Surveillance cameras could really use a PCI-type compliance regime. Data must be stored encrypted at rest, intranets must be segregated from the broader web, etc. It isn't perfect but it's better than nothing.