{"id":71107,"date":"2026-07-15T13:05:19","date_gmt":"2026-07-15T11:05:19","guid":{"rendered":"https:\/\/www.innovagroupbcn.com\/blog\/uncategorized\/siram-ocr7-and-cybersecurity-in-lpr-systems\/"},"modified":"2026-07-16T12:39:18","modified_gmt":"2026-07-16T10:39:18","slug":"cybersecurity-lpr-systems","status":"publish","type":"post","link":"https:\/\/www.innovagroupbcn.com\/en\/blog\/parking\/cybersecurity-lpr-systems\/","title":{"rendered":"SIRAM OCR7 and cybersecurity in LPR systems"},"content":{"rendered":"\n

When a license plate recognition system like SIRAM OCR7<\/a> is installed, the conversation almost always revolves around the same things: <\/strong>accuracy rate, reading speed, whether it works in the rain or at night, what the maximum angle is. All of that matters, without a doubt. But there’s one part of installation planning that shouldn’t be left for last: the security of the system itself<\/strong>. <\/p>\n\n\n\n

An LPR system is not just a camera<\/strong>. It’s a device connected to the network, processing personal data, communicating with access management software and, in many cases, relying on third-party hardware \u2014 such as Axis cameras, on which SIRAM OCR can run in embedded form. Each of these points is a door into the corporate network. And doors, if not closed properly, open. <\/p>\n\n\n\n

That’s why in this article we’ll dig into the cybersecurity of LPR systems<\/strong>. We hope you find it useful!<\/p>\n\n\n\n

The first mistake: treating access profiles as a formality<\/strong><\/strong><\/h2>\n\n\n\n

In most installations we’ve seen, the administrator user is created once, with a generic password, and it stays that way. Months later, anyone who needs to touch the system uses that same account. <\/p>\n\n\n\n

This is a serious problem, since this is a vehicle access system <\/strong>that handles sensitive information \u2014 for example, who enters, at what time, with what license plate, on which lane. If everyone shares the same credentials, when something goes wrong \u2014 tampering, deletion of records, a configuration change that opens a barrier that shouldn’t open \u2014 there’s no way to know who did it.
<\/p>\n\n\n\n

The solution isn’t complicated, but it requires discipline: differentiated profiles according to each person’s actual role<\/a>, what in cybersecurity is known as user role segmentation<\/strong>. An operator who only needs to check movements shouldn’t have permissions to modify configuration or delete the license plate history. The installation technician needs access to the capture unit configuration, but not necessarily to the most sensitive parts of the system. And the general administrator \u2014 the profile with full permissions \u2014 should be the role held by the fewest people. For this reason, Siram OCR7 has incorporated user role management in addition to the Axis camera’s own user role management. <\/p>\n\n\n\n

\"SIRAM<\/figure>\n\n\n\n
\n
Download the LPR and Cybersecurity Whitepaper<\/strong><\/a><\/div>\n<\/div>\n\n\n\n

Secure connectivity vs. network isolation<\/strong><\/strong><\/h2>\n\n\n\n

In the past it was common to consider a secure system one that was completely isolated from the Internet. Today that statement no longer holds for many installations. Remote management, centralized monitoring, continuous updates and the use of cloud services provide very high operational value when implemented securely. <\/p>\n\n\n\n

The question is no longer whether a system is connected, but how it is connected. Communications must take place through authenticated, encrypted channels, limiting access to strictly necessary services and applying the principle of least privilege. A camera connected in a controlled way to Access Cloud or Alarm Cloud is not the same as a camera exposed to the Internet without any control. <\/p>\n\n\n\n

The value of running OCR7 on Axis cameras<\/strong><\/h2>\n\n\n\n

One of the strengths of SIRAM OCR is that it can run embedded directly on an Axis camera, leveraging these devices’ application platform (ACAP)<\/strong>. This brings real advantages: less physical hardware to maintain, fewer points of failure, and the backing of a manufacturer like Axis, which has a solid track record when it comes to firmware update cycles and vulnerability management.
<\/p>\n\n\n\n

That said, the manufacturer doing its part well doesn’t mean the job is finished. Axis publishes security advisories and patches fairly regularly, and those updates only protect you if someone applies them. We’ve seen installations running for years with firmware from the installation date, because “if it works, don’t touch it.” In cybersecurity, that reasoning is backwards: if it works and isn’t updated, that’s when it’s most exposed. <\/p>\n\n\n\n

The same applies to the cameras’ own default credentials. Every Axis device ships from the factory with a known username and password (although, in more recent installations, it forces you to set a password on first boot, which is a step forward). Changing those credentials, disabling services that won’t be used \u2014 Telnet, FTP if not needed, old management interfaces \u2014 and limiting HTTPS access to the internal network itself is basic work that’s rarely documented as part of the project, but should be in every commissioning report. <\/p>\n\n\n\n

What’s new: SCAP and Siram Alarm, the leap to ISO\/IEC 27001<\/strong><\/h2>\n\n\n\n

With all this in mind, what Innova has done with the new SCAP \u2014 the SIRAM Camera Application Platform Module \u2014 makes sense. The idea, at its core, is simple: instead of leaving each installation to figure out on its own how to install, manage and update the camera’s OCR or firmware, that whole process is standardized on a platform built for it. Less room for someone to skip a step, less dependence on everyone involved remembering to do things right. <\/p>\n\n\n\n

What’s interesting is that SCAP wasn’t conceived merely as an operational convenience tool, but with cybersecurity built in by design, aligned with the international ISO\/IEC 27001 standard. And this isn’t a minor detail: 27001 is the reference standard in information security management, so relying on it means adopting a serious framework, not just a list of good intentions in a sales PDF. <\/p>\n\n\n\n

In practice, that alignment translates into several very concrete pillars:<\/p>\n\n\n\n