CS1803

smart cities
smart city, it needs to collect and analyse
personal data from the users, so that it can
tell what works and what does not. To be
as effective as possible, they need to collect
data from users about their movements,
peak traffic times, transportation mode
preferences, streetlight data, traffic camera
data, payment options and more.
All this information then needs to be
stored somewhere, whether this is a Cloud
server or under the control of a municipal
IT department. Doing this is a necessity,
but the centralisation of information and
control of an entire municipal
transportation system is putting a lot of
eggs in a single basket. As we've seen,
though, putting so much precious data in
one location is an invitation for trouble.
2017 saw a rise in cyber-attacks that
purposely target private data, whether
to use as ransom or to release online and
cause chaos. Uber and Forever 21 were
just two of the many companies to suffer
massive data breaches in 2017 and, in
recognition of the very real risks to people's
personal information, 2018 sees the
introduction of the GDPR [in May], a new
regulation that will force companies to
take more responsibility for the protection
of customer data [see page 24].
If enterprises want to continue the
upkeep of smart cities, then the basket that
holds all this information must be designed
for maximum security, controlled access
and limited information portability.
According to Von Welch, director of the
Center for Applied Cyber Security Research
at Indiana University: "We have a lot of
companies making new devices for the
urban Internet of Things that have not
made computers or written software
before." This is a critical warning to
intelligent urban traffic planners. Get the
IT security team involved early. There is
great technology available to help protect
and defend large centralised networks.
Robust security requires many specialised
appliances, so an intelligent connectivity
solution should also be part of the initial
plan.
Alastair Hartrup, global CEO, Network
Critical.
Without properly planned network
protection and rapid attack remediation, the
commerce, movement and safety of entire
cities could be vulnerable to a malicious
breach. Traffic signals could be manipulated;
electronic road signs could be hacked to
provide misinformation; emergency
responders could be blocked from trouble
spots; funds could be stolen; or bank
accounts compromised.
We've seen this already: in 2014, security
researchers at the University of Michigan
were able to hack traffic lights of nearly 100
intersections that they found to have no
security controls at all. This hack was just an
experiment to point out the flaws; imagine if
it was performed by someone with malicious
intent.
This is all scary stuff, but not impossible to
manage. If proper network visibility, threat
landscape reduction, data loss protection,
data backup and employee training are
planned and implemented early on, then
Utopia may, in fact, be possible, without
opening the door to a municipal apocalypse.
www.computingsecurity.co.uk @CSMagAndAwards March/April 2018 computing security
19