Managing the Risks Inherent to Smart Cities

Adopting smart city technologies comes with increased risks of technical failures and cyber crime that officials must anticipate and manage, according to a guide released Thursday by the EastWest Institute.

The scale and speed at which smart devices are deployed, their interconnectedness via unstructured networks, and the novelty of the technology all increase a city’s risk of crashes and hacks, the security think tank says.

Appropriate risk management requires that officials establish a framework with a tested incident and emergency response plan—a concept “Smart and Safe: Risk Reduction in Tomorrow’s Cities” outlines.

“The reality is that the smart city and [Internet of Things] devices have been procured in waves at least over a 10- to 15-year period,” said Mark Forman, global head of public sector at the IT company Unisys, who was consulted in writing the guide. “City governments don’t usually have a budget to hire the level of talent to cover all these different generations of cybersecurity risks.”

Add to that the management complexity of juggling a wide array of tech and the public’s distrust that government can keep that information safe, Forman said, and establishing a risk management framework becomes a tall order.

Senior city executives must first decide when and how to connect devices and systems to each other, and only after procuring secure ones, according to the guide. Secure devices and systems are certified, while the guide suggests that cities make sure that they patch and upgrade them regularly, change default passwords, encrypt communication, and strongly authenticate users.

Mapping the network is key to ensuring data goes only where it’s intended, the guide adds.

Secondly, a smart city network must be resilient enough to continue delivering critical services like public safety at predetermined levels in spite of glitches or attacks.

“Nobody’s quite figured out how to be totally resilient,” Forman said.