU fails on the NVR, none of the systems are working.

IP cameras have the advantage that a redundant, secondary "recorder" can pick up the responsibility lost by the "primary". An IP camera can also be designed to integrate other functionality to enhance security or provide a more robust implementation.

You can backup (power) your stuff. But, an adversary can just wait out your backup capacity after pulling your breaker (assuming that can be accessed -- common in this part of the country). Are you really going to cut your vacation short and rush home just to address an "equipment failure"?

[Dannyx]

Re: CCTV cameras: single PSU or individual PSUs ?

Well....this escalated quickly I didn't have time to check up on this post since I was busy with, ironically enough, installing cameras so I was surprised to see the amount of replies and "opinions"

Now then, this seems to have become more of an "IP cams vs AHDs" than a discussion about common/separate PSUs
TBH, I too would go with IP cams whenever possible, purely due to convenience and some of the advanced features they offer - valid point. As noted by someone, there's no real risk of hacking your average Joe out of their cameras, not even in the more "high-risk" environments where the boys have done installs before. At the end of the day however, it's the client's decision agreed upon with our management, so we just install whatever is provided to us, even though we might be discussing what stuff WOULD'VE been better among ourselves AS we're doing the actual install at the premises

Just today, we finished replacing some "regular" analog cameras with....analog cameras ? Yeah...AHD cameras with WAY better picture quality, which is what it all boils down to, but still "analog" by definition. They were powered in sets of 4 by a couple of power supplies scattered around the compound. They also ran a single loop of FTP cable for 4 cameras, so each got a color pair, which is economically viable, but makes powering from the same place as the DVR impossible, hence why they chose to go with remote PSUs....we had no choice but to preserve these, so we now have a set of cameras powered by a single PSU, and another set powered by a second PSU, so it's right in-between the situation I described: not quite separate, but not quite everything in parallel on the same supply either.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

TBH, I too would go with IP cams whenever possible, purely due to convenience and some of the advanced features they offer - valid point. As noted by someone, there's no real risk of hacking your average Joe out of their cameras, not even in the more "high-risk" environments where the boys have done installs before. At the end of the day however, it's the client's decision agreed upon with our management, so we just install whatever is provided to us, even though we might be discussing what stuff WOULD'VE been better among ourselves AS we're doing the actual install at the premises

IME, there are usually many "nontechnical" issues that influence these decisions in disproportionate ways.

For example, I installed a four (analog) camera with DVR in a small storefront, yesterday. The DVR was "on hand" as were the analog cameras.

Similarly, I'll be installing an eight (analog) camera DVR in their warehouse area next week -- cuz the DVR was "on hand" and cameras will be easy to acquire.

This despite having a box of IP PoE PTZ cameras that I could have used for either application. (the folks who will eventually maintain/troubleshoot these can more readily relate to a broken video cable/power supply than to a failure to properly negotiate a DHCP lease, etc.)

Understanding your customer (instead of pie-in-the-sky, elitist techocracy) is the key to successful deployments.

["These are the pros and cons. My recommendation is ____ but the decision is yours -- as are the consequences!"]

[diif]

Re: CCTV cameras: single PSU or individual PSUs ?

I suspect many of your cameras look OUT to surveil the environs of your property (yard, driveway, entryways, etc. All of those are accessible "from the outside". Or, do you ignore the exterior and concentrate your cameras on surveilling the INDOORS? Keep track of who's in your living room, kitchen, etc.?

An analog camera mounted outdoors doesn't present a security risk to your network (read my post, moron). An adversary can disable the camera or, if clever, effectively render it disabled by feeding canned video through its analog signal cable. But, the extent of his attack is limited to the loss of that signal feed.

Running a WIRED network connection to an accessible point (VoIP camera) is WORSE than running a WIRELESS device.



You need to learn how to READ! (see above) It's not MY fault that I know so much more than you -- better education, more opportunities/experience, etc.; how should I be held accountable for YOUR stupidity?

[Spend a few years in a red/purple/blue environment or actively doing PenTest; you'll be amused at how many of your beliefs are flat out baseless!]

Now, you can go sulk as you consider how *my* "outdoor accessible" drops CAN'T be used to subvert my network. It should be a FUN challenge for you and a chance to stop inhaling flux vapors for a few moments...

Still bloviating, and your incorrect and over use of punctuation and grammar suggests otherwise, it just highlights you arrogance.

[Curious.George]

Re: CCTV cameras: single PSU or individual PSUs ?

Still bloviating, and your incorrect and over use of punctuation and grammar suggests otherwise, it just highlights you arrogance.

Ah, yes... ad hominem attacks. When the technical nature of the discussion exceeds your level of ignorance. A sure sign of the inept and incompetent.

Bwahahahaha....

Moron.

[Dannyx]

Re: CCTV cameras: single PSU or individual PSUs ?

Oooookk...moving right along

Today we fired up the cameras we installed the last two days. They look.....unimpressive for lack of a better word. It's obviously an improvement over the previous system, but you'd expect better from a 5mp camera. Most notably, there seem to be vertical "hum bars" on some of them and some even flash white speckles every now and then. It could be the new power boxes we installed, combined with the relatively long cable runs which carry 4 video signals at once (one on each pair)...we usually don't do it like this (we run individual cables for each camera), but the system was already in place so we had to use it, as it was too expensive/difficult to run new wires.

Funny thing is that the original PSU boxes are MeanWells which are not that bad a brand apparently and they also support a backup SLA, so in reality all we would've had to do there was install a battery in them and we were set, but whoever was in charge also (more ore less) shoved these replacement boxes down their throat as well, which I'm not sure how well stack up against the MWs. I suggested leaving the MWs in place, but I was told the "Videomatix" boxes were already paid for, so we had to use them no matter what...even if we just plug them in so the green LED turns on for the average Joes to see I must admit I kinda hate mediocrity like this which verges on being a rip-off, but then again I'm a perfectionist, so it's expected...maybe it's a defect...:|

[CapLeaker]

Re: CCTV cameras: single PSU or individual PSUs ?

Something is „defect“ all right.