As Mike said, VPN is your most secure bet, but an alternative, don't expose the cameras themselves, expose a web server (Blue Iris, Zoneminder, or whatever flavor you choose) that way, you control the O/S patch levels, and software updates. Known exploit? Patch, or change to something else...