Innovating for a smarter, safer world

Cybersecurity built in: how Axis minimizes security risks

“Cybersecurity is a fundamental and natural part of the Axis DNA,” says Jonas Falk, Director Cybersecurity, Software Development at Axis. “It’s an integral part of everything we do, from new technology development, to our own day-to-day operations. At Axis, security considerations are addressed right from the start of a new product’s development process, and this focus continues throughout the product’s lifecycle.”

To make sure this happens, a dedicated Axis cybersecurity team, the Axis Software Security Group, has defined the Axis Security Development Model (ASDM) that guides development teams to minimize the risk of vulnerabilities in Axis products during design and implementation. The group guides the methodology and activities, including tests involving simulated cyberattacks, that help to improve the security of Axis products.

Most Axis networked devices are driven by AXIS OS, the Axis operating system. While AXIS OS drives the features of Axis products, it’s also designed to reduce the risk of vulnerabilities and improve security of products from deployment through to decommissioning. New AXIS OS versions for devices are made available on a continual basis, and they include the latest security patches and bug fixes.

“A significant step Axis took was transforming the development of software for devices from an individual approach for each product, to a software platform that today is the foundation for most Axis products,” says Andre Bastert, Global Product Manager AXIS OS Cybersecurity at Axis. “Focusing on a common platform based on AXIS OS means we can more readily ensure development and updates to enhance security in an efficient and timely fashion.”

A key aspect of Axis’ strength in cybersecurity also comes from the strong foundation provided through the hardware-based security platform called Axis Edge Vault. Edge Vault safeguards the integrity of Axis devices and enables the execution of operations requiring cryptographic keys. Edge Vault enhances supply chain protection and provides secure key storage. Cybersecurity, however, cannot be achieved by developing new security features alone. A security foundation – with an overarching strategy comprising processes and policies that are implemented and improved over time – is necessary.

Having transparency in cybersecurity

“It’s important for customers to mitigate supply chain risks from networked products that are integrated into their systems, and at Axis, we believe that customers deserve to have transparency from their suppliers to help them mitigate risks,” says Andre. “It’s why we place such importance in being transparent, in areas such as the management of software vulnerabilities, in order to be a responsible partner in helping to protect our customers.”

Axis is approved as a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA) for its products. The CVE Program provides the framework and tooling that enable organizations around the world to manage and disclose newly identified vulnerabilities. Joining the CVE Program testifies to the commitment of an organization to following ethical vulnerability management best practices with a focus on customers.