---

Unattended surveillance sites face a unique combination of physical, electrical, environmental, and cyber threats that are absent or less severe in attended installations. Because no personnel are on-site to respond to incidents, the system must be designed to withstand threats autonomously, detect and report failures in real time, and degrade gracefully rather than fail catastrophically. This chapter provides a structured risk assessment framework and mitigation strategies for each major threat category.

6.1 Risk Assessment Matrix

The risk matrix below evaluates each threat category by likelihood, impact severity, and the primary mitigation measures. The risk level is the product of likelihood and impact, and determines the priority of mitigation investment.

6.2 Lightning & Surge Protection

Lightning is the leading cause of total site loss at remote unattended surveillance installations. A single direct or nearby lightning strike can destroy every electronic component in the cabinet if the protection system is inadequate. The protection strategy must address three distinct threat paths: direct strike to the pole or structure, conducted surge on power cables, and conducted surge on data cables.

6.2.1 Protection Hierarchy

6.3 Cybersecurity for Unattended Sites

Unattended surveillance sites are increasingly targeted by cyber attacks because they combine internet connectivity (cellular/fiber backhaul) with physical inaccessibility that delays detection of compromise. The attack surface includes the router's WAN interface, the VPN endpoint, the camera web interfaces, the NVR management interface, and any cloud platform APIs. A layered defense strategy is required.

6.3.1 Minimum Cybersecurity Baseline

• Eliminate all default credentials: Change all factory default usernames and passwords before deployment. Use a password manager to generate and store unique strong passwords for each device and site.
• VPN-only remote access: No device should be directly accessible from the internet. All remote access must traverse the VPN tunnel. Disable any UPnP, port forwarding, or P2P cloud access features that bypass the VPN.
• Firmware currency: Establish a quarterly firmware review and update cycle. Subscribe to vendor security advisories. Critical CVEs must be patched within 30 days of disclosure.
• VLAN segmentation: Implement the four-VLAN design from Chapter 4. Camera traffic must never be on the same VLAN as management traffic.
• Disable unused services: Disable Telnet, HTTP (use HTTPS only), UPnP, ONVIF discovery (on WAN-facing interfaces), and any other services not required for operation.
• Log retention and alerting: Configure syslog forwarding to the central NMS. Alert on: failed login attempts (>3 in 5 minutes), new device on camera VLAN, VPN tunnel failure, configuration changes.

6.4 Physical Security Measures

Physical security at unattended sites must deter, delay, and detect unauthorized access to the equipment. The goal is not to make the equipment impenetrable — a determined attacker with tools will always be able to remove equipment — but to ensure that any tampering is detected and reported before the attacker can exploit the compromised system, and to make opportunistic theft unattractive through visible deterrents.