Five Eyes agencies this week issued cybersecurity guidance and best practices for smart cities. The document describes potential risks and provides recommendations for addressing them.
Smart cities are defined as communities that integrate information and communication technologies (ICT), community-wide data and intelligent solutions to optimize governance, as well as communities that connect operational technology (OT) managing physical infrastructure with IoT devices, cloud computing, AI and 5G communications.
Smart cities provide numerous benefits for authorities and citizens, but the cybersecurity risks associated with them should not be ignored as they can be an attractive target for threat actors, including profit-driven cybercriminals and state-sponsored threat actors looking to obtain valuable information or cause disruption or destruction.
The cybersecurity guidance for smart cities is provided by US agencies CISA, NSA and FBI, the UK’s National Cyber Security Centre, Canada’s Centre for Cyber Security, the Australian Cyber Security Centre, and New Zealand’s National Cyber Security Centre.
One of the risks associated with smart cities is related to the expanded and interconnected attack surface that is created when previously separate systems are integrated into a single network. This enables an attacker who has gained initial access to the network to move laterally and cause “cascading, cross-sector disruptions of infrastructure operations”.
“For example, malicious actors accessing a local government IoT sensor network might be able to obtain lateral access into emergency alert systems if the systems are interconnected,” the agencies explained.
Another risk comes from the ICT supply chain and the vendors that provide hardware and software. Threat actors can abuse supply chain vulnerabilities to steal valuable data, cause disruption, or weaken confidence in the integrity of systems.
“Illicit access gained through a vulnerable ICT supply chain could allow the degradation or disruption of infrastructure operations and the compromise or theft of sensitive data from utility operations, emergency service communications, or visual surveillance technologies. Smart city IT vendors may also have access to vast amounts of sensitive data from multiple communities to support the integration of infrastructure services—including sensitive government information and personally identifiable information (PII)—which would be an attractive target for malicious actors,” the agencies said.
Another major risk category is related to the automation of infrastructure operations, such as traffic management and wastewater management. This automation can introduce new vulnerabilities, and the volume of data and the complexity of automations can lead to reduced visibility.
In order to address these risks, owners should keep track of the individuals and vendors responsible for the overall system and each segment, ensuring that there is no ambiguity when it comes to roles and responsibilities in order to avoid degrading cybersecurity posture and incident response capabilities.
When it comes to supply chains and vendors, they should be carefully vetted and risks should be assessed.
“This includes scrutinizing vendors from nation-states associated with cyberattacks, or those subject to national legislation requiring them to hand over data to foreign intelligence services,” the agencies said.
Specific recommendations described in the guidance include applying the least privilege principle and implementing a zero trust architecture, enforcing multi-factor authentication, securely managing assets, improving the security of devices, protecting internet-exposed systems, patching systems, conducting training, and developing and exercising incident response and recovery plans.
The Five Eyes guidance only summarizes the recommendations for securing smart cities, but it also includes links to numerous useful resources provided by various government agencies.
Related: Securing Smart Cities from the Ground Up
Related: Securing Autonomous Vehicles Paves the Way for Smart Cities
Related: Compromised by Connection: 5G Will Unite Cities and Also Put Them at Risk
