Securing smart cities from cyber attacks

Vishal Salvi at Infosys argues that smart cities can be sitting ducks without a robust cyber defence

 

In 2020, Sunderland won the Smart City of the Year award in the UK for its ambitious vision to create a connected, international city. It’s a smart city that runs on sensors, IoT, cloud, and 5G to deliver enhanced services to its residents and build a sustainable environment. But is such a highly digitised city safe from cyber attacks? 

 

IDC estimates global investment in smart cities will reach $189 billion in 2023, with 70% of the spending coming from the US, western Europe, and China. Smart cities have extremely digitalised, interconnected systems. If any of these systems are compromised, it could impact citizen privacy and safety.  

 

Smart cities: where convenience and risks go hand in hand

Let’s look at the various areas where smart cities can help citizens and the possible vulnerabilities that we need to be aware of.

 

Transport and traffic management

Smart cities could reduce transit time, improve traffic management and safety by using real-time information and surveillance. However, smart transportation is often built on top of legacy systems that are vulnerable to exploitation.

 

Law enforcement

Smart cities can become safer using technologies to identify potential lawbreakers and alert the police to possible criminal activities. A big challenge here is to balance security with data privacy. Mandates such as the General Data Protection Regulation (GDPR) help create the necessary checks, but these focus only on privacy and not security.  

 

Health services

Technology can be used to offer equitable access to healthcare and reduce long-term patient care. However, unsecured healthcare systems are a challenge. During the Covid19 pandemic, hospitals faced relentless breach attempts to access their systems for hospital and patient data, for example, in mid-2020, the COVID-19 test data of 1.4 million Parisians were stolen.

 

Energy consumption

Smart meters and devices can reduce electricity consumption. Self-healing grids can detect faults and fix them by reconfiguring systems. Compliance with environmental laws can be monitored closely.

 

Again, the risks of data theft are high due to many interconnected devices and complex networks. In 2016, for instance, Ukraine’s power grid was hacked by alleged state actors leaving 230,000 citizens in the dark.

 

These use cases are only a sample of the many that exist for a smart city. Each use case presents several vulnerabilities that could lead to attacks impacting the safety of citizens.

 

Building blocks of a resilient smart city defence

There are five primary focus areas in a smart city cyber-security strategy:

 

People

The citizens of a smart city are foundational to building a security-first culture. The higher the adoption and awareness, the better prepared they are to deal with threats such as online frauds, financial concealment, theft of credentials, impersonation, and more. Botnets and advanced malware attacks are other new dangers. Thus, digital literacy and trust become important. 

 

Governance

Key processes must be planned and communicated to all the relevant stakeholders to ensure effective handling of security. A robust multi-tier governance model ensures that various stakeholders such as immigration, customs, terrorism, biosecurity, law enforcement, and emergency management can work harmoniously. They must be powered by advisory on new tech innovations and threat evaluations.

 

The government must build the necessary infrastructure to enable quick investigation and resolution of cyber crimes.

 

Technology

Connected devices technology integrations such as smart sensors or security y-based controls using zero trust help effectively deal with the spread of sophisticated attacks. Advances in AI and deep learning need to be deployed wherever necessary to anticipate and mitigate known attack vectors.

 

Operations

Smart cities involve massive digital transformations requiring large technology assets and data centres. These assets need to be protected from cyber threats coming from various threat actors, thus, requiring 24X7 security monitoring and a robust incident response system that can scale up to the dynamic demands of the rapidly changing technology landscape.

 

Mitigation strategies

The latest cyber surveillance and detection technologies based on a zero-trust approach must be used pervasively in smart city settings. It must include real-time communication to incident response systems and first responders for mitigation, investigation, and analysis.

 

The smart city requires adept and efficient use of data that goes beyond traditional information resources. By analysing patterns, sensor feeds, and databases of records, analytics could help city administrators with insights. They can also monitor important city infrastructure and citizens for improved resilience.

 

Governments should develop threat models to assess the overall size and cost of crime occurring in the city and assess risks across diverse areas, including immigration, customs, terrorism, and biosecurity.

 

Europe is now highly focused on the security of smart cities. UK’s National Cyber Security Centre (NCSC) published new guidance on securing smart city infrastructure in May 2021. The guidelines drive awareness of how to keep connected places secure.

 

However, to ensure security in a smart city, all the citizens need to adopt best security practices.

 

---

 

Vishal Salvi is Chief Information Security Officer and Head of Cyber Security Practice at Infosys

Main image courtesy of iStockPhoto.com