Securing Broadcast and Zoom technology

[markcrego]

In our Annandale Virginia Stake Center, we have installed the ClearTouch 500 camera, powered by PoE from the network switch, with a fixed IP address of 192.168.108.4, so as to be available to Liahona and Lehi for NDI video transmission and camera control. We have also routed a stereo headphone feed from the headphone jack of the Listen System Unit into the camera's "line in" jack. I am quite impressed with this configuration, the RL500 is an exceptional 4K PTZ camera, supporting NDI, HDMI, and SDI.

I have three security concerns with this configuration:

1. How do you physically secure the camera so that (a) it is not stolen, (b) is not tampered with?

2. How do you secure the PTZ control of the camera? Anyone with a mobile phone can download several PTZ control apps, and after logging into Liahona, can find the camera and control it.

3. How do you secure the A/V NDI output, so that only an authorized Ward Tech Specialist can access the camera feed?

Although I have tried several things, I'm seeking any advice from y'all

thanks,

Mark Crego
Master Technology Architect
Annandale Virginia Stake Technology Specialist

[CalS201]

1. How do you physically secure the camera so that (a) it is not stolen, (b) is not tampered with?

If the church owns the camera then any loss by theft or damage will be covered by insurance.

2. How do you secure the PTZ control of the camera? Anyone with a mobile phone can download several PTZ control apps, and after logging into Liahona, can find the camera and control it.

3. How do you secure the A/V NDI output, so that only an authorized Ward Tech Specialist can access the camera feed?

Keep the camera turned OFF when not in use. When the camera is ON and in use, you can turn off the Liahona wireless network (in CNM) and use the wired LAN connections for your PTZ control and NDI video.


If turning off the Liahona wireless is not a reasonable option then you can install your own wifi router near the church LAN switch. Plug the camera LAN cable into your router's LAN (with a POE injector for camera power), plug your router WAN port into the church LAN switch (where the camera was previously plugged in), and finally - select 1 RJ45 LAN jack somewhere in the bldg as your PTZ/NDI "control location" and move it's LAN cable from the church LAN switch to your router LAN. You can also physically secure the wall jack with any simple RJ45 security lock from Amazon for $10. No one will be able to access your (sub)network from the bldg wireless or wired network!

[garystroble]

Generally, the Church self insures on small dollar property losses.

[russellhltn]

In our Annandale Virginia Stake Center, we have installed the ClearTouch 500 camera, powered by PoE from the network switch,

Where is it being placed? The sites I've seen with the camera has it mounted high enough that it's out of reach without a ladder.

Otherwise, most portable devices have a hole for a Kensington lock (typically used for laptops - it's a hole about the size of a USB-C port). Getting one of those will make walking away with it that much harder. I use that on projectors for overflow when we do stake conference. (Never had a issue, but I don't like leaving temptation.)

[markcrego]

Thanks to y'all for your responses

1. Regarding physical protection:

If the church owns the camera then any loss by theft or damage will be covered by insurance.

Generally, the Church self insures on small dollar property losses.

I understand that the church does take care of property losses, but that, of course, doesn't solve the problem of the period of time when the camera is lost and then replaced. I would like to be a good steward here, and at least discourage the theft or tampering of the equipment.

Where is it being placed? The sites I've seen with the camera has it mounted high enough that it's out of reach without a ladder.

The challenge with this is that the Church's best practice for camera placement is head-level to the person at the pulpit, which is around 9' in most of our buildings. Placing it above typical ladder level renders the video an unnatural viewing experience.

Otherwise, most portable devices have a hole for a Kensington lock (typically used for laptops - it's a hole about the size of a USB-C port). Getting one of those will make walking away with it that much harder. I use that on projectors for overflow when we do stake conference. (Never had a issue, but I don't like leaving temptation.)

That's a great idea -- thanks.

2&3: Regarding Network access protection:

Keep the camera turned OFF when not in use. When the camera is ON and in use, you can turn off the Liahona wireless network (in CNM) and use the wired LAN connections for your PTZ control and NDI video.

not really an option.

If turning off the Liahona wireless is not a reasonable option then you can install your own wifi router near the church LAN switch. Plug the camera LAN cable into your router's LAN (with a POE injector for camera power), plug your router WAN port into the church LAN switch (where the camera was previously plugged in), and finally - select 1 RJ45 LAN jack somewhere in the bldg as your PTZ/NDI "control location" and move it's LAN cable from the church LAN switch to your router LAN. You can also physically secure the wall jack with any simple RJ45 security lock from Amazon for $10. No one will be able to access your (sub)network from the bldg wireless or wired network!

I have thought about this, and have an Edgerouter X from Ubiquity with a separate WAP for this purpose. It definitely works, but I'm a little uncomfortable for two reasons:

1. It involves a double-NAT configuration, with which I've never had a problem, but it's apparently a no-no according to Internet/Intranet best practices.

2. Not sure the Church would approve of setting up a private network. Although my mission president taught me years ago, "It's usually much easier to gain forgiveness than permission," I'm trying to obey the FMG commandments with exactness...

[CalS201]

NDI provides a free suite of programs. One of them is "NDI Access Manager" which appears to provide the security you are looking for. It limits camera video streams and PTZ control signals to ONLY computers you specify.

[russellhltn]

Where is it being placed? The sites I've seen with the camera has it mounted high enough that it's out of reach without a ladder.

The challenge with this is that the Church's best practice for camera placement is head-level to the person at the pulpit, which is around 9' in most of our buildings. Placing it above typical ladder level renders the video an unnatural viewing experience.

As long as it's above "stand on chair" height, I think that's sufficient. Being above the Won door from the back of the chapel would be like balcony seating. Not that unnatural.

[russellhltn]

Where is it being placed? The sites I've seen with the camera has it mounted high enough that it's out of reach without a ladder.

The challenge with this is that the Church's best practice for camera placement is head-level to the person at the pulpit, which is around 9' in most of our buildings. Placing it above typical ladder level renders the video an unnatural viewing experience.

As long as it's above "stand on chair" height, I think that's sufficient. Being above the Won door from the back of the chapel would be like balcony seating. Odd for a local chapel, but we see that all the time in General Conference. Notice how you can see the top of the podium.

[swigginton]

As long as it's above "stand on chair" height, I think that's sufficient. Being above the Won door from the back of the chapel would be like balcony seating. Odd for a local chapel, but we see that all the time in General Conference. Notice how you can see the top of the podium.

Too high is not good either. As we were determining placement for our stake center camera, we considered above the Won Door or suspended from the overflow ceiling. In either case, the view would have been from an angle looking over the podium modesty wall, which could potentially create an uncomfortable view when sisters in skirts were seated on the stand. For our building, 9' above floor level seemed to meet all the requirements.

[Mikerowaved]

Camera placement doesn't have to be a guessing game. Your FM managers have been given instructions as to the proper vertical height range of cameras being mounted in chapels. It should be their installers that do the actual drilling, mounting, and routing of cables, to not only make sure everything conforms to the local building code, but also ensures the whole thing remains aesthetically pleasing.