How to create smart security for smart cities

Smart cities promise greater operational efficiency, increased environmental and financial sustainability and a new level of responsiveness to the needs of residents and visitors. However, this new “intelligence” requires sending information from millions of internet-of-things sensors to the cloud, significantly increasing cybersecurity risks. Governments planning a smart city strategy must accept that they may become a favorite target of attackers.

While most cybersecurity initiatives focus on preventing attacks, cyber defenses will never be perfect because they depend on humans doing the right thing -- and attackers know how to prey on human vulnerabilities, including carelessness, fear and a desire to respond to pleas for help. So while working to minimize the risk of attack, governments must develop a resilient infrastructure that minimizes the impact of breaches.

Successful cybersecurity requires good cyber hygiene and effective cybersecurity practices. Instead of pretending their patients will never get sick, doctors recommend minimizing the risk of sickness through good hygiene -- frequent hand washing, eliminating bacteria around the house, etc. -- then bolstering patients’ defenses with healthy practices, such as eating well and exercising. This way, inevitable illnesses tend to have less impact.

Technology for good cyber hygiene

Today, most government agencies rely on multiple-point solutions to block cyberattacks. While many of these products are excellent, the disconnect between the individual solutions creates security gaps. Effective cyber hygiene requires a single, centralized solution for managing and protecting the entire network. For several years, companies have used software-defined wide-area networking to centralize and simplify network management. In 2019, Gartner defined a new solution category: secure access service edge (SASE), which combines an SD-WAN with network security services.

The goal of SASE is to inspect traffic once and apply consistent policies across the entire infrastructure, including at the edge and across multiple clouds. It eliminates the complexity of applying policies as data crosses separate network borders, which often creates security and compliance vulnerabilities. The SASE inspects all traffic without latency and consistently applies security measures -- such as next-generation firewalls, intrusion-detection and anti-malware scanning -- all according to the agency’s policies.

A SASE that is delivered as an end-to-end fully managed service also eliminates the need to constantly upgrade, patch and rethink every aspect of the network. Instead, the as-a-service delivery model increases network flexibility, scalability, security and performance, while optimizing IT resources.

Healthy cyber living

While a SASE can establish basic cyber hygiene, smart cities must still practice “a healthy lifestyle.” This includes putting the right people and processes in place to minimize risk. For example, because human error is a common cause of breaches, agencies train everyone who handles data on their individual responsibilities for protecting that data, including securing social media and email accounts, backing up data where required, keeping all devices and applications not managed by the agency up to date and learning to avoid phishing and spear-phishing scams.

Many agencies have made great strides in promoting these healthy practices; however, most still ignore perhaps the most important cyber defense preparation: a robust incident response (IR) plan that can minimize data loss, the financial impact and the time to restore processes and services.

An effective IR plan requires:

• Preparedness – Build a quality IR team. Security engineers should have the technical skills to uncover and defend against attacks, as well as the social skills to connect with colleagues when a breach occurs. Team members may also include compliance officers, human resources managers, attorneys and public relations specialists. The team should be involved in helping to develop cyber policies and an IR communications plan to ensure timely delivery of information to internal and external stakeholders.
• Breach detection – Arm the IR team with 24/7 monitoring and detection tools that can help them understand the type of incident, whether it's malware, phishing or denial-of-service. Since many incidents are discovered by external parties, have a visible point of contact who can be easily reached.
• Triage – Determine whether attackers are still in the network and what the current threat level is. Combine all available information from the network with the latest threat intelligence to formulate the most effective response.
• Remediation – Find and eradicate the cause of the threat. Back up all affected systems to preserve their current state for later forensics and then proceed with any required service restoration. Communicate with stakeholders and demonstrate the agency's control of the situation.

Building an effective cyber defense is hard, but governments can ensure their smart city initiatives maximize benefits and minimize risks by starting with a SASE solution to create a solid foundation of good cyber hygiene and then establishing healthy cyber practices that include a robust incident response plan.