Smart City Cybersecurity: Key Risks Explained

By Mehdi Paryavi

The promise of smart cities is a realm of convenience and a wide range of utilities available at our fingertips.  However, the evolution of technology and its offspring services is not without risk. Cybersecurity risks are one of the core challenges of our time that threaten municipal life in the modern digital world.

As our cities become smarter, our lives adapt by becoming more dependent on the convenience, and the resources provided to us via smart city technologies. However, with every evolution, there come risks. What are the cybersecurity risks associated with the smart city technologies that render the very services we use each day?

Cybersecurity is a major risk that threatens vital applications and services we utilize to live our modern lives. Smart cities are not excluded from this rule. To understand risks, we must first understand the key components of a smart city and their interwoven nature. From an aerial view, smart cities operate through four main pillars:

• Applications – All smart services across cities are delivered via applications that digitally render a set of processes for their users. Examples could be waste management, lighting systems, and emergency response systems. If any of these applications exhibit cybersecurity vulnerabilities and are exploited, not only could their services be seized, but sensitive and mission-critical municipal data could also be exposed to unauthorized access.
• End Devices – Most applications need certain end devices to perform the very services they were designed to perform. Examples could range from CCTV cameras to air quality sensors across the city. If the end devices are interfered with, then blind spots across the city will occur and misinformation could be fed back to the applications. End devices are often undermined as they typically don’t store data. However, they are the input and output components of smart city applications.
• Infrastructure – Infrastructure is the backbone of any smart city application. Infrastructure could range from data centers that process and store data, to energy and power grids that power the data centers as well as end-devices, as well as fiber and telecommunications. If the infrastructure is interrupted via cyber vulnerabilities, the impact could be catastrophic as it could ultimately cause total blackouts and bring down a series of applications, simultaneously.
• Operations – The operational gear is inclusive of operating policies, manuals, processes, and procedures as well as the human resources that together devise, develop, and maintain smart city functionalities. Even the most secure applications, end devices or infrastructure need a robust operations and maintenance regime to stay reliable. A city’s lack of being well-maintained or operated could endanger the entire ecosystem.

The question is, are we skilled or prepared to carry on without smart city functionalities? Probably not. We are so ingrained in the use of digital municipal services that we can’t truly gauge the depth of our dependency on their on-time and flawless deliverables. At the same time, technology and the adaptation of its resources is happening far faster than governments’ capability to create contingency plans and alternatives.

Is the threat spectrum wider in smart cities than in less digitized municipalities? Certainly. In a traditional urban life, the threat must be locally present. However, in smart cities, the threats could be remote. Additionally, the number of nodes that can be threatened is far more and the threat is not limited to certain hours of the day or night, it’s constant. In general, a mechanical life and a digital life are not the same. There must be a physical and local presence of an outside force to interrupt a mechanical life, while in the world of cyber someone could be putting a pause on our way of life through a personal computer with two continents of physical separation. From the way our traffic is monitored and managed, to how we respond to crime or emergencies, to when and how we light our streets, and more, all are managed via applications and digital devices that live under the threat of a cyber-attack 24 hours a day. Therefore, architecting for cyber-resilience and having a zero-trust environment is critical in maintaining smart city applications and capabilities.

What are the key features of a cyber-resilient smart city architecture?

• Prevention – The most critical component of cybersecurity is planning for prevention. Preventing cyber intrusions is the most fundamental and necessary component of building smart cities that can avoid disastrous outcomes due to cybersecurity breaches. Cyber breaches could be extremely expensive to overcome and therefore any measures that can help prevent any such incident are far better than trying to overcome the consequences of an incident.
• Detection – Detection is an integral part of prevention. Meticulous monitoring is vital in detecting cyber breaches both at the application layer as well as network devices. If a cyber breach occurs, the attack and the attack vector must be quickly recognized to allow for immediate recovery, to minimize losses and service interruptions for city residents and stakeholders.  
• Recovery – Once a cybersecurity breach happens, depending on the severity of the breach, immediate pre-determined steps must be taken to recover from the incident. Recovery is an operating procedure that includes taking the necessary steps, including the use of certain tools, to retrieve and recover data and restore the service capabilities of the interrupted applications. In the business continuity world, this is referred to as disaster recovery which is part of the overall business continuity plan (BCP) of any organization, prescribing the methodology and tools used to stay uninterrupted and/or, in the case of interruption, recover from such incidents swiftly and with minimum losses.

What is the backup plan for smart cities? Manual bypass. There must be a physical path in performing every critical digital function. There must be a manual bypass for every digital functionality so that in the event of crises certain key functionalities can be manually operated. This also requires well-trained personnel at the municipality’s information technology office and other depending agencies as well as capable and well-informed residents of a smart city ecosystem.

In conclusion, the more reliant we become on smart tools and technologies, the less likely we are to be able to perform and conduct our day-to-day business in their absence. Many conveniences of life, as well as its necessities, are delivered through smart cities today. But their availability and security are taken for granted. The more advanced and the smarter the cities, the greater the impact of a probable cyber intrusion. The slightest turbulence in the processing capabilities of the applications and systems that deliver such services could put life, as we know it, on hold for modern cities. Cybersecurity plays a vital role in upholding the features the smart city features which enable municipal functionality and prosperity.

About the Author

Mehdi Paryavi is the Chairman and CEO of the International Data Center Authority (IDCA), the world’s leading Digital Economy think tank and prime consortium of policymakers, investors, and developers in AI, data centers, and cloud.