Securing Smart Cities Systems and Services: A Risk‐Based Analytics‐Driven Approach

A smart city can be defined as a city that uses technology to automate and improve its services, making citizens' lives better. Smart cities solutions include traffic control systems, street lighting, smart grid, public transportation information systems, traffic cameras and surveillance, city management systems, seismic activity sensors, and many other systems.Due to the diversity of those services, smart cities solutions suffer from a large cybersecurity attack surface, which creates complexity, interdependency, and chain reactions in case of a single failure. This is due to several factors including that new technologies are being deployed in an ad hoc manner and without any security testing, weak encryption schemes in wireless Internet of Things (
IoT
) devices, lack of coordination, and communication on security incidents.Smart cities represent a very interesting target for different cyberattackers ranging from cybercriminals interested in extracting money out of local governments (e.g., ransomware) to hacktivists who use cyber‐attacks to advance political or social agendas (e.g., cyberattacks on the cities holding major events), and finally cyber‐terrorism. Recent incidents affecting city services may be an indication of how severe cybersecurity attacks on smart cities can be. In May 2017, several National Health Service (
NHS
) hospitals in the
UK
were locked out of their systems, and doctors could not have access to patient records. Emergency rooms were out of service after the largest ransomware attack on record. In November 2013, the Bay Area Rapid Transit (
BART
) service shutdown affecting 19 trains and more than 1000 passengers. In August 2003, the Northeast blackout was caused by a software bug, which affected 55 million users.In this chapter, we propose a risk‐based analytics‐driven approach to design and operate smart cities' critical infrastructure (e.g., communication, transportation, and energy). This approach integrates the National Institute of Standards and Technology (
NIST
) Cybersecurity Framework (
NIST
,) with design science methodology and enables that with big data analytics (descriptive, predictive, prescriptive) fusion center.