jtsec | Blog | Smart cities: a new cibersecurity paradigm

- Febr

2020

Posted by: Raúl Sánchez

Smart cities: a new cibersecurity paradigm

When we think about smart cities, it is very common to think about streets full of screens and Wi-Fi in the toilet. However, the term Smart City means much more than that. Of course, interaction and communication are very important factors in a smart city, but not the only ones.

Another term that usually comes to our mind is IoT (Internet of Things), and probably we are getting closer to the point. IoT is the new paradigm that is changing the rules of the game and, of course, our cities.

Billions of bytes are collected every day from many kinds of sensors in many kinds of devices. This data can be used to improve the efficiency of the city in many ways, such as power consumption, transport, communication, etc. So, we have to introduce a new concept to the equation, Big Data.

The base of a Smart City is the combination of these 2 mentioned concepts: Iot and Big Data. However, they are necessary, but not enough. A proper use and analysis are required to achieve the main objective of a Smart City: To be able to manage resources by itself to enhance the workability, to be sustainable and respectful with the environment.

IoT in Smart Cities

We have dreamed about a massive network of connected devices since the beginning of the millennium. Nowadays is a reality. Every device has an interface to be able to connect to Internet and transmit data twenty-four hours per day. These devices are not only embedded systems in traffic lights or bus stops, but also systems operated by humans like smartphones, wearables, home assistants or smart cards.

The technology that empowered IoT has been developed and improved during the two decades of the millennium making this a reality. Wireless technologies like Wi-Fi, reduced processors and architectures, talking in terms of size and power consumption (but also in processing power) like ARM, specific protocols like MQTT, OCPP, ZigBee or even Bluetooth and Cloud Computing have fed IoT and take it until where it is today.

As the paradigm evolved, smart devices have been spread around big cities, but the implementation of the systems around the cities has not been planned and they have been set ad hoc to solve specific needs. If the city had been planned taking into account the use of the devices, we would interact completely different as we do it nowadays. As this approach is impossible (big cities have a long history) we can try "patching" them and incorporating the use of new paradigms as the city grows.

Big Data in Smart Cities

With such a big amount of connected systems, we will have a massive load of data that needs to be stored and processed. It is impossible to store this data in the same device where is generated in most of the cases due to the inherent restrictions of the device (although devices like smartphones can store their own data), so Cloud Computing along with a reliable and high-performance bandwidth is essential.

Data storage requires a dedicated infrastructure that has to be taken into account. The cities grow, and the data with them, so it should be scalable and guarantee security, which involves availability, confidentiality and integrity of the data at every moment.

Apart from storage, data processing also requires specific and powerful machines. This data is probably going to be used in artificial intelligence. Conventional algorithms are not enough when we talk about such a big amount of data, so AI (and specifically neural networks) seems to be the best approach.

AI allow us to predict and optimize common problems in the management of a city, such as the frequency of public transport in peak time, power management and monitoring of according to production and consumption, smart lightning or vulnerable groups monitoring.

In essence, an ideal smart city should behave like an independent system taking care of its data and acting in function of them

Cybersecurity in Smart Cities

An independent and auto-managed city sounds great, but a completely connected systems means a very big exposure area, physically and virtually. Security and prevention should be the priority as all the citizens of the city depends on that.

Smart Cities infrastructure is exposed to many threats that should be considered during the design. Not all threats are performed by an attacker, we have to consider accidental threats as well. As mentioned in this ENISAs article, we can classify the different threats as follows:

Intentional Threats: obviously, those committed by an attacker with bad intentions. We can classify them:

Eavesdropping/wiretapping:Capturing network traffic and listening to communications between two or more parties without consent. It could affect not only the confidentiality but also the integrity of the communication. IoT devices often use wireless connection which are easy to sniff. Also, due to the inherent restrictions of the device, it is common to see technologies which default configuration is unsecure by default like, for example, MQTT, which is a very common protocol in IoT communications.
Theft: Unauthorized appropriation of data or technology. Confidentiality and availability can be compromised and can lead to other attacks if credentials or keys are stolen. As the devices are on the street, can be compromised easily.
Tampering: Alteration of data affecting to its integrity, availability and, of course, authenticity.
Unauthorized use/access:It uses to be the first step that leads to other attack. However, bad use of a resource is also an unauthorized use. Taking into account that many systems in smart cities aims to enhance the interaction, a bad use could be a very probable scenario.
DDoS:A huge amount of connected systems is the perfect target to get a botnet. A DDoS performed by a IoT devices botnet can cause several harms to availability not only to the attacked system but also to the devices forming part of the botnet.

Accidental threats:

Hardware failure: IoT devices are not exposed in a static environment and a failure can occur due to many situations. Also, a failure in network devices like routers or switch can cause interruptions between big networks.
User error: either a maintainer, either an user, can cause an error due to an unexpected use of the system or a bad configuration. It can lead to loss of availability or even data leaks.
End of support: As an IoT device does not use to be easily accessible, updates are usually forgotten and it can lead to several vulnerabilities, promoting intentional attacks.
Electrical interruption: electric power supply may not be constant because of external factors and availability can be compromised.
Environmental incidents: as these systems use to be exposed to weather, bad weather conditions can damage them interfering communications or even taking them down

Of course, all these threats can be mitigated if a set of good practices is followed.

Use of VPNs to benefit from the functionality of private networks in public networks.
Encryption of data to grant confidentiality.
Physical protection to avoid access to devices which use to be placed on streets.
Access control to not only avoid access to unauthorized entities, but also monitorize who has access and what he did.
Logging and monitoring every action to get record of what, when, where, and how happened.
Debugging procedures to troubleshoot errors when required.
Hardware redundancy to have a backup in case a system fails.
Shutdown procedure to keep consistent data and systems in case they are unexpectedly shut down.
Maintenance of backups in dedicated centers to recover data in case it is necessary.
Regular auditing to keep track of infrastructure’s weaknesses and remediate them.
Regular upgrade to prevent obsolescence (software or hardware).
Device hardening reducing surface of exposure.
Power protections like surge protections or secondary power supplies.
User and operator training to give the necessary knowledge to use technologies safely.
Enhanced engineering requirements where security is a priority.

If any critical infrastructure is compromised, citizens could be affected directly or indirectly. For example, if the water supply management is compromised, citizen would not have access to it. An attack to the cameras system could result in privacy violation. Probably, the most critical aspect could be an attack to the transport system, such as connected cars, trains or even plains which in the best scenario would cause a traffic jam or delays, and an accident in the worst. Also, sensitive data, credentials, keys or even physical devices could be theft, compromising other related systems or users.

Creation of specific cybersecurity laws, use of good security practices and periodic security tests are completely necessary to make our smart cities the most reliable and sustainable possible. Security must be a priority during design phase and the city growing plan has to be synced with the cybersecurity planning. Certification Professional advice is completely necessary. Cybersecurity professionals must participate in the new technologies adoption designing/auditing/evaluating the security of future devices/systems in conformance to recognized cybersecurity standards such as LINCE or Common Criteria.

It would be really suitable to collect all these key points in a big standard specially dedicated to smart cities. However, it does not exist at this time. Cybersecurity is collected inside more general standards about smart cities like ISO/TS 37151:2015, where security is vaguely mentioned. A preliminary standard is being developed by NIST but it is far from being a reality. PD 8100 is the standard for smart cities developed by BSI (UK) but, again, it is smart city definition broadly speaking and it just mentions security a couple of times. It is obvious that it is more than necessary to develop a specific and concise standard that can describe and expand cybersecurity in a Smart City.

Conclusion

Smart Cities are the new paradigm which every big city is going to adopt in a close future. Sustainability, workability and eco-efficiency are the main objectives to achieve and thanks to technology we are closer every day. However, security cannot be forgotten if we want to develop a safe space for everyone. The price we could pay for not taking care of it could be very high, not only in terms of money but also in human lifes. Technology adaptation is not enough. Laws, behavior and responsibilities need to be updated to go ahead to the new paradigm.

Cybersecurity must be taken into account since the conception of the smart city, including cybersecurity requirements (e.g. Cybersecurity certification, pentesting by recognized auditors, etc…) must be a must in the future.