Smart City Cyber Security

Cyber Security for the development of Smart Cities

recent posts

about

Cyber Security Consultant and Enterprise Architect with an interest in semantic systems for security, strategy and architectural development.
  • Photo by Tyler Lastovich on Pexels.com

    Connected Homes, Communities and Cities Threat Environment

    As Smart Cities develop, the relationship between the Home, Communities and the City as a whole will become ever more integrated and connected. Each of these can be viewed independently, paired or all together when considering the specific threat environment and landscape. By threat environment and landscape i mean the broader make up of the city and the narrower view of city assets and what is immediate to it. (I will explore the idea of the threat environment and landscapes in the further developments of Smart City Security Taxonomy, Smart City Security Ontology and a Smart City Threat Model).

    To be able to understand and use a threat model for a Smart City you will need to define the context from the top down.

    • The City will have city multiple sensors, devices, services and connectivity serving specific needs or the city as a whole, have particular domains as size, geography and functions and will incorporate public and private organisations managing and delivering services.
    • A community or designated zone within a city may have specific sensors, devices, services and connectivity dedicated to serving the community, resident’s homes and businesses as well as the City.
    • The Connected Home will contain sensors, personal and fitted devices that connect via mobile or wifi and possibly new emerging connectivity to cloud, street, community and city services.

    This makes for a very complex Threat Landscape. Before setting out to monitor this there will be a need to map the cities technological structure a monitoring framework and I will examine the frameworks and monitoring guidelines provided by NIST and the UK’s NCSC.

    Considerations:

    NCSC MonitoringSmart City
    Business traffic crossing a boundary
    • Traffic passing from connected home to connected community or city service.
    Activity at a boundary
    • Suspicious activity detected by connected home wifi or externally facing device
    • Suspicious activity detected by connected community sensor or device located on street or in community space.
    Session activity by user & work station
    • Suspicious activity detected through the work operations of City Official performing maintenance to smart sensor or device.
    • Suspicious activity detected through the action of Resident while modifying Home device provided by Smart City or Community.

    These are three examples of how at a conceptual level a framework for cyber security monitoring can be applied to Smart Cities. This would need to be further defined at a logical level before being applied to the monitoring requirements of reference data and log or event data needed to monitor and detect anomalies and suspicious activity.

    Further Reading
    A PDF report by IBM looking at vulnerabilities found in a range of Smart City sensors and devices

     

  • Photo by Tyler Lastovich on Pexels.com

    Recent cyber attacks on Cities

    A review of the reported incidents on Hackmageddon shows that there are a variety of City / Public Services attacks emerging.

    TargetOverviewAttack Types / Vector
    Sunderland City CouncilHackers access users’ personal details in a cyber attack on Sunderland City Council’s library database.Data Breech, Compromise, Access
    Louisville Regional Airport Authority (LRAA)Is hit by a ransomware attack.Phishing, Initial Access.
    Broome CountyAn employee email account was compromised between Nov. 20, 2018, and Jan. 2.Phishing, Initial Access, Credential Harvesting.
    Riviera BeachRiviera Beach agrees to pay $600,000 in ransom to hackers who took over its computer system in a ransomware attack.Malware, Phishing
    Borough of WestwoodA data breach that began in December 2018Initial Access, Data Breach
    City of New BedfordThe city of New Bedford is hit by what appears to be a ransomware attack.Malware, Initial Access.
    Onondaga County LibrariesOnondaga County Libraries are hit by a ransomware attack.Malware, Initial Access.

    It is important to note that these attacks need to have sufficient post-incident review, root cause analysis and follow-up vulnerability / Pentesting audits to ensure no repeat of attack and that their compromise does not leave them vulnerable in the future. There may be numerous dormant access points, backdoors and details within Dark Web forums that attackers can use to enable attacks in the future when smarter solutions and services may yield an attacker a richer reward.

    Further consideration
    Smart City Threat Model, Smart City Cyber Security Framework

  • Photo by Tyler Lastovich on Pexels.com

    The House that Google built

    A sign outside Google’s headquarters in Mountain View last year attests to the need for affordable housing.Photo: James Tensuan / Special to The Chronicle 2018
    Approving and constructing new Bay Area housing can take years.Photo: Amy Osborne / Special to The Chronicle

    Google has committed to a $1 billion plan that would help build 20,000 homes in the Bay Area over the next decade. San Francisco Chronicle

    If Google does get the go-ahead to develop new houses then how much of its own technology portfolio will it invest in each of these homes? Whilst Google does not produce all of these items the list of technologies for a smart home is quite long and still growing. The current range includes:

    • Wireless speaker systems
    • TV/Entertainment systems
    • Thermostats
    • Home security & monitoring systems
    • Domestic robots
    • Smoke/CO detectors
    • Lighting
    • Home energy use monitors
    • Door locks
    • Refrigerators
    • Laundry machines
    • Water detectors
    • Utility Meters

    If not Google then perhaps the other Tech majors such as Facebook, Amazon, Apple, Cisco and others may all begin to sponsor or “build” new housing in Smart Cities. If a Smart Home development area consisting of tens or hundreds of homes all fitted with the same technologies encounters a vulnerability does it mean Threat Actors could exploit this vulnerability and thus compromise a lot of houses in one attack?

    Considerations:

    Site Resources
    Connected Home shared technology exploit

  • Photo by Tyler Lastovich on Pexels.com

    Cities, critical infrastructure and maturity

    Whilst technically a City is not deemed Critical National Infrastructure there are or soon will be good reasons to consider capitals and major cities as something critical to the safety, welfare and economy of a country.

    Consider the UK government’s official definition of CNI:

    ‘Those critical elements of infrastructure (namely assets, facilities, systems, networks or processes and the essential workers that operate and facilitate them), the loss or compromise of which could result in:

    a)    Major detrimental impact on the availability, integrity or delivery of essential services – including those services whose integrity, if compromised, could result in significant loss of life or casualties – taking into account significant economic or social impacts; and/or

    b)    Significant impact on national security, national defence, or the functioning of the state.

    As cities today transform themselves into Smart Cities, in the coming years, citizens and services will become ever more dependent upon the smart technology that administers, manages and delivers critical services. As such the current definition of critical infrastructure applies to the concept of a city as a whole and certainly that of a capital or cities with a very large population.

    So the cyber security maturity of a smart city needs to consider the learning and best practice from current CNI organisations and one, in particular, is the guidance developed in the USA called C2M2 – Cybersecurity Capability Maturity Model.

    The model looks at 10 domains of cybersecurity:

    • Risk management
    • Asset, change, and configuration management
    • Identity and access management
    • Threat and vulnerability management
    • Situational awareness
    • Information sharing and communications
    • Event and incident response, continuity of operations
    • Supply chain and external dependencies management
    • Workforce management
    • Cybersecurity program management

    The Department of Energy (DOE) developed the Cybersecurity Capability Maturity Model (C2M2) from the Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2) Version 1.0 by removing sector-specific references and terminology. The ES-C2M2 was developed in support of a White House initiative led by the DOE, in partnership with the Department of Homeland Security (DHS), and in collaboration with private- and public-sector experts. [Department of Energy (DOE)]

    Further Considerations

    Resources
    I plan to explore the lessons and applicability of C2M2 in further research into Smart City Cyber Maturity.

  • Photo by Tyler Lastovich on Pexels.com

    Vulnerabilities and soft targets

    In the first wave of Smart City developments, with proposed projects like Waterfront Toronto and Bleutech Park Las Vegas, these will be designated zones within existing cities. Whilst the Waterfront project has seen some controversy and objections from Toronto residents those that object to these projects may well not be their first inhabitants. Others who are more in favour of the lifestyle and services offered and happy to accept the technology surveillance that entails may also be more trusting of the security that will protect them.

    Ironically, that level of trust may be a trait that exposes them to greater vulnerability to social engineering and susceptible to a cyber attack. Determining vulnerabilities and attacks through social engineering will be examined as part of the development of a Smart City Threat Model.

  • Photo by Tyler Lastovich on Pexels.com

    Who or what is the Weakest Link?

    As the number of devices and systems within Smart Cities will increase dramatically over the next ten years so will the number of vulnerabilities and weaknesses open to exploitation. Yet it may well be that the weakest link in Smart Cities will be the citizens themselves either as inhabitants, tourists or employees.

    As new threat scenarios unfold in the future these will very likely focus in some way around making money for the attacker. Whether that is directly related and targeted to a victim or indirectly where details are harvested and sold to other attackers to exploit. The “smarter” cities become the more likely they are to attract the attention of attackers developing new campaigns or looking to copy shared tactics and techniques used in other cities. The more open connectivity, services and technologies smart cities create the more attractive they become.

    To use and quote Schneier’s Law – Anyone can invent a security system that he or she cannot break. Smart Cities will procure a variety of systems to equip the city to function with varying degrees of security. The resilience and testing of the solution and its security will be dependent upon the thoroughness of the vendor and rigour of the buyer. It is often the sheer ingenuity of the attack actor and their means to find vulnerabilities that surprises the system or service owner. So Smart Cities cannot become complacent nor underestimate the effort attack actors will go to find and exploit a weakness or vulnerability. An attack actor will look at all options and may well conclude that the weakest option to exploit is the humans involved as administrators or users of the system.

    An attack actor will conduct reconnaissance for an attack by either physically visiting the intended site / sites or conduct research remotely through their tools and services such as Google Maps, Streetview etc. They are looking for opportunities and vulnerabilities to exploit and that will involve observing how people use and interact with a system. Often the easiest route for the attack actor is to compromise the account of a user or administrator through a phishing campaign – email, sms or message format. Other options may include spoofing, bribery or coercion.

    I plan to look at the features and criteria of a Smart City Threat Model which will include how humans will play a significant part in the cyber threat to Smart Cities. This work will be found in the Smart City Threat Model Research.

  • Photo by Tyler Lastovich on Pexels.com

    Cyber security best practice for Smart Cities

    There is a range of cyber security best practice guidelines and standards that with some adjustments are very suitable for the design and development of a cyber security strategy and protective monitoring programme. They can be modified to the IOT and ICT architectures, diverse environments and the different public and private sector parties involved. In time more specific guidelines and standards may well evolve but until they do those available today are a good start. These include:

    • NIST Cyber Framework
    • CIS Security Controls
    • MITRE ATT&CK
    • STIX
    • NCSC Monitoring Guidelines
    • ISO 27k
    Further reading…
    I plan to cover this further as part of Monitoring Strategies, Design Guides and a Smart City Threat Model.

  • Photo by Tyler Lastovich on Pexels.com

    Data driven smart cities

    In the next 10 years, the majority of cities across the developed countries in the World will undergo significant transformation to their infrastructure, technologies and services they provide to their citizens. This change will be driven by both Public and Private organisations and a key principle driver of this transformation will be Data. Data is generated by a multitude of sensors or devices to be processed, analysed or transacted by an equally large range of systems to enable a city to function. Judging by what is happening today in 2019 there are already a large number of projects developing new solutions, technologies and services to leverage Data to enable more efficient, effective and innovative city environments. By 2030 it may well be that it is very little in a city that is not supported or serviced by Data.

    Challenges:

    • Guidance, standards and best practice for the development of Smart Cities is limited and quite subjective depending upon the public or private sector organisation that prepared it and security information is limited.
    • Guidance, standards and best practice for cyber security have been developing in maturity were the last 5 years have seen the most development and investment by Governments and specialist organisations but this has been focused mainly on ICT cyber security.
    • Security Technology advancement has surged ahead in the last 5-10 years and often quicker than that of security standards and best practice.
    • There are still major skills shortages in many cyber security areas.
    • Smart city developments, technological advancements and human necessities / dependencies will test cyber security capabilities and service provision.
    Further Reading
    I plan to examine these challenges in several ways in the areas of Classification and Ontologies and Monitoring Strategies.