Store Guard Security · Camera setup
Prepare an RTSP or ONVIF camera
This general guide covers secure preparation for a camera system you own or are authorized to manage. It is not a Store Guard integration walkthrough or a camera compatibility list.
01 · RTSP
Find the real stream details
RTSP controls a media session; the video travels using a separate media transport. Ask the camera or NVR vendor for the exact stream URI, supported transport, and port. Port 554 is the RTSP default, but a device can use a different port or stream path. Do not guess a URL from another model or publish one containing credentials.
- Test the stream only from an authorized device on the camera’s intended network.
- Treat the stream URI, usernames, and passwords as secrets. Use a unique, strong password and a dedicated least-privilege streaming account when supported.
- Use RTSP over TLS for control and HTTPS media transport only when both ends support them. These protect different parts of the session: HTTPS on the settings page or TLS on the RTSP control connection alone does not show that the video itself is encrypted.
- If the stream cannot be encrypted, keep it on a restricted camera network and limit which client addresses can reach it.
02 · ONVIF
Enable only what the system needs
ONVIF profiles describe standardized feature sets; conformance does not establish Store Guard compatibility. Check the exact product and firmware in ONVIF’s database and confirm the needed profile with the camera and client vendors. ONVIF ends new Profile S submissions on March 31, 2027 and recommends Profile T for new deployments where both sides support it. ONVIF also advises moving away from Profile S’s username-token authentication; confirm the supported authentication mode with both vendors.
- Enable ONVIF only when needed; create a separate account with only the required access instead of sharing the camera’s main administrator login.
- Change factory credentials, keep firmware current, disable unused services, and review access logs when the device supports them.
03 · Network and test
Keep camera access contained
- Separate cameras from guest, office, and payment networks with a dedicated VLAN or equivalent firewall controls.
- Block unsolicited internet access and avoid router port forwarding for RTSP or ONVIF. Use the owner’s approved VPN for remote administration.
- For any future evaluation, provide an owner-controlled, non-sensitive test feed and confirm the access path with the system vendor. Do not use a public or customer-facing camera feed as a test.
Sources
These references support protocol and general hardening guidance. They do not verify any camera for Store Guard.