Connect with us

Hi, what are you looking for?



Five Eyes Agencies Issue Cybersecurity Guidance for Smart Cities

Five Eyes agencies have issued joint cybersecurity guidance and best practices for smart cities.

Smart city cybersecurity

Five Eyes agencies this week issued cybersecurity guidance and best practices for smart cities. The document describes potential risks and provides recommendations for addressing them.

Smart cities are defined as communities that integrate information and communication technologies (ICT), community-wide data and intelligent solutions to optimize governance, as well as communities that connect operational technology (OT) managing physical infrastructure with IoT devices, cloud computing, AI and 5G communications. 

Smart cities provide numerous benefits for authorities and citizens, but the cybersecurity risks associated with them should not be ignored as they can be an attractive target for threat actors, including profit-driven cybercriminals and state-sponsored threat actors looking to obtain valuable information or cause disruption or destruction.

The cybersecurity guidance for smart cities is provided by US agencies CISA, NSA and FBI, the UK’s National Cyber Security Centre, Canada’s Centre for Cyber Security, the Australian Cyber Security Centre, and New Zealand’s National Cyber Security Centre. 

One of the risks associated with smart cities is related to the expanded and interconnected attack surface that is created when previously separate systems are integrated into a single network. This enables an attacker who has gained initial access to the network to move laterally and cause “cascading, cross-sector disruptions of infrastructure operations”.

“For example, malicious actors accessing a local government IoT sensor network might be able to obtain lateral access into emergency alert systems if the systems are interconnected,” the agencies explained.

Another risk comes from the ICT supply chain and the vendors that provide hardware and software. Threat actors can abuse supply chain vulnerabilities to steal valuable data, cause disruption, or weaken confidence in the integrity of systems. 

Advertisement. Scroll to continue reading.

“Illicit access gained through a vulnerable ICT supply chain could allow the degradation or disruption of infrastructure operations and the compromise or theft of sensitive data from utility operations, emergency service communications, or visual surveillance technologies. Smart city IT vendors may also have access to vast amounts of sensitive data from multiple communities to support the integration of infrastructure services—including sensitive government information and personally identifiable information (PII)—which would be an attractive target for malicious actors,” the agencies said. 

Another major risk category is related to the automation of infrastructure operations, such as traffic management and wastewater management. This automation can introduce new vulnerabilities, and the volume of data and the complexity of automations can lead to reduced visibility. 

In order to address these risks, owners should keep track of the individuals and vendors responsible for the overall system and each segment, ensuring that there is no ambiguity when it comes to roles and responsibilities in order to avoid degrading cybersecurity posture and incident response capabilities.

When it comes to supply chains and vendors, they should be carefully vetted and risks should be assessed.

“This includes scrutinizing vendors from nation-states associated with cyberattacks, or those subject to national legislation requiring them to hand over data to foreign intelligence services,” the agencies said.

Specific recommendations described in the guidance include applying the least privilege principle and implementing a zero trust architecture, enforcing multi-factor authentication, securely managing assets, improving the security of devices, protecting internet-exposed systems, patching systems, conducting training, and developing and exercising incident response and recovery plans. 

The Five Eyes guidance only summarizes the recommendations for securing smart cities, but it also includes links to numerous useful resources provided by various government agencies.

Related: Securing Smart Cities from the Ground Up

Related: Securing Autonomous Vehicles Paves the Way for Smart Cities

Related: Compromised by Connection: 5G Will Unite Cities and Also Put Them at Risk

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Management & Strategy

Anna Tutt, CMO of Oort, shares her experiences and perspectives on how we can accelerate growth of women in cybersecurity.


The UK’s NCSC has issued a security advisory to warn about spearphishing campaigns conducted by two unrelated Russian and Iranian hacker groups.


A new CISA pilot program to warn critical infrastructure organizations if their systems are unpatched against vulnerabilities exploited in ransomware attacks.

Cybersecurity Funding

B2B payment security provider NsKnox raised $17 million in a new funding round that brings the total raised by the company to $35.6 million.


Privacy experts have said they fear pregnancies could be surveilled and the data shared with police or sold to vigilantes.


Google has suspended the Chinese shopping app Pinduoduo on its app store after malware was discovered in versions of the app from other sources.


An Italy-based firm's hacking tools were used to spy on Apple and Android smartphones in Italy and Kazakhstan, Google said Thursday, casting a light...


Steven Mnuchin’s Liberty Strategic Capital acquires majority stake in Dallas, Texas-based Zimperium