## 3 Critical Analysis of Selected Literature  
After conducting the screening process mentioned in Section 2, this section identifies and explains the classification criteria and common themes for this review.  
[PERSON] in [21] proposed seven criteria to classify vulnerabilities, exploitation techniques, attacks and security measures, namely: attack surface, attack type, attacker type, directly affected components, exploitation complexity, mitigation and mitigation complexity. In contrast, [PERSON] et al. [22] employed a classification framework consisting of five categories, namely: precondition, attack method, vulnerability, target and effect. While the authors in [21] studied video surveillance systems (VSS), the authors in [22] focused on the cyber-physical systems in general, not specifically on IP cameras or video surveillance system components. Furthermore, both studies were published over five years ago, and may not encompass attacks and vulnerabilities that have emerged since 2016. A recent study of [PERSON] et al. [15] focuses only on attack and mitigation security mechanisms for VSS, omitting broader aspects, such as target and impact. Additionally, as highlighted in the introduction section, this study does not encompass air-gapped IP video networks.  
This study tries to map the analysis to real-life scenarios, and thus classifies the findings according to the following five categories: network topology, vulnerability, exploitation technique, impact, and security measure. Use cases and attack diagrams have been added to enhance the explanation of the published attacks.  
Before analyzing the most common and novel exploitation techniques, it is essential to differentiate between two network topologies: air-gapped and non-air-gapped. An \"air gap\" is a security measure that involves isolating a computer or network and preventing it from establishing an external connection. In the context of cybersecurity, an air-gapped computer is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices [23]. In a \"non-air gapped\" topology (Figure 2a), all IoST devices have public IP addresses, which means that anyone from the internet can send packets to these devices. In contrast, an air-gapped topology employs private IP addresses, ensuring that no one from the internet can send packets directly to the device. There can be both logical and physical air-gapped networks, as illustrated in Figure 2b,c, which differ in topology and in how the devices can be accessed; in the logical topology, the devices could be accessed using a VPN.  
[PERSON] [21], [PERSON] et al. [24], and [PERSON] et al. [25] have each examined physical air-gapped network topologies to some extent. Their analyses primarily focused on attacks related to covert channels and data exfiltration within these physically isolated networks.  
[PERSON] and [PERSON] in [26] explain that a logical air-gap can be configured at the network firewall using network segmentation with different Virtual LANs (VLANs). In this configuration, an air-gap represents an isolated network within a larger network, ensuring that cameras are not visible on the computer network or to external entities. This isolation is achieved by placing the cameras on a subnet physically distinct from the main network. In a logical air-gapped network, a remote connection to the DVR/NVR can still be utilized to log in and used as a bridge to observe the cameras. Neither an administrator nor a hacker can directly access the cameras without first logging into the NVR and knowing of the unique camera subnet mask for NVR. This is particularly significant because the majority of IoST exploitations occur through cameras rather than the NVR [8].  
Figure 2: The topology of non-air gapped (**a**), physically air-gapped (**b**) and logically air-gapped (**c**) networks [24].