Smart City Cyber Security

Cyber Security for the development of Smart Cities

recent posts

about

Cyber Security Consultant and Enterprise Architect with an interest in semantic systems for security, strategy and architectural development.
  • Photo by Tyler Lastovich on Pexels.com

    Cyber Security Capabilities for a Smart City Cyber Security Strategy

    It is important to select the right cyber security capabilities necessary to fulfil the scope and vision for a Smart City and the individual cyber security requirements. There may be potentially over 100 cyber security capabilities needed to support a large Smart City organisation and services. They could be chosen from a best practice framework like NIST CF or taxonomy provided by an organisation with specific expertise. The development of a decision tree may also help to consider the options and necessary choices.

    Capability Selection
    Decision Tree
    1 Where will the Capability be located?
    2 What will the Capability do?
    3 Who is best placed to provide the Capability?
    3.1 Outsourced
    3.2 In-house
    4 Why is the Capability needed?
    5 How is the Capability provided?
    6 etc etc…

    The strategy should explore if the capabilities are to be provided directly, outsourced or a hybrid of the two. Whether or not it is an in-house, hybrid or outsource strategy its success will be dependent upon the right capability mix and how they are defined. Similarly, for service capability, maturity and benchmarking, gaps and challenges should be met with clear capability definition and structure.

    The NIST Cybersecurity Framework is a good starting point for the initial set of key capabilities:
    The Identify Capabilities
    The Detect Capabilities
    The React Capabilities
    The Respond Capabilities
    The Recover Capabilities

    Further reading
    Monitoring Strategies and Design Guides as well as Cyber Security Smart City Strategy
  • Photo by Tyler Lastovich on Pexels.com

    Smart City Cyber Security Strategy

    There will come a point in the development and transition of a City into a Smart City where cyber security becomes paramount and for many cities that point may already have been reached. It is at this point a City must assess its ability to deal with a new threat landscape and prepare a strategy to do so. The key objectives of a Smart City Cyber Security Strategy must be to deliver a new or adapted operating model able to effectively direct, monitor and protect a diverse range of city domains, services and its citizens. As part of this, Smart cities will have crucial decisions to make as to whether to define dedicated security operations, joint or shared security and city operations or outsource all or part of the required capabilities.

    The point of becoming a Smart City is to develop and release new connected technologies and services but that has the potential to increase the risk and threat of attacks. Depending upon the location, population size and scale of the city services, the strategy and operating model will then need to reflect the right range of cyber security capabilities to address this. The following are a series of steps to help the development of that strategy.

    Step 1 – Identify Cyber Security Capabilities to meet strategic vision

    Step 2 – Define the Criteria for each required capability

    Step 3 – Align Standards and Regulation requirements

    Step 4 – Define Functions, Actors, Roles and Responsibilities

    Step 5 – Model the Capability domain

    Step 6 – Integrate the Technology and Data requirements

    Step 7 – Define the Service Model and Requirements

    Step 8 – Define the Operating Model and supporting Views

    Step 9 – Deliver the strategy through a Transformation Plan

    Step 10 – Monitor in-life Change, Performance and Maturity development

    Further reading
    Design Guides for Smart City Cyber Security Strategy
  • Photo by Tyler Lastovich on Pexels.com

    Smart City Cyber Security Ontology

    If there is one lesson to learn from the cyber security incidents that have plagued public and private organisations it is a problem of the lack of knowledge of assets, appropriate configurations and impact assessments. Asset and configuration management has over, the last 20 years, been a troubling story and cyber attacks have benefited from the organisation, especially large global ones, not knowing enough of what their assets are, how they are configured and connected to other assets.

    A large smart city emulates a large organisation in many ways and as more and more interconnected technologies, sensors and devices are fitted into these cities then they need to have a better understanding of what these assets are, how they function, where and with what ownership.

    Ontologies have the ability to help Smart Cities develop necessary classification models of their assets and their interoperability. There are several key Smart Cities Ontologies being developed and three significant ones are:

    OntologyDescription
    SAREF4CITYAn extension of the SAREF ontology for Smart Cities developed by OneM2M
    PAS 182:2014BSI Smart city concept model – Guide to establishing a model for data interoperability
    ISO/IEC DIS 21972An upper level ontology for smart city indicators

    I plan to watch the development of these and other ontologies relating to Smart Cities and also develop associated Smart City Threat Model Ontologies that can use these as upper models.

    I came across a rather fascinating ontology resource site called Lov4IOT

    Almost 500 ontology-based projects for IoT, smart cities, etc. More than 20 domains relevant to IoT referenced such as building, healthcare, robotics, smart grid, smart agriculture, smart transportation, etc. LOV4IoT ontology catalog GUI tables are provided (HTML view).

    Here is a link to another view of this as per Linked Open Vocabularies.

    Here is a link to visualise some of the listed ontologies via WEBVowl (Adjust the FILTER to see further class details)
    km4city, the DISIT Knowledge Model for City and Mobility
    Global City Indicator Foundation Ontology
    Central Government Ontology
    Open 311 Ontology: An Ontology for publishing a city’s non-emergency events.
    The SEAS Building Ontology
    SAREF4EE: the EEbus/Energy@home extension of SAREF
    SAREF: the Smart Appliances REFerence ontology
    GConsent – a consent ontology based on the GDPR
    Cognitive Characteristics Ontology
    AgRelOn, an Agent Relationship Ontology
    PersonLink Ontology
    An ontology to detect activities in a smart home
    IoT-Lite Ontology
    Semantic Sensor Network Ontology

  • Photo by Tyler Lastovich on Pexels.com

    The impetus that drives cyber security

    Following the recent publication of a report on ‘Smart City Cybersecurity’, produced by technology market data analysis firm ABI Research, there have been a series of supporting news articles. Many just covering the basics of the report but a few go on to push the arguments. Here are a few of the more informative.

    SiteArticle
    Government EuropaCybersecurity in smart cities: lack of funding increases vulnerabilities
    HelpnetsecurityCybersecurity challenges for smart cities: Key issues and top threats
    ESI AfricaLack of investments in cybersecurity puts industries in a vulnerable position
    NextGovThe Dangers in Smart Cities
    ITPROAre smart cities a disaster waiting to happen?

    The recent cyber attack in Texas where 22 cities were impacted culminated in millions being demanded in payment as part of a massive Ransomeware attack. – Two Texas towns have publicly commented on the attack, verifying that they were breached. The city of Borger issued a statement notifying citizens that their ability to process all payments is offline indefinitely, and that birth and death certificates cannot be issued at this time. The city of Keene also issued a statement indicating that they are not able to process payments or access the accounts of utility customers.

    Perhaps Governments and Cities need to follow in the example of the US DoD. The article DOD Will Require Vendor Cybersecurity Certifications By This Time Next Year highlights the requirements:

    The department has been kicking around the idea of creating a certification standard for defense industrial base companies to ensure vendors’ cybersecurity posture was adequate to handle controlled and classified information. That became an official effort in March, and Wednesday the department released the first draft Cybersecurity Maturity Model Certification, or CMMC, outline for public comment.

    If Governments required Smart Cities to comply with Cyber Security Maturity Model Certification and the Smart Cities demanded their vendors and service providers do the same then that might create a better cyber security solution.

    Further Reading
    Smart City Cyber Maturity and Smart City Security Controls
  • Photo by Tyler Lastovich on Pexels.com

    Cyber Security capability for Smart Cities

    The term Capability is often used in business reports and publications to describe something particular to a person, technology or an organisation but in many cases it is often less clear as to what exactly that “capability” is, how it materialises or is managed. So for the sake of clarity and understanding i am going to use the definitions from TOGAF 9 to define governance, function, service and capability, show their relationships and how together they can, through a development process, turn a conceptual term into a real world thing.

    Here are the following TOGAF 9 definitions :

    Capability
    An ability that an organization, person, or system possesses. Capabilities are typically expressed in general and high-level terms and typically require a combination of organization, people, processes, and technology to achieve.

    As the definition outlines, a capability is composed of multiple elements. As all things within an organisation are governed by something – internal policy or external regulation – the top level definition begins with:

    Business Governance
    Concerned with ensuring that the business processes and policies (and their operation) deliver the business outcomes and adhere to relevant business regulation.
    Business Function
    Delivers business capabilities closely aligned to an organization, but not necessarily explicitly governed by the organization.
    Business Service
    Supports business capabilities through an explicitly defined interface and is explicitly governed by an organization.
    Capability Architecture
    A highly detailed description of the architectural approach to realize a particular solution or solution aspect.
    Capability Increment
    A discrete portion of a capability architecture that delivers specific value. When all increments have been completed, the capability has been realized.

    By breaking a capability down into its components and its relationships to other concepts it should make it clearer as to what a capability is and how it needs to be designed. Cities or Smart cities should have some cyber security capability so now it is a case of improving and maturing existing ones or defining new capabilities to accommodate the changes and advancements smart cities are making.

    Further reading
    For more information on Smart City Cyber Security Strategies and Capability Design Guides.
  • Photo by Tyler Lastovich on Pexels.com

    Lessons to be learned from recent attacks to cities

    A recent article from IOT World highlights that real world events can trigger cyber attacks either as protest or retaliation.

    City Security: How Fort Lauderdale Deals with Cyber Threats

    The article describes:

    • In 2014, the city of Ferguson, Mo. was hit with a cyberattack in apparent retaliation for the police shooting of the unarmed teen Michael Brown.
    • Fort Lauderdale – A wake-up call arrived on “Cyber Monday,” December 1, 2014 in the form of a massive DDoS attack from the Anonymous hacking collective targeting the city’s website and that of its police. The Anonymous group released a video of a speaker donning a Guy Fawkes mask, which had become emblematic for the hacking collective, insisting Fort Lauderdale abandon three controversial ordinances within 24 hours related to homelessness and panhandling.

    These examples highlight not only the need for an effective Smart City cyber strategy but also the use of threat intelligence and integration of proactive cyber security capabilities, such as Situational Awareness, with City Governance and Communications. If events happening in a city or controversial news is released to the public that may attract unwanted attention cyber security services may need to proactively consider the impact.

    This interesting quote from the article shows just how many attacks a large city now faces each year:

    Michael Lee Sherwood, the director of information technology for the city of Las Vegas, which has launched one of the most ambitious smart city programs in the country. “Guess how many attacks you think the city of Las Vegas gets in a year,” Sherwood said at the CIO Visions Leadership Summit conference in Las Vegas. “Half a billion. Right now we’re being attacked. And when we have a big event in Las Vegas, they spike up.”

    Further Consideration
    Development of Smart City Cyber Strategy and Threat Model

    Rating: 1 out of 5.
  • Photo by Tyler Lastovich on Pexels.com

    Smart Cities, cyber security and cybernetics

    It is important to be aware of and take note from Ashby’s Law of Requisite Variety when addressing the problem of cyber security for a smart city.

    If a system is to be stable, the number of states of its control mechanism must be greater than or equal to the number of states in the system being controlled. Ashby states the law as “variety can destroy variety”

    The best explanation to how this applies can be found through Stafford Beer’s explanation video.

    Only variety can absorb variety

    The threat landscape of a Smart City offers the Attacker a huge variety of opportunities through the predicted numbers of devices, sensors and systems for exploitation as well as a range of targets. As Ashby’s law and Stafford Beer describe, the system required to control another system needs an equal or greater range of variety to overcome and manage it. Thus the scale of cyber security technology, monitoring and capability must be greater in variety than the variety afforded to the Attacker.

    To further explain this it is also useful to consider – Basis for the Viable System Model by Stafford Beer – as a means to help address the cyber security strategy for a smart city and the issues faced.

    Further reading
    Monitoring Strategies and Design Guides

    Rating: 1 out of 5.
  • Photo by Tyler Lastovich on Pexels.com

    City and home smart cameras, eavesdropping, surveillance and safety

    Two events this year show what can happen with home security cameras.

    1. An Illinois couple said a hacker spoke to their baby through one of their Nest security cameras and then later hurled obscenities at them, CBS station WBBM-TV reports. Arjun Sud told the station he was outside his 7-month-old son’s room Sunday outside Chicago and he heard someone talking. Later that night, Arjun Sud noticed the Nest thermostat they have upstairs had been raised to 90 degrees. He suspected the hacker was behind that too.

    2. Laura Lyons of Orinda, California told the San Jose Mercury News that her smart home security camera was infiltrated after it said on Sunday that three North Korean missiles were headed to Los Angeles, Chicago and Ohio. The warning was preceded by a blaring alarm, Lyons told the newspaper. The message said the US was retaliating and affected areas had three hours to evacuate, she said. Lyons checked news stations for coverage of the apparent attack, but found nothing. When she realized the message was coming from the Nest Cam sitting above her TV, she called the company, which is part of Google, to find out what was going on.

    Further news on this from LiveMINT includes:

    Connected cameras accounted for 15.2% of IoT attacks in 2018, up from 3.5% in 2017, highlighting how their role has increased significantly in just one year, points out Ritesh Chopra, country manager-consumer business unit, Symantec.

    According to Kaspersky, most cameras provide access to feed through a web interface, which provides a full-fledged management console to users. In other words, each camera has its own little website. The problem is that these websites and broadcasts can be easily found by specialized search systems such as Shodan and Censys. “With access to smart cameras, cybercriminals could also spy on the owners and use that knowledge to decide a good time to break into their home,” rues Chopra.

    As per Kaspersky, the problem with most smart cameras is that both users and camera makers prioritize ease-of-use over device security. That’s why surveillance cameras can be easily hacked with brute force. A major challenge with smart cameras is that they lack both memory and compute power to run a security solution on top.

  • Photo by Tyler Lastovich on Pexels.com

    Smart City lack of investment in cybersecurity

    A recently published report from ABI Research highlights that the lack of investment into Smart City Cyber Security will have some serious consequences.

    Report from ABI Research
    Press release coverage of the report at Smart Cities World

    To quote from ABI Research summary:

    On top of strategic recommendations, this report offers three distinct smart city cybersecurity frameworks aimed to assist implementers tailor their needs accordingly, each of which offers unique insights and deep analysis into multiple technology layers, vertical considerations and standards using the connected energy grid as a key example. Additionally, a market data section has been included which sheds more light into smart city wide-area network (WAN), offers segmentation by end markets (e.g. smart meters, video surveillance, building automation, etc.) and identifies key market trends as well as cybersecurity shortcomings.

    It will be interesting to read what their three cyber security frameworks describe and cover.

    Quoting ABI Research:

    1. SMART CITY CYBERSECURITY FRAMEWORKS

    1. The Vertical Approach Framework
    2. The Technology Layer Framework
    3. The Unified Standards-Driven Framework
  • Photo by Tyler Lastovich on Pexels.com

    Management of Cities

    Whilst the structure and services of global cities are very similar there are very different ways in which cities are governed and administrated. This post will consider three different countries and cities:

    • London, UK
    • Paris, France
    • New York, USA

    The way in which cities are governed and administered will create some interesting cyber security challenges as each city develops smart technologies, services and greater inter-connectivity and integration. Whatever the management system across a city it may well be that a city of a certain size and population will require an integrated cyber security monitoring and operations strategy. This will then potentially cover multiple service types, third parties and stakeholders making for quite a complex arrangement.

    Considerations

    Resources
    Roles, responsibilities and demarcation with a Smart City Cyber Security strategy and governance model – part of the Smart City Cyber Security Monitoring Strategy and Smart City Threat Model.

    City Governance Structures

    London

    The table below shows the different formations and tier structures of UK Cities and London. Depending upon the city certain services may be managed across the tiers depending upon the responsibility.

    ArrangementUpper tier authorityLower tier authority
    Non-metropolitan counties/Non-metropolitan districtswaste management, education, libraries, social services, transport, strategic planning, consumer protection, police, firehousing, waste collection, council tax collection, local planning, licensing, cemeteries and crematoria
    Unitary authoritieshousing, waste management, waste collection, council tax collection, education, libraries, social services, transport, planning, consumer protection, licensing, cemeteries and crematoria, police and fire come under shire councils
    Metropolitan boroughshousing, waste collection, council tax collection, education, libraries, social services, transport, planning, consumer protection, licensing, police, fire, cemeteries and crematoria
    Greater London/London boroughstransport, strategic planning, regional development, police, firehousing, waste collection, council tax collection, education, libraries, social services, local planning, consumer protection, licensing, cemeteries and crematoria
    Combined authorities/constituent authoritiestransport, economic development, regeneration & various (depends on devolution deal)Dependent on the type and combined authority arrangement

    Paris

    StructureDescription
    20 Arrondissements – administrative districtsEach arrondissements has its own town hall and a directly elected council (conseil d’arrondissement), which, in turn, elects an arrondissement mayor. A selection of members from each arrondissement council form the Council of Paris (conseil de Paris), which, in turn, elects the mayor of Paris.

    New York

    StructureDescription
    New York has a mayor-council system. The mayor is elected to a four-year term and is responsible for the administration of city government. The New York City Council is a unicameral body consisting of 51 membersIn the government of New York City, the heads of about 50 city departments are appointed by the mayor, and the mayor also appoints several Deputy Mayors to head major offices within the executive branch of the city government.
    PeopleNew York City government employs 325,000 people
    Borough and community governmentNew York City is composed of five boroughs or counties, collectively comprising 59 community districts
    New York Agencies50 city departments, managed by Heads of Department who are appointed by the mayor

    Common City Services

    The table below is a collection of city service types, this will, of course, differ greatly across city size and location, covering the main service areas offered in and by cities to the citizens. These services may be locally managed and governed or centrally governed and locally managed and those responsible for the strategy and transformation of service capabilities will drive the subsequent change.

    Area Smart City Transformation Change impact – High / Low Description
    HousingHighDevelopment of new smart homes and upgrading of existing properties.
    Waste managementHighNew technologies to configure, monitor and manage city waste management.
    waste collectionHighNew technologies and sensors to monitor and control collection.
    Tax collection, Revenues and BenefitsLowPart of Smart Government strategy. May include smart citizen solutions
    EducationHighSmart school technology, student technologies and integration with smart homes, mobility, commercial services.
    LibrariesMediumDigital services and technologies city citizens. May be focal point of free services
    Social servicesHighPart of Smart Government strategy as well as city integration of health services and smart technologies within homes
    TransportHighConnected, autonomous vehicles, logistics, delivery, passenger services through integration across cities, homes and transport services.
    Urban planningHighNew governance and administration models to define, design and manage smart cities
    Consumer protectionLowPolicy for citizen data protection, ecommerce and smart services
    LicensingLowPolicy for smart technology in Licensed Premises
    Cemeteries and crematoriaLowSmart technology for location or gravestone
    PoliceHighIncluding personal devices, mobility, street monitoring, AI and Machine Learning systems
    FireHighIncluding personal devices, mobility and surveillance
    AmbulanceHighIncluding personal devices, connected mobility solutions.
    HealthHighIncluding personal devices, connected Home and Hospital solutions.
    Infrastructure – lighting, signage, communicationsHighSmart kiosk, lamppost, Street IOT, CCTV, smart signage and interaction with wearable devices.
    SecurityHighCCTV, recognition systems, Home and Commercial building monitoring
    Culture – events, artsHighPersonal device, wearable device interaction, interactive events