Site CCTV, Gates and Connected Kit: Securing the Devices on a Construction Site

A modern construction site is full of connected devices that nobody thinks of as IT. Cameras on the hoarding, a turnstile or gate controller, a temporary alarm, a site printer, a router in the welfare cabin and sometimes sensors or connected plant. Each one usually arrives with its own installer, its own app and its own password. Construction site CCTV security, and the security of everything else on that site network, often ends up being nobody’s job.

This article looks at why these devices matter, what UK guidance says about them, and a practical baseline any contractor can apply from site set-up to handover. It is practical guidance, not legal advice.

Why connected site devices are a real risk

The government and the NCSC call this category “enterprise connected devices”: things like office printers, cameras, entry systems and room booking systems that sit on a business network. The government’s published research on enterprise connected devices notes significant concerns from IT professionals about how secure they are, and that organisations often lack clarity on how to monitor and protect them.

The NCSC’s assessment of these devices points to the usual weak spots: default passwords, outdated protocols, missing encryption, poor configuration and unpatched firmware. A badly secured device can expose footage, and it can also give an attacker a foothold to move onto the rest of the network.

On a construction site the problem is made worse by a few everyday habits:

• Kit is installed quickly by different suppliers. Security cameras, gate systems and broadband are often separate packages with separate contractors.
• Remote viewing is switched on by default. Managers want to check the site from their phone, so ports get opened on the router to make it work.
• Sites are temporary. Devices move from job to job, and passwords set on the first site follow them to the next.
• Nobody owns the inventory. IT may not even know what has been plugged into the site router.

What good construction site CCTV security looks like

The NCSC’s guidance for operational technology and connected devices is clear on the basics, and they translate well to a site:

Change every default password

No device should keep the password it shipped with. The NCSC is blunt that default credentials make compromise trivial, especially for devices reachable from the internet. Set a unique password per device, store it in your password manager, and do not reuse one password across every site.

Keep firmware updated

Camera recorders, gate controllers and routers all run software. Check for updates at installation and on a schedule after that, and turn on automatic updates where the device supports it. A device that the manufacturer no longer supports should be replaced, not left running.

Turn off what you do not need

If a device does not need to be reachable from the internet, switch off remote access. Where remote viewing is genuinely needed, prefer the manufacturer’s secure cloud service or a VPN over opening ports on the router, and check UPnP is turned off so devices cannot open ports by themselves. Remove unused services and accounts.

Keep devices off the business network

Cameras, gates and sensors should sit on their own network or VLAN, separate from laptops, tablets and the systems that hold project and finance data. Guest Wi-Fi for visitors and subcontractors should be separate again. We cover the wider set-up in construction site connectivity.

Use MFA and named accounts for remote access

Where the camera platform or gate system has a web portal, use named accounts rather than one shared login, and switch on multi-factor authentication where it is offered. That way you know who viewed or exported footage, and you can remove access cleanly when someone leaves.

Put the devices on your asset register

Every camera, recorder, controller and router should be listed with its location, supplier, firmware version and who holds the admin login. If it is not on the list, it will not be patched or removed at the end of the job. Our guide to building an IT asset register covers how to keep that list useful.

Do not forget the footage itself

Security of the device is only half the job. Footage of identifiable people is personal data. The ICO’s guidance on video surveillance, including CCTV explains that organisations using surveillance systems need to comply with UK GDPR and the Data Protection Act 2018. In practice that means:

• A clear purpose and lawful basis, usually legitimate interests for site security, documented before the cameras go up.
• A DPIA where the processing is likely to be high risk. The ICO says this applies in most cases involving surveillance systems.
• Visible signage so people know cameras are in use and who to contact.
• Retention set by purpose. The law does not set a fixed period, so decide how long you need footage and delete it after that.
• Controlled access and disclosure, including being able to find and extract footage when someone makes a subject access request.

Cameras that also point at neighbouring properties, public footpaths or welfare areas need extra thought.

From site set-up to handover

A short checklist keeps this manageable across many sites:

1. At set-up: agree with each installer who owns the device, change default passwords, update firmware and put the device on its own network.
2. During the job: review who has access to camera and gate portals, especially when subcontractors and staff leave. This fits naturally into your joiners, movers and leavers process.
3. At handover or demobilisation: remove remote access, export only the footage you have a reason to keep, factory reset or securely wipe devices before they move to the next site, and update the asset register.

Takeaway

The cameras and gates protecting a site should not become the easiest way into the business. Change the defaults, keep them patched, keep them separate and treat the footage as the personal data it is. None of it needs expensive tools, just a clear owner and a routine that runs from set-up to handover.

If you would like help building a sensible baseline for site devices, our managed IT services and IT consultancy teams can help. Get in touch for a no-pressure conversation.