The video systems are typically like this, they aren't run by your average good looking, hyper smart information security professionals, they are run by physical security which is a whole different kettle of fish. I once worked at an org where there was NO password on the video surveillance, and they refused to set up one. So I went and showed the Windows server admins, who were well known scamps, how to access it and pan/tilt the cameras and left it at that. I don't know what those Windows admins were doing with the cameras, but soon there was at least a decent password on the thing.