Smart cities spur new thinking on technology risks

KEY MESSAGES

• Smart city technologies could create unforeseen exposures. Resilience must be built into design and operation.
• Civic leaders need to understand the opportunities and potential risks, which are not limited to technology.
• Civic leaders and IT specialists require new skills and approaches to collaborate, understand and manage the risks.

What is a smart city?

There is no universally accepted definition of a smart city, but they are best thought of as places that use the power of digital technology, data analysis and Internet of Things (IoT) sensors to improve liveability while managing resources efficiently and sustainably.

At a basic level this can include real-time information for passengers about public transport systems, streetlights that dim when sensors detect no one is around, or providing police with crime-rate data to help them understand where resources can be best deployed.

During the pandemic, public health authorities relied on subject matter experts who used data to track the daily spread of Covid and help plan their response to the pandemic. This model of decision-making illustrates how smart cities can use technology and sensors connected to the IoT to provide leaders with data related to almost any problem facing a city.

How smart cities work

Automation will take decision-making from humans and place it with machines. Smart systems that regulate the flow of traffic through a city can make decisions instantly, as opposed to minutes or hours it might take a person. Public health, waste management, transportation, crime, climate resilience, urban planning, economic development and even democracy can all be improved.

Helsinki, Barcelona, New York and Singapore might be considered trailblazers, but all cities in the developed world have elements of “smartness”.

• Barcelona provides people with real-time data about air quality in its streets.
• Helsinki uses a driver advisory system to manage public transport and reduce energy usage across its public transport network.
• London uses data to predict when components of their underground trains are likely to fail. Maintenance can happen before trains must be removed from service,improving service levels for everyone.
• Edinburgh uses sensors embedded in bins to alert the city when waste needs to be collected.

New threats arise

As smart city technology is implemented, a patchwork of systems that are interdependent and controlled by different organisations will develop. As with many technological developments, people will become reliant on these systems, perhaps without realising it until the system is unavailable for some reason.

As smart cities integrate data and communications along with IoT devices from various locations, the potential disruption for society and communities increases. This is why cyber risk is increasingly seen as an ESG challenge.

In a time of volatile geopolitics, smart cities are a lucrative target for cybercriminals supporting nation state strategies. A malicious attack on the integrity or availability of the systems could have a major impact on the day-to-day operations of a city and the lives of citizens.

Implications for Leaders

The rise of smart cities brings great potential, but civic and business leaders with responsibility for public services must also consider resilience, understanding that:
• Ethical considerations must be built in to avoid unintentionally reinforcing bias or prejudice.
• All digital systems are subject to downtime and exposure to cyber risk.
• Smart cities depend on the availability of high quality, and sometimes sensitive, data.
• Automated decision-making can lead to a phenomenon called the paradox of automation, whereby people can become less competent when required to step in for a failing system.
• Different skillsets are needed to manage, implement, and oversee digital systems.
• Cities must avoid becoming overly reliant on individual vendors or ‘black box’ systems that cannot be audited or easily understood.
• Finally, the interconnected nature of smart city systems means that a compromise in one area could potentially impact other areas, creating a sequence of failures.

Managing risks in smart cities

With some tweaks, the approach to managing cyber risk can be adapted for smart cities, starting with an assessment of risks and vulnerabilities. Some of the key controls to consider in safeguarding smart cities are:

1. Build security, redundancy, and resilience measures into system design and operation to minimise disruption caused by cyber incidents.
2. Keep all software and firmware up to date with security patches to address vulnerabilities.
3. Implement strict access controls and authentication mechanisms to ensure only authorised personnel can access critical systems and sensitive information.
4. Develop and rehearse incident management plans that involve multiple agencies and respond when systems are attacked or unavailable.
5. Implement an ethical framework to shape how smart city technology is deployed and data is used.

Smart city technology is expected to become more widely adopted, resulting in cities that are more sustainable, liveable and better able to provide for the needs of citizens. To deliver these solutions sustainably, new skillsets are required to lead the change and manage the risks.

Zurich Resilience Solutions offer a range of services and expert advice to help organizations understand, assess and manage cyber risks. For more information, please get in touch with one of our experts below.

Arunava Banerjee
Cyber Risk Consulting Lead UK
Zurich Resilience Solutions
Get in touch

Vivien Bilquez
Global Head of Cyber Resilience
Zurich Resilience Solutions
Get in touch