A security camera can continue streaming video as usual while quietly making connections unrelated to its normal operation. When an attacker takes control of multiple internet-connected devices and coordinates their activity, those devices form a botnet. A botnet can launch a distributed denial-of-service (DDoS) attack by flooding an online service with traffic, making it difficult for legitimate users to access it. One example is the 2016 Mirai attack on the DNS provider Dyn, which involved devices compromised through default login credentials. (cisa.gov⁠) How Can We Identify Suspicious Connections? Monitoring begins with recording how a device behaves under normal operating conditions. Which destinations does it contact? How many connections does it initiate per minute? How does its activity change during an update or after a restart? These observations establish a baseline for comparison. A sudden increase in connections alongside attempts to reach unfamiliar destinations may warrant investigation. (csrc.nist.gov⁠) Suppose a laboratory camera normally sends video to a recorder on the local network. If it suddenly tries to contact dozens of external addresses within a minute, the network administrator can review when the activity began, examine the destinations, and check for a scheduled update or a configuration change. If the activity remains unexplained, the camera can be temporarily isolated and examined to determine whether it has been compromised. How Can We Reduce the Risk of Compromise? Cameras and sensors can be placed on a separate subnet, with network rules that allow them to reach only the destinations they need to function. For example, access rules for a camera that uses a local recorder can be limited to its operational requirements. Changing default passwords and installing manufacturer-provided security updates also reduces the risk of compromise. (cisa.gov⁠, nist.gov⁠) Al-Mustaqbal University The First University in Iraq