Several leading government security agencies have published new advice designed to help smart city stakeholders build protection into new systems from the ground up.
Smart City Cybersecurity Best Practices was published by the UK’s National Cyber Security Center (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), and their equivalents in Canada, Australia, and New Zealand.
For more information on smart city threats, check out our Smart City Alert where experts detail LoRaWAN security issues.
Presented at CYBERUK 2023, the paper argues that the “intrinsic value of large data sets and the potential vulnerabilities of digital systems” makes smart city technology a threat to financially motivated cybercriminals, nation states, terrorists and hacktivists. I warn you that you are in danger.
A successful attack could not only lead to the theft of sensitive data, but could also disrupt critical services and even cause physical harm or loss of life, the report notes.
One of the challenges for defenders is consolidating previously separate infrastructure systems into a single network environment, expanding the digital attack surface of each participating organization while increasing visibility to security teams. more difficult to control and control.
The risk also increases as the number of compromised endpoints and network connections increases due to large and complex supply chains and increased use of automation, the report adds.
“Connected places have the potential to make citizens’ everyday lives safer and more resilient. However, it is important to balance the benefits in a way that protects security and data privacy.” NCSC CEO Lindy Cameron said.
“Our new joint guidance will help communities manage the risks involved in integrating connected technologies into their infrastructure and take steps to protect their systems and data from online threats.”
Key recommendations for smart city communities include:
- Safe planning and design, including least privilege principle, multi-factor authentication, zero trust architecture, rapid patching, device security, and securing internet-facing services
- Proactive supply chain risk management covering software supply chain, IoT and device supply chain, and managed/cloud service providers
- Operational resilience, including system and data backup, employee training, and incident response and recovery
