What a Condominium's Build Year Tells You About Its Security System.

Why does a building’s age tell you anything about its security system?

Because the cable goes in when the tower is built and is expensive to replace once residents live there, while cameras, readers and recorders change around it. So the year a Kuala Lumpur tower was wired is a clue to its cable and cards; the riser settles it. For the city-wide picture, see Security Systems for Kuala Lumpur High-Rise Buildings.

Two dates help, though each marks when a technology arrived, not when towers were recabled. HD-over-coax, which sends high-definition video down ordinary camera coax, barely existed in 2012, according to Security Info Watch. Powering a device such as an IP camera through its network cable (Power over Ethernet) has been standardised since 2003, and later versions carry more power per camera. Why CCTV cabling outlasts its equipment is in how long a building’s security systems last.

Confirm it in the riser and on residents’ key rings:

What does an older condominium usually need first?

An older condominium tower usually needs its access cards checked first, and then whether its camera cable still performs, because good coax can often stay. HD-over-coax upgrades an analogue system without replacing the analogue infrastructure: the cameras use the same RG59 Siamese cable as traditional analogue ones, at up to seven times the resolution of a standard 640 x 480 analogue camera.

Where the tower still uses 125 kHz cards, they are often the weak point. IPVM, a security research publication, found that many access systems accepting them can be defeated with a card copier costing about US$30. Keeping the intercom wiring avoids drilling, cable routing and wall work in an occupied building, but only makes sense if the new system performs reliably on it. The full sequence for an older tower, layer by layer, is in upgrading security in older Bangsar and Damansara Heights towers.

What does a newer condominium usually need first?

A newer condominium tower usually needs its passwords, its software and its card type checked first. A networked camera system is only as safe as its settings and software, and a 13.56 MHz card only as safe as its chip.

The US Cybersecurity and Infrastructure Security Agency (CISA) reported in 2016 that the Mirai malware scanned for devices using a short list of 62 common default usernames and passwords, and that the devices it took over were primarily home routers, network-enabled cameras and digital video recorders.

Default usernames and passwords for most devices can easily be found on the Internet, making devices with default passwords extremely vulnerable.

CISA’s advice: change the defaults, and update devices with security patches as soon as patches become available. On a building’s cameras and head end, someone has to own both jobs.

A newer card frequency is not automatically a safer card. MIFARE Classic was the dominant access card through the 2000s and 2010s. In March 2008, researchers at Radboud University Nijmegen made public a complete reverse-engineering of it and cloned a transit card that used it. The cheap copier IPVM tested could not copy 13.56 MHz cards, so the barrier is higher than for 125 kHz, but it is not a lock.

There are no publicly known practical cloning attacks against properly implemented DESFire EV1, EV2 and EV3 cards, and MIFARE Plus lets an installation move off MIFARE Classic gradually, without replacing every reader at the same time.

What changes when the developer’s defects period ends?

The developer stops being the one who repairs defects, and the building carries the risk itself. Under the standard Schedule H strata agreement, the defect liability period is commonly 24 months from vacant possession. The agreement covers the unit, the building and the common property, and common-area defects are usually pursued through the JMB or MC.

For a networked system, use the months before it ends to get in writing who holds the administrator passwords, which software each recorder runs and which card type the readers use. What else should cross at handover is listed in what a JMB inherits at developer handover.

After that, an upgrade is a fund question. Section 24(2) of the Strata Management Act 2013 lets a JMB’s sinking fund pay for the renewal or replacement of any fixture or fitting in the common property (24(2)(c)) and for the upgrading and refurbishment of the common property (24(2)(d)). How to put that to owners is set out in sinking fund or maintenance fee.

What should a committee check before asking for quotations?

Before asking for quotations, a committee should know what each layer of its security system is, from camera cable to cards, and whether the defects period is still running, so every contractor prices the same building. Five checks settle most of it:

• The dates: completion and vacant possession, so you know whether the defects period is still running.
• The camera cable: coax or network cable, and how far each run goes.
• The cards: 125 kHz, MIFARE Classic, or DESFire EV1 or later.
• Passwords and software: whether the defaults were changed, and who holds the administrator accounts.
• What stays: written layer by layer into the scope of works, as in scope of works for a condominium CCTV tender, then compared using how to compare CCTV quotations.

Occhio Tec, established 2012, designs, installs and maintains CCTV, access control, video intercom, structured networking and perimeter intrusion, with its work concentrated in mid-high to high-end condominiums in Mont Kiara, Bangsar and KLCC. It also handles taking over a security system another contractor installed. See also Mont Kiara. To find out which generation your building’s system belongs to, request a site survey.