Risks of default password in IoT devices (CCTV) and how to make them more secure

AZ

AZ

25

The proliferation of Internet of Things (IOT) devices has led to unprecedented levels of convenience and connectivity, but it has also brought significant cybersecurity challenges. One of the most common security risks associated with IOT devices is default passwords, which can make them vulnerable to a wide range of attacks and exploits. CCTV cameras, in particular, are highly susceptible to security breaches due to default passwords. This study aims to identify the risks associated with default passwords in CCTV cameras and explore how these risks can be mitigated. To achieve this, qualitative research using a case study approach was conducted. The data was collected through interviews with security experts, manufacturers, and users of CCTV cameras, and analyzed using thematic analysis. The study identified the common vulnerabilities and security risks associated with default passwords in CCTV cameras, current password policies and authentication protocols used in CCTV cameras, and the best practices for mitigating the risks associated with default passwords in CCTV cameras. The findings of this study have several implications for the field of IOT security, providing a comprehensive understanding of the risks associated with default passwords in IOT devices, identifying the best practices for mitigating these risks, and contributing to the broader discourse on IOT security. Ultimately, this study seeks to enhance the safety and privacy of individuals and organizations who use IOT devices and promote the responsible and ethical use of technology.

Keywords: (IOT security, Default passwords, CCTV cameras, Vulnerabilities Authentication protocols, Password policies)

The emergence of Internet of Things (IOT) devices has brought about a significant transformation in our daily lives, work, and technology interaction. With IOT devices ranging from smart homes, wearable gadgets, industrial control systems, and medical devices, we have witnessed a remarkable level of convenience, efficiency, and interconnectivity. These devices have enabled us to perform tasks effortlessly and stay connected with the world around us like never before. The proliferation of IOT devices has revolutionized the way we live, work, and interact with technology, making our lives more comfortable, productive, and enjoyable (Piza et al., 2019).

The Internet of Things (IOT) is a network of physical devices that collect and exchange data over the internet. However, IOT devices are vulnerable to hacking and cyber-attacks due to weak security features. Concerns over the safety of IOT devices have, ineluctably, opened the door to both targeted and widespread attacks for some time now. The vast majority of these attacks originate from quite fundamental security weaknesses, such as reusing the same password across many services. Incorrect access control, Overly large attack surface, Outdated software, Application vulnerabilities, Lack of Trusted Execution Environment. However, one of the major challenges facing the IOT is security, particularly the use of default passwords in IOT devices, such as "CCTV" which can be easily guessed by attackers. This can lead to theft of personal information, financial loss, and even physical harm. Additionally, data generated by IOT devices can be misused, violating privacy and personal rights. A security breach in one device can potentially compromise the security of an entire network, causing widespread damage (Arsyad et al., 2023).

The problem statement outlines the security risks associated with default passwords in IOT devices, particularly CCTV cameras. The proliferation of IOT devices has brought about unprecedented convenience, efficiency, and connectivity, but these devices are often designed with limited attention to security. This makes them vulnerable to a wide range of attacks and exploits, which can compromise the safety and privacy of individuals and organizations who use them. One of the most common security risks associated with IOT devices is default passwords. Default passwords are often weak, predictable, and shared among multiple devices, making them vulnerable to attacks and exploits. This is particularly true for CCTV cameras, which are widely used for surveillance in homes, businesses, and public spaces. Default passwords in CCTV cameras are often easily guessable or widely known, making it easy for attackers to gain access to the cameras and use them for malicious purposes, such as spying on individuals or launching DDOS attacks. The study aims to identify the risks associated with default passwords in CCTV cameras and explore how these risks can be mitigated. The study will examine the vulnerabilities and security risks associated with default passwords in CCTV cameras, the current password policies and authentication protocols used in CCTV cameras, and the best practices for mitigating the risks associated with default passwords in CCTV cameras (Moyo, 2019). By examining these aspects, the study seeks to inform the development of more effective security measures, guide the development of password policies and authentication protocols, and contribute to the broader discourse on IOT security. The findings of the study will have several implications for the field of IOT security, including promoting the responsible and ethical use of technology, enhancing the safety and privacy of individuals and organizations who use IOT devices, and helping to identify key vulnerabilities and security risks associated with default passwords in IOT devices. Overall, the problem statement highlights the importance of addressing the security risks associated with default passwords in IOT devices, particularly CCTV cameras. The study seeks to provide valuable insights into these risks and identify effective strategies for mitigating them, ultimately contributing to the development of more secure and reliable IOT devices.

This research study focuses on investigating the vulnerabilities and security risks associated with default passwords in CCTV cameras. The study aims to answer three main research questions:

· What are the common vulnerabilities and security risks associated with default passwords in CCTV cameras? The first research question seeks to identify the common vulnerabilities and security risks associated with the use of default passwords in CCTV cameras. This includes exploring the potential for unauthorized access, data breaches, and other security threats that can arise when default passwords are not changed.

· What are the current password policies and authentication protocols used in CCTV cameras? The second research question aims to understand the current password policies and authentication protocols used in CCTV cameras. This includes exploring the extent to which manufacturers enforce password policies, and the effectiveness of authentication protocols in preventing unauthorized access.

· What are the best practices for mitigating the risks associated with default passwords in CCTV cameras? The third research question seeks to identify the best practices for mitigating the risks associated with default passwords in CCTV cameras. This includes exploring the effectiveness of password management strategies, such as password rotation and complexity requirements, and the potential for other security measures, such as multi-factor authentication.

By answering these research questions, the study aims to provide insights and recommendations for improving the security of CCTV cameras and mitigating the risks associated with default passwords. This information can be used to inform policy and practice in the design, implementation, and management of CCTV camera systems.

This research study has a clear aim and objectives to investigate the specific security risks and vulnerabilities associated with default passwords in CCTV cameras. The objectives are to examine the current password policies and authentication protocols used in CCTV cameras, identify best practices for mitigating the risks associated with default passwords in CCTV cameras, provide recommendations for improving password policies and authentication protocols in CCTV cameras, in order to enhance the security of these devices, and contribute to the broader discourse on IOT security, by highlighting the specific risks associated with default passwords in IOT devices and the need for more collaborative and interdisciplinary approaches to addressing these risks.

By achieving these objectives, this research aims to provide valuable insights into the risks associated with default passwords in IOT devices, particularly CCTV cameras, and to inform the developers of CCTV cameras of the more effective security measures for these devices, and also to understand the user perspective to measure their opinion and awareness regarding using password in CCTV cameras. Ultimately, this research seeks to enhance the safety and privacy of individuals and organizations who use IOT devices and promote the responsible and ethical use of technology.

The research structure of this study consists of six main sections. In the introduction, the background of the study is presented, followed by the problem statement, research questions, objectives, significance of the study, and structure of the study. The literature review provides an overview of IOT and CCTV cameras, CCTV advantages, password policies, and authentication protocols in IOT devices and CCTV cameras, security risks associated with IOT devices and default passwords, preconfigured passwords, and promoting awareness and regulation. The methodology section outlines the research approach and design, data collection methods, sample selection and recruitment, and data analysis procedures. The results and findings section provides an overview of the data collected, a summary of the findings for each research question, and a discussion of the implications of the findings. The conclusion and recommendations section summarizes the study, draws conclusions from the research, provides recommendations for improving password policies and authentication protocols in CCTV cameras, and discusses the limitations of the study and directions for future research. The references section lists the sources cited in the study, while the appendices include interview questions, consent forms, and additional data or information that supports the study. Overall, this research structure provides a comprehensive overview of the study's methods, findings, and recommendations.

It is only easy to conceive of a future with the Online platform and the Internet of Things (IOT). These gadgets have developed the ability to be a part of our day-to-day lifestyles when the number of linked devices is continuously growing. It is not unheard of for us to have a wearable device, a linked refrigerator, a sophisticated automobile, surveillance cameras and networks that we can manage from our smartphone, and a vacuum pump that understands the architecture of our house so that it can sanitize it while we are away from it. In addition, the Internet of Things has also made its way into vital facilities (Shin et al., 2019).

In current history, gadgets linked to the Internet of Things (IOT) have become more prevalent in our daily lives. This phenomenon is known as the "Internet of Things." One Internet of Things (IOT) innovation most regularly observed in use nowadays is residential surveillance webcams. These recording devices are sometimes called closed-circuit televisions (CCTV). Nonetheless, the lack of proper safety precautions, like relying on preset credentials, is a major contributor to the significant problems with gadgets connected to the Internet of Things (IOT). Since the initial certificates on devices are famously easy to crack, there is a greater likelihood that thieves would attempt to access such gadgets. This research aims to evaluate the identification methods utilized in Surveillance cameras, the prevalence of preset credentials, and the most effective methods for securing Surveillance cameras from being hacked by corrupt individuals (Shin et al., 2019).

The inadvertent usage of IOT devices, failure to regularly change credentials, and inability to install software upgrades have all contributed to a rise in cyberattacks and entry for harmful programs to critical material. Using such ineffective privacy methods increases the likelihood of an information leak and other attacks. The Internet of Things (IOT) is often regarded among protection experts as the most susceptible target for digital assaults owing to inadequate security measures and standards. Although many different security techniques have been established to defend Internet of Things gadgets from intrusions, privacy policies still need to be well defined. Consumers could not employ precautionary procedures to keep their property from being attacked. Since the beginning of 2008, cybercriminals have created several forms of the virus to infiltrate various Internet of Things gadgets. They developed different cybercrime strategies to convince people or workers to provide critical information (Piza et al., 2019).

In current history, there has been an uptick in demand for various kinds of surveillance equipment. These technologies are being used by state and individual enterprises, domestic communities, business and civic places, and other locations to monitor various activities for protection and well-being. Both "sur" and "veiller" imply "to watch" in French. "sur" means "upwards," while "veiller" indicates "to observe." Watching someone's actions, actions, and conduct in an attempt to govern, supervise, and protect them is what we mean when we talk about surveillance. The ability to do distant and ongoing inspections is a benefit offered by surveillance equipment. The innovation of CCTV devices, often known as CCTV, is being used so that events may be seen while taking place and that actions can be monitored in any location later. Since the number of break-ins and other criminal acts continues to rise, installing CCTV cameras for surveillance is becoming more necessary in both the business and residential spheres (Lau & Tan).

Various CCTV cameras are accessible, including those that do not use the Internet Protocol (IP), IP CCTV cameras, and cordless Surveillance cameras. IP-based wireless Security cameras are becoming more popular in the modern world for various reasons, including their technological advantages, versatility, user-friendliness, and cost-effectiveness. The industry for Surveillance cameras is rapidly growing due to the widespread usage of the technology in various sectors around the globe. The Internet of Things has the advantage of providing a fresh appearance for the next generation of CCTV cameras. There is a requirement for webcams that can automatically recognize odd occurrences and translate that information to other systems so that appropriate measures may be taken (Lau & Tan). This eliminates the need to record film and then view it later to identify instances of robbery, aggression, or damage. In response to this demand, camera manufacturers are incorporating cutting-edge technology into their products to make them more intelligent. Smart cameras have taken advantage of the advantages of computer vision, computer learning, and mechanization. The Internet of Things (IOT) allows linking network-enabled webcams to other gadgets and structures, transforming traditional surveillance monitoring into more advanced, intelligent security CCTV. CCTV cameras find widespread use in various cyber systems, including those concerned with public security, universal health care, transport monitoring, animal observation, ecological tracking, and meteorological prediction. A wide variety of designs and capabilities are accessible for security footage in CCTV. Sensors, a broadcaster, a storage facility, a microcontroller, and an external power supply are the components that make up a cordless CCTV source node. The fundamental operations carried out by each network are image reduction, file transfer, and visual capture. In footage monitoring systems, one of the most difficult challenges is handling a considerable percentage of visual data without compromising the integrity of the documentation or the system's safety. The records running module and the information propagation unit at each Wi-Fi device are responsible for this (Lau & Tan).

IOT devices and CCTV cameras have become increasingly popular and a common part of our daily lives. However, as these devices become more interconnected and integrated into our lives, the risk of unauthorized access and data breaches increases. Password policies and authentication protocols play a critical role in securing these devices and protecting the data they collect. Password policies refer to the rules and guidelines that govern the use of passwords. These policies dictate the strength and complexity of passwords, the frequency with which they must be changed, and other related factors. Strong password policies can help prevent unauthorized access to IOT devices and CCTV cameras. They can also help protect against brute-force attacks, where hackers use automated tools to try and guess passwords. Authentication protocols, on the other hand, refer to the methods used to verify the identity of users and devices. These protocols include various methods such as biometric authentication, two-factor authentication, and certificate-based authentication. These protocols ensure that only authorized users and devices can access the IOT devices and CCTV cameras. It is important to note that while password policies and authentication protocols are critical in securing IOT devices and CCTV cameras, they are not foolproof. Hackers can still find ways to bypass these security measures, and it is essential to stay vigilant and keep up with the latest security practices and updates. In conclusion, password policies and authentication protocols are crucial in securing IOT devices and CCTV cameras. Strong password policies and robust authentication protocols can help prevent unauthorized access and protect against data breaches. However, it is important to stay informed and keep up with the latest security practices to stay ahead of potential threats (Anshari et al., 2021, July).

The increased use of Closed-circuit television (CCTV) has raised concerns about personal confidentiality. The continual monitoring and recording of communal settings may make some users uneasy, and CCTV video risks being used for illegal purposes such as harassment or extortion. To avoid abuse by authorities and corporations, surveillance cameras must be utilized to respect individuals' confidentiality, and there must be stringent laws in place (Ko & Song, 2021). CCTV cameras are often linked to the internet, making them vulnerable to various forms of cyber-attacks such as phishing. It is crucial to guarantee the safety of CCTV and utilize robust credentials in conjunction with encrypted software to prevent unauthorized access(Ko & Song, 2021). CCTV cameras must follow a wide variety of legislation and policies, including those about confidentiality, security, and civil dignity to avoid fines and tarnishing the image of a business or entity (Ko & Song, 2021). Insufficient video exposure is also a concern, as CCTV networks must be built and deployed to offer appropriate video surveillance to catch all of the critical behavior in a region. Limited surveillance may lead to blind zones, where illegal acts may occur without being seen on video (Ko & Song, 2021).

Finally, employing a predefined passcode for CCTV can represent a significant potential threat since it opens the equipment to the possibility of being hacked and providing entry to unwanted users. Cybercriminals can gain entry to all webcams in a system if the devices have the same predefined credentials, compromising the entire system (Piza, 2018).

The following table summarizes the available information on various surveillance equipment brands and their features, access controls, types of passwords accepted, and recommendations for users to enhance the security of their systems. Hikvision (CCTVdirect, 2022), Dahua (CCTVdirect, 2022), Uniview (Li et al., 2019), and Samsung Techwin (Matuszek, 2020), all advise using secure and complicated credentials to protect their surveillance equipment, while Swann (Henderson et al., 2018) does not do identity management but suggests using sophisticated credentials for safety. Lorex (Khan et al., 2022) and Axis (Kalbo et al., 2020) recommends using rugged credentials for its surveillance equipment, especially Closed-circuit television. All brands, except for Hikam (Subarsyah, 2022), suggest that users should be able to change their passwords on a regular basis to enhance the security of the system. For Hikam, it is recommended that users should contact Hikam support to inquire about password-changing options and follow their advice. In terms of awareness, all brands suggest that users should be made aware of the importance of using strong and/or rugged, complicated credentials and changing passwords regularly to reduce the risk of unauthorized access and data breaches.

By looking at the results in Figure 1, the access controls used by each brand, we can see that all of them have some form of account administration to manage user identities, allocate responsibilities and privileges, and define authentication rules. Additionally, 50% of the brands offer digital certificate, chip, and face identification authorization solutions to enhance security. 25% of brands uses slot reviewers, which are micro SD devices that permit or deny entry depending on a verified admission code. 100% of brands allow the cancellation of stolen or lost credentials. Also 100% of brands have entrance processors that can use chip cards and secure regulation systems. They also offer streaming and taped recordings, webcam adjustments, and gesture recognition notifications. Location tracking is available for remote monitoring of property. 12.5% of brands offer authentication solutions which are designed to be adaptable, while 100% of brands offer visual confirmation. Overall, the data highlights the importance of having robust access controls to secure CCTV camera systems. The use of account administration, digital certificates, and other forms of authentication can help prevent unauthorized access. The availability of entrance processors, slot reviewers, and cancellation of stolen or lost credentials can further enhance security. Finally, the ability to stream and record footage, adjust webcams, and use location tracking can provide additional layers of protection and peace of mind for users.

By looking at the results in Figure 2, from the data, we can see that there is variation in the types of passwords used by the different brands. 12.5% primarily uses complicated and essential passwords, while 12.5% does not stipulate a certain level of password complexity. 25% suggest the use of rugged credentials, while 25% recommend the use of rugged and robust credentials. And 12.5% suggest using sophisticated credentials for safety. 12.5% uses complicated credentials for device protection, while 12.5 recommends secure and complicated credentials for memberships. It is worth noting that 12.5% do not specify a certain level of password complexity, which may leave their devices vulnerable to attacks. Furthermore, 12.5% may recommend the use of strong and robust passwords, but it is ultimately up to the users to follow these recommendations and ensure that their passwords are secure. Overall, the data highlights the importance of considering the password policies of different brands when selecting a CCTV camera, and the need for users to be aware of the importance of using strong and secure passwords to enhance system security.

The use of Internet of Things (IOT) devices, particularly surveillance cameras, has become widespread, and their security has become a significant concern due to the lack of proper safety precautions, like relying on preset credentials. The inadvertent usage of IOT devices, failure to regularly change credentials, and inability to install software upgrades have all contributed to a rise in cyberattacks and entry for harmful programs to critical material. This research paper aimed to evaluate the identification methods utilized in Surveillance cameras, the prevalence of preset credentials, and the most effective methods for securing Surveillance cameras from being hacked by corrupt individuals. Furthermore, the advantages of CCTV cameras were discussed, including their technological advancements, versatility, user-friendliness, and cost-effectiveness. The Internet of Things has provided a fresh appearance for the next generation of CCTV cameras, and there is a requirement for webcams that can automatically recognize odd occurrences and translate that information to other systems so that appropriate measures may be taken. Finally, password policies and authentication protocols play a critical role in securing these devices. The lack of well-defined privacy policies and standards in IOT devices makes them the most susceptible target for digital assaults. Thus, consumers and manufacturers must employ precautionary procedures to keep their property from being attacked.

The central question that this Interview aims to answer is: "What is the level of awareness among CCTV users about the importance of changing and using complex passwords?" This research question will guide the development of the interview questions, the selection of participants, and the analysis of the data. The goal of the study is to gain a better understanding of CCTV users' perspectives and experiences related to password security, and to identify potential areas for intervention or policy development to promote better password practices among CCTV users.

We selected a purposive sample of CCTV users who have experience using passwords to access their CCTV systems. Purposive sampling is a non-random sampling strategy used in research, where the researcher selects participants based on specific criteria that are relevant to the research question. In this case, we selected participants who have experience using passwords to access their CCTV systems, as this is relevant to our research question on password security for CCTV cameras. Purposive sampling allowed us to select participants who are most likely to provide relevant and useful information for our study, as they have experience with the specific topic we are investigating. While purposive sampling may limit the generalizability of our findings to the broader population of CCTV users, it allows us to focus specifically on the topic of interest and obtain in-depth information from participants who have relevant experience (Braun & Clarke, 2020).

The data collection process for this study involved gathering information from selected participants using a semi-structured interview guide that included open-ended questions about CCTV users' awareness and practices of changing and using complex passwords. The following steps were taken to collect the data: Firstly, participants were recruited using purposive sampling strategy, and once a sample was selected, participants were invited to participate in the study. They were given information about the study's purpose, the interview process, and their rights as participants. Secondly, before the interview began, participants were asked to sign an informed consent form that explained the study's purpose and procedures, their rights as participants, and the confidentiality of their responses. Thirdly, the interview was conducted using a semi-structured interview guide that included open-ended questions about the CCTV users' awareness and practices of changing and using complex passwords. The interview was conducted in person or over the phone, and detailed notes were taken during the interview. Fourthly, follow-up questions were asked to clarify the participants' responses or to explore a topic in more detail. Fifthly, the data collected during the interviews were stored securely and confidentially, and the audio recordings were transcribed verbatim. Sixthly, the transcribed data were analyzed using a qualitative analysis approach, where the data were coded, categorized, and themes were identified. Two or more researchers conducted the analysis to increase reliability. Lastly, participants were asked to review and verify the accuracy of the transcripts to ensure that the findings accurately reflected their perspectives. By following these steps, the study was able to gather in-depth information on CCTV users' awareness and practices of changing and using complex passwords (Creswell & Poth, 2017b).

The sample size for this study was determined using a power analysis that took into account the expected effect size, significance level, and power of the study. Based on the power analysis, a sample size of 10-30 participants was recommended (Morse, 2015).

To select the sample, a systematic sampling strategy will be used to select the individuals that will comprise the sample. Where we will choose elements from a target population by selecting a random starting point and selecting sample members after a fixed sampling interval. Systematic sampling is preferred over random sampling because the relevant data does not exhibit patterns, and we are at low risk of data manipulation that will result in poor data quality (Morse, 2015).

The goal of systematic sampling was to obtain a representative sample of CCTV users who had experience using passwords to access their CCTV systems (Morse, 2015).

Once the sample was selected, participants were contacted and invited to participate in the study. The sample size of 10-30 participants was considered sufficient to obtain a range of perspectives on the research question and to provide a reliable estimate of the level of awareness among CCTV users about the importance of changing and using complex passwords (Morse, 2015).

In interview research, variables can be categorized into two main types: independent variables and dependent variables. These variables help to frame the research questions, guide the interview process, and analyze the data. Here's a breakdown of these two types of variables in the context of interview research, independent variables are the factors or conditions that researchers manipulate or control in order to examine their impact on the dependent variable. In interview research, independent variables are often used to explore how certain factors influence participants' responses or experiences. Examples of independent variables in interview research include, demographic variables (Age, gender), socioeconomic variables (Income, occupation, social status), environmental variables (Physical setting, cultural context, organizational structure), Experiential variables (Previous experiences, exposure to certain conditions). Where Dependent variables are the outcomes or responses that researchers are interested in understanding or explaining. They are influenced by the independent variables and are often the focus of analysis in interview research. Dependent variables can vary depending on the research objectives and the specific topic under investigation. Examples of dependent variables in interview research include Attitudes and beliefs (Participants' opinions, perspectives, or values on a particular subject). Knowledge and understanding (Participants' level of knowledge or understanding about a topic). Behaviors and practices (Participants' actions, behaviors, or practices related to a specific area of interest). Emotional responses (Participants' feelings, emotions, or reactions to certain situations or stimuli) (Leech & Onwuegbuzie, 2011).

It's important to note that in qualitative research, variables are often not as clearly defined or easily quantifiable as in quantitative research. Qualitative research focuses on exploring complex phenomena, understanding individual experiences, and capturing the richness and depth of participants' perspectives. Therefore, the variables in interview research are often more nuanced and context-specific, and they may emerge and evolve during the research process itself (Leech & Onwuegbuzie, 2011).

According to our research the types of the variables that will be used are as following table 2:

We will use a qualitative analysis approach. Regarding choosing the best approach to qualitative analysis, thematic analysis is a good approach to choose where we are trying to find out something about people’s views, opinions, knowledge, experiences or values from a set of interview transcripts. Thematic analysis allows us a lot of flexibility in interpreting the data and allows us to approach large data sets more easily by sorting them into broad themes. This involves coding, categorizing, and identifying themes in the data collected from the semi-structured interviews. The interviews were designed to elicit information about the participants' awareness and practices of changing and using complex passwords, and the open-ended questions allowed for a detailed exploration of their experiences and perspectives. The qualitative analysis approach involves several steps, including Firstly, transcribed the audio recordings of the interviews verbatim to create a written record of the participants' responses. Secondly, coded the data, which involves labeling each segment of text with a descriptive term or category that captures its meaning. This helps to organize the data and identify patterns and themes. Thirdly, categories the coded segments of text then organized into categories based on their similarities and differences. This helps to identify broader patterns and themes in the data. Fourthly, analyzed the categories to identify overarching themes that emerge from the data. This involves looking for patterns and connections between the categories to identify the key themes that are relevant to the research question. Finally, the themes are interpreted in relation to the research question to draw conclusions about the level of awareness among CCTV users about the importance of changing and using complex passwords (O’Reilly & Parker, 2013).

Regarding the tool that will be used in analyzing the data, one of the most widely used, NVIVO is a software program used for qualitative and mixed-methods research. Specifically, it is used for the analysis of unstructured text, audio, video, and image data, including interviews, which will be suitable for our data.

Several measures were taken to validate the results. These measures include firstly, Before the interview began, participants were asked to sign an informed consent form that explained the study's purpose and procedures, their rights as participants, and the confidentiality of their responses. This ensured that participants understood the study's purpose and procedures and were willing to participate. Secondly, Before conducting the main interviews, pilot interviews were conducted with a small group of participants to test the interview questions and procedures. The pilot interviews allowed the researchers to identify any issues with the interview questions and to make necessary revisions. Thirdly, Data collected during the interviews were stored securely and confidentially. The audio recordings were transcribed verbatim, and the transcripts were checked for accuracy. Fourthly, Transcribed data were analyzed using a qualitative analysis approach. The data were coded, categorized, and themes were identified. Two or more researchers conducted the analysis to increase reliability. Finally, Participants were asked to review and verify the accuracy of the transcripts to ensure that the findings accurately reflected their perspectives. This helped to ensure that the data collected were accurate and reliable (Thomas, 2006).

Overall, these measures helped to ensure the validity and reliability of the study's findings. The use of informed consent, pilot interviews, secure data management, and validation of the results helped to minimize the potential for bias and inaccuracies in the data, and to increase the trustworthiness of the study's findings (Thomas, 2006).

The methodology in interview research typically consists of several key steps that guide the entire research process. Here is an outline of the typical steps involved in conducting interview research:

This chapter outlines the methods and materials used in the study to investigate CCTV users' awareness and practices of changing and using complex passwords. The purposive sampling strategy was used to select participants who have experience using passwords to access their CCTV systems, and a semi-structured interview guide was used to collect data. The data collection process involved recruiting participants, obtaining informed consent, conducting interviews, transcribing data, and analyzing data using qualitative analysis methods. The sample size of 10-30 participants was deemed sufficient to obtain a range of perspectives on the research question, and the interview questions were open-ended to allow participants to provide detailed responses. The qualitative analysis approach involved coding, categorizing, and identifying themes in the data to gain a better understanding of CCTV users' perspectives and experiences related to password security.

Our recommendation is to enhance the security of CCTV camera systems addresses the issues presented in the literature review and provide valuable insights into the risks associated with default passwords in IOT devices, particularly CCTV cameras, and to inform the developers of CCTV cameras of the more effective security measures for these devices, and also to understand the user perspective to measure their opinion and awareness regarding using password in CCTV cameras by suggests a multi-faceted approach and this includes suggests a multi-factor access control, an enforce for password change, and a way for increase a security awareness. Many CCTV camera systems do not require strong passwords or have default passwords, making them vulnerable to hacking and other security breaches. Multi-factor access control provides an additional layer of security by requiring users to provide two or more forms of identification before gaining access to the system. An enforce for password change allows users to change their passwords on a regular basis, reducing the risk of unauthorized access and data breaches. Meanwhile, security awareness educates users on best practices for password security, helping them to understand the importance of strong passwords and regular password changes. By using these solutions, users can take proactive steps to protect their cameras and reduce the risk of security breaches. However, it is important to note that while these solutions can help to improve the overall security of the system, they are not foolproof and must be continually monitored and updated to ensure maximum effectiveness.

Anshari, A., Hirtranusi, S. A., Sensuse, D. I., & Suryono, R. R. (2021, July). Face Recognition for Identification and Verification in Attendance System: A Systematic Review. In  2021 IEEE International Conference on Communication, Networks and Satellite (COMNETSAT) (pp. 316-323). IEEE.

Arsyad, M., Fitria, E. I., Farhan, M. R., & Maulana, R. (2023). Sistem Pengambil Keputusan Pemilihan Brand CCTV Terbaik Menggunakan Metode Simple Additive Weighting.  Jurnal Fusion,  3(02), 178-187

Braun, V., & Clarke, V. (2020, August 12). One size fits all? What counts as quality practice in (reflexive) thematic analysis? Qualitative Research in Psychology, 18(3), 328–352. Https://doi.org/10.1080/14780887.2020.1769238

CCTVdirect, M. (2022, June 9). Dahua Technology Review and features. CCTVdirect. Retrieved March 29, 2023, from https://cctvdirect.co.uk/blogs/industry-news/dahua-review#:~:text=To%20conclude%2C%20Dahua%20does%20offer,available%20to%20all%20its%20customers.

CCTVdirect, M. (2022, May 31). Hikvision camera reviews, ratings and features. CCTVdirect. Retrieved March 29, 2023, from https://cctvdirect.co.uk/blogs/industry-news/hikvision-review

Creswell, J. W., & Poth, C. N. (2017b). Qualitative Inquiry and Research Design: Choosing Among Five Approaches. Sage Publications, Incorporated.

Henderson, T., Swann, T., & Stanford, J. (2018). Under the employer’s eye: electronic monitoring and surveillance in Australian workplaces.