Smart city cyber security

This is set to change how we experience – and what we come to expect from – the cities around us.

In practical terms, these transformative effects will arise from the combination of three pieces of technology: inexpensive logic controllers; millions of sensors connected to devices dispersed across a city; and a network that connects all of these nodes together and enables real-time communication.

Local city administrations and private sector organisations will need to work together in the future, identifying and prioritising critical assets, establishing a benchmark for their normal operation, and continuously ensuring that all parts of the city adhere to said benchmark. Rapid component replacement – in the event of compromise or failure – and the secure segmentation of critical private assets from the city network, will be critical.

This level of connectivity will enable a better and more efficient provision of urban services. Amsterdam, Barcelona, Santa Cruz and Stockholm have begun the process of incorporating elements of a ‘smart grid’ – a network of interconnected sensors within the city – across many of their urban domains, including energy provision, transport systems and telecommunications infrastructure. Inhabitants of these cities have begun to feel the benefits – but increased connectivity carries with it potentially severe cyber security risks that have yet to be fully revealed and, in many cases, mitigated. 

The idea of smart cities relies on three fundamental ideas. Physical infrastructure can be used more efficiently as data analytics and artificial intelligence progress.

Engagement of the urban population with the city administration can be achieved through e-participation – or the carrying out of civic duties through the internet.

As technology continues to progress, computer systems will learn and adapt to challenges autonomously.

With proper implementation, smart cities will provide tremendous economic, social and cultural advantages for inhabitants, for instance through smart meters providing real-time data to the consumer and electricity company on consumption.

Indeed, smart cities are dependent on machine-to-machine (M2M) interactions and decision-making. This is in part a product of the sheer number of inputs and the frequency and speed with which associated calculations need to be completed. In the case of the energy grid, it would not be possible for a human operator to process all the data necessary to make decisions at the speed required by the system. But while M2M decision-making (M2MD) is an unavoidable and beneficial feature of smart cities, it is also one of the greatest risks.

The key challenge for organisations is ownership of cyber security more generally. By definition, smart cities will widen the number of stakeholders and risk-owners to whom private organisations will need to be accountable. Although various organisational functions have some form of responsibility for managing cyber security (IT, security, corporate risk, legal), it is imperative that there is clear senior ownership of and accountability for cyber security and that this is articulated in a clear organisational strategy.

New city, new risk

M2MD is a highly promising means of ensuring efficient automation across smart cities. But given the absence of human operators, the risk of a cascading error is significant. (A cascading error refers to the potential for a small, unchecked mistake to spread through a system and become a systemic risk.)

For example, if a minor computing error caused a smart electricity reader to transmit inaccurate data readings to its control centre for a period of time this could lead to an automated, and mistaken, assessment that a particular private organisation’s premises required more electricity.

Smart cities will be composed of thousands if not millions of interconnected devices. Such a structure is a boon to criminals able to create or purchase and subsequently deploy self-propagating malware, variants of which have been known to proliferate across multiple connected networks.

Private sector organisations and municipal authorities will share ownership of systems and the responsibility for their security; beyond adding legal and financial costs for the private sector, this will create the need for highly complex pre-planned incident response schemes involving multiple parties.

The potential destructiveness of a cyber attack on smart cities is such that even the threat of compromise of the city’s system is likely to be treated by governments and businesses as an existential one. In practice, private sector organisations are likely to be made accountable for the use of their networks by malicious intruders as the potential for the cascading effect of a single network breach will be magnified by smart cities.

Because the underlying network of smart cities will encompass most aspects of life in the city, should that network be compromised by an attacker it would grant them unfettered access to a target individual or organisation. For example, state-owned competitors could compromise a smart city’s infrastructure to gather intelligence on a large number of rival private sector firms.

This information could include movements of their executives within the city, private and commercial communications grabbed from the ubiquitous presence of ‘free Wi-Fi hotspots’ managed by the city, and many more.

Moreover, organisations operating within the city are likely to have their networks overlap to some extent with the city’s own network, or at the very least, have frequent data transfers from their networks to that of the city. This would enable highly advanced threat actors such as nation states to exploit weaknesses within a city’s infrastructure to reach a target organisation and compromise the confidentiality of its network.

Beyond traditional espionage operations, the large-scale destruction or disruption of physical infrastructure through computer systems could become a technical reality.

Prioritise the security of critical assets: Contemporary networks are already impossible to protect in their entirety, a problem that will apply equally to smart cities. Some components of the system will have to be made more secure than others. Public and private sector organisations would need to work together to identify the city’s critical assets and oversee the institution of appropriate security measures.

Behaviour-based security: Auditing millions of separate devices for signs of malware is simply not feasible. A more workable approach would be to evaluate the behaviour of smart city components and systems against an established baseline of normal functionality or network behaviour. Any significant derivation from the norm would trigger an investigation into the possible presence of malware on the subcomponents.

Rapid component replacement: Given the potential for component failure or attacks compromising these components, an automated replacement system will enhance the security of the whole system.

Segment critical assets of private organisations from the city’s network: Paramount to the security of organisations in the smart city environment is the segmentation of their critical assets from the city’s network. Although costly and potentially reducing the effectiveness of the organisations, this policy will enable organisations to contain and mitigate any threat actors exploiting vulnerabilities in the smart city network to reach their assets.

Better together

Private organisations will need to build relationships with their local governments and security agencies, which will have the onus of decision-making in their city’s transformation into a smart city. They should also seek to understand whom the city has selected as a core security provider. These often private sector entities will understand the development of a city’s infrastructure and the future security requirements of the city at a macro-level across all areas of security. As such, they are able to provide private sector organisations with appropriate advice to best keep abreast of a city’s developing infrastructure. Finally, organisations operating in similar sectors should seek to share information around smart city initiatives, providing one another with insight into the forthcoming development of the city and their associated challenges.