Risks of default password in IoT devices (CCTV) and how to make them more secure

· The participants' awareness.

1. What do you think the data is collected to provide functionality of the CCTV cameras? Do you think they need to access your location, phone data, and so on?

2. How often do you read the policy of the device?

3. Before you choose using CCTV cameras, do you read the policy? If no, why you did not read the policy?

4. Before you start using CCTV cameras did they ask you to agree upon agreement, read the policy?

· The participants' practices of changing and using complex passwords.

1. Do you use a simple password like sequence numbers or a complex password which contain symbols and number password? Why?

2. How do you store your passwords? Do you use a password manager for your CCTV system?

3. Do you use the same password for multiple accounts, including your CCTV system? If yes, why or why not?

4. How important do you believe that complex password are important and how often you change your password ?

5. How confident are you in your ability to create a strong and secure password?

6. Do you usually choose devices that force you to use a complex password?

7. Do you use two-factor authentication for your CCTV system? If not, why?

· How much they trust these devices in related to security.

1. What is the brand you used for CCTV camera? What are the reasons of choosing this brand?

2. How much do you trust your CCTV system to keep your property and assets secure?

3. How important is protecting your data (videos, password, audio recording) when it comes to CCTV systems?

4. How much your confidence regard storing your recorded data in these devices?

5. How do you ensure that only authorized personnel have access to your CCTV system?

· The favorite method of notification they preferred in terms they have been hacked or in the situation in security breach.

1. Have you ever heard about any security breach that happened in brand you use?

2. Did you receive any notification regarding security breach?

3. Have you ever experienced a security breach or hacking incident in your CCTV system? If so, how were you notified?

4. How quickly do you expect to be notified following a security breach or hacking incident?

5. In the event of a security breach, would you like to be notified or would you rather keep this for the developer?

6. What is your preferred method of notification in the event of a security breach? Would you prefer to be notified via email, phone call, text message, or another method?

· Best method of authentications they preferred.

1. Have you received any notifications from your CCTV provider regarding weak passwords?

2. How many authentication factors do you use?

3. Do you prefer one or more of the authentication methods?

4. Have you read the device policy? Is there any requirements about changing the password every period of time?

5. What is your preferred method of authentication for accessing your CCTV system?