By Gary Hilson for Verizon

Smart cities and cybersecurity are inseparable. When you start integrating the Internet of Things (IoT) with infrastructure, a city cyber attack is, unfortunately, inevitable. But that doesn’t mean it has to be successful. Systems that were once on separate operational technology (OT) infrastructures have merged with modern information technology (IT) systems and use IoT to gather and manage data. This data is processed and analyzed to optimize city services such as lighting, traffic data management, public parking, video surveillance, and real-time response systems. Combining these and other functions into a single, connected infrastructure to create more efficient, intelligent systems requires finding the right balance between smart cities and cybersecurity. 

HOW CITIES ARE GETTING SMARTER

Smarter communities are vulnerable to a city cyber attack because of the increased connectivity across multiple functions. A smart city collects data from IoT sensors and applies analytics to automate and optimize the orchestration of a wide range of services for citizens while lowering costs, improving performance, and lessening the environmental impact. Data sources can include city-owned assets and buildings, including traffic lights and utility meters, as well as citizens themselves. All this information is processed and analyzed to better monitor and manage the lifeblood of any city, including:

• Intelligent lighting: Streetlights are smarter thanks to central management by an online application, so they can be remotely controlled and monitored. Sensors allow smart city lighting to be responsive to traffic flow, accidents and detours, parking spaces and even power outages.
• Traffic management: Smart cities use cameras to collect real-time traffic data that can enable cities to respond immediately to changing road conditions and inform long-term planning. Navigation for emergency vehicles and first responders can be prioritized when necessary, and planners can identify potential congestion areas as cities grow up and out.
• Parking: A smart city optimizes how cars are parked — as much as 30 percent of traffic congestion is caused by parking shortages. Secure video nodes use computer vision to monitor parking activity, so it can help drivers find spots faster while informing parking policies, allocation and pricing over the long term based on parking patterns.

A smart city can include real-time response distributed endpoints and systems that can immediately react to the regular hustle and bustle of its citizens as well as an emergency. However, a smart city’s inherent connectivity and the unification of OT and IT opens the door to more cybersecurity threats.

WHAT ARE THE POTENTIAL CYBERSECURITY RISKS?

For smart cities, malware is not only a threat to it and the city’s administration but also to the community’s residents and businesses. An intelligent energy management system that’s responsive to user demand could turn off the power when it’s needed or increase the power unnecessarily if infected by malware, causing a constituent to have sticker shock when they get their next electricity bill. Smart city security strategies must also be ready to confront distributed denial of service attacks that can cripple websites, computers, and online services. Essentially, they are overwhelmed with more traffic than the server or network can handle, rendering them inoperable. A city cyber attack could exploit an IoT device and use it as a gateway into a wide variety of disparate IT and OT systems. Threat actors can manipulate and corrupt the data that powers all these intelligent systems and threaten the safe operation of traffic control, public transportation, street lighting, power grids, and many other services. They can even stop their operation completely through signal jamming and remote execution because they can take. No matter how these essential systems are altered by emerging technologies, it’s important to remember they are critical infrastructure and must be safeguarded.

PREVENTING A CYBER ATTACK ON YOUR CITY

The relationship between smart cities and cybersecurity is complex, and standards are still being developed. However, the National Institute of Standards and Technology has laid the groundwork for an IoT-enabled framework for smart cities that addresses cybersecurity and data protection. It begins with good policy. It’s easy to get excited about the doors opened by IoT but forget the threats that can come through them. Having clear policies around IoT data use and privacy from the start will prevent misuse and help city staff be more security aware, so they can do their part in preventing a cyber attack. At the same time, there must be boundaries around who is allowed to access and use the information generated by the various connected devices. Remember, a smart city handles the data of all its citizens, which means identity management is critical across all connected systems, even if each piece of infrastructure has different access rules. Credentialing must be synchronized to eliminate weak points and protect all residents’ personal information. In addition to managing access and credentials, city staff must be clear on how each connected device behaves — what data it collects and how, as well as how the data is transmitted and used. Proper encryption must be applied as soon as the device is turned on, both at the device level and across any communications links to the data’s destination. Any smart city’s goal is to improve the quality of life for people living in it while increasing the ways and efficiency in which cities operate by designing infrastructure, systems, and processes that elevate the way they provide services in new and cost-effective ways. The smart technology, connectivity, and applications must be able to meet the basic wants and needs of residents with cybersecurity acting as a key building block of any smart city’s foundation.