Here we are at section 6.2 and
these are some more super important takeaways of a smart CDC.
And in this section. I'm going to be talking about some
real-world threats to Smart cities. We identified
the various types of smart cities, and
it brought in a previous section and what they can offer
our communities, especially in the future, but
let's take a moment to explore the various serious.
Facing these feature cities as are built
environments, become more and more digital. The
also become more open to attack and cyber
attacks are clearly on the rise. And the minis is
bodies are becoming easy easy targets. So,
your city desperately needs your help to
secure its own future.
Before I get into the many ways that cyber attacks
are impacting our cities, and
what you can do to help them. It's good to kind of take a
quick break that a quick pause. And just look back on the last
section, which talks about privacy and digital rights
for us, collectively as Citizens. Because
as much as the city's try, they
you know, they'll make mistakes. And so the next two
examples are some example, mistakes on.
Not just how the
Technologies were breached but how that affects our privacy
and potential Collective rights?
So, in the many projects I work on, there's a very, very fine
line between privacy and insights and
for the city's surveillance versus
security. So this one
example is, again a recent example, the
city south to a slide in universe as a very, famous university, and
they've deployed 350 classroom
sensors. Basically to count the number of people occupying.
The entrances in classrooms lecture
Halls, as a tool to
Combat the coronavirus period. This
this was this had a huge made, big
news, lots of Fallout from
the University for three reasons. One is
the Privacy that the, the scanners
that were told that were installed in the classrooms had
been much more than just count people. It could also detect
the sex, whether it was a man or female
the age. I was a child or adult height in
walking boots, etcetera, and that was unbeknownst to the students.
It's so that was one. No. No, the
second one is the outdated security. So the
scanners or
publicly accessible by a URL. That wasn't even a.
It was just a normal HTTP
URL. So you could
have Googled the school and the classroom
scanners and come up to the page and with a
few attempts might have been able to logged in so security.
Again, it was super important here.
Not to have these types of invasive Technologies available on
some sort of without a secure HTTP
address or URL address. There's
also the legal in the moral grounds. So there
are very very strict guidelines to
deploying these types of devices in any
space. Whether it's indoors Outdoors, public
space classrooms Etc.
If the devices are doing
more than what it's told to do, it's illegal. So
So, it was, there's a lot of egg in the face of
lightning University, who have now, just
taken down the cameras to better, find to
find a better way to count occupancy of
their schools and classrooms.
The next big No-No took place in Rotterdam last
year. So the what
had happened is that they deployed a lot of
these scan cars which are basically cars. They drive around
with 360 degree cameras on top counting
license plates to issue, parking
violations or whatnot. And
in this case, the same cars were doing
being deployed into public parks and squares and
whatnot.
To detect safe, social distancing between people and
once detected, the authorities would
come and issue fines. So this was a big problem
on three fronts, one is that normally the
municipality and the police have to be performing these
types of tests with Technologies within
for the public. So that
the public is informed in way, in
advance to know what these Technologies are and how it
helps either, keep their street secure or is
it just
Surveillance tool. The second
reason is the CCTV versus mobile surveillance.
So what that means is normally we
look up and around our cities and we
see CCTV cameras, which are fixed locations. We can see the cameras
as objects mounted on the facades. But
when these cameras moving around, it's it's it's,
it's much more difficult. So, is this a
major violation here in the in the Netherlands? Because the
public needs to be aware?
When recordings are being made. And
if the camp, if the images are being collected on a, from
a, from a car, or some other mobile device, it's
unexpected and therefore illegal. And the
third reason, as I mentioned earlier, section proportionality.
So the choice of insights versus invasiveness
is key. And so, in this case, it
completely went off the rails in terms of proportionality because
most of these images were stored
longer than seven days, which is much
longer than
Terry, and it was completely Overkill because
the task in this canned, was easily
remedied by eye detection and
then using walkie-talkies to contact
their colleagues to go into the parks
or spaces to make sure that there was no any overcrowding
during the corona lockdowns. So,
these are again, another examples of
insights versus privacy
and the
The, these are important because we
have to decide what kinds of cities we want to live in. Yes.
This is a as the city's get smarter with
their Technologies. It doesn't necessarily mean,
it's getting safer. So before I
get into the next section about all the threats and
risks facing our cities, we need to account
for what kind of city do we want to live in
collectively and on a
social level.
There are many reasons to harden and future-proof your smart
city, but we need to know what the threats types are,
and what kinds of things get stolen. When
attack occurs. There are lots of reasons why
these attacks happen, but they're certainly on the increase
in number in scope and for
good reason and because in this section, we're going to discuss a
because it's big money.
So here are four reasons why municipalities in the public need cybersecurity?
Legacy, budgets, Talent leadership
are kinds of terms that
you can use apply anywhere, but insert
and smart cities. It becomes even more urgent, especially
as it relates to security. So, Inlet
Legacy. Lots of city systems
are old, you know, who knows using Windows 95
systems, outdated and
based on very, very old kinds of systems that
you need to constantly update or
may not
Be compatible to some of the newer Technologies budgets,
are the kind
of one of the largest deciding factors in investment
in Smart City Technologies. There's very little
understanding from municipalities why
they need to be investing in these
kinds of solutions because the benefits aren't so clear and
that once the budgets budgets
have been approved and there's limited resources and budgets for
actual security. So
Up to you and me basically to
create those arguments to make sure that there's enough
budgets to secure. The city hall,
Talent is a reality check,
most governments employee legal
experts or marketing Communications experts.
They have little in-house
knowledge as it as it relates to security. So
there's a lot of skill sets out there that need to be introduced
and this
This is important because when you have City
governments, that have an IT team that
can create a strategy in division, two to
prevent attacks and prevent
breaches. That's money. Well, spent leadership
is also one of my most frustrating
kinds of points. It's, it's
something that you see time and time again, especially
in the US, where you have super old
political parties.
Represent representing an era that
doesn't exist today and they don't even know
and understand how Facebook Works. Google works
Uber works. So it's very understand. It's
very hard to find those leaders that will go to
bat and and find those. It security people
that can create a very clear vision and
a system to basically hard in
your city, future-proof your city, and that should be a priority.
So in this diagram, we very
clearly illustrate that cyber attacks are on
the rise and cities. And so what's
these infographics start explaining is that
there's a lot of equity experts around the world estimate
that ransomware attacks happen, every
11 seconds this year in 2021, u.s.
Ransom attacks calls around, 15 working
days, downed due
to down systems and that's expensive.
Of thinking about all the staff and
all the support teams. That is very, very
expensive. The average cost of ransomware recovery
in the u.s. Anyway, is calculated 1.85
million dollars. So that
already starts underlining. The clear
business model behind all of these attacks, because
cities are so stupid, and because
they're so outdated, because they don't have
the resources or the skill sets. They can make a
lot of
money with ransomware and just
one single example of a payout 4.5
million dollars and
the in total, of course, these
combined surpassed 7.5 billion just
in 2019. So these
are just kind of like fun, info graphic illustrations to
underscore that this is a
big business for several, you know, criminals and
hacker.
So in this in this illustration is Crystal Clear, Municipal
data breaches are on the rise. And
this is a clear and present danger to the
citizens because when
the cities become such easy, prey,
easy targets, it will only get compounded and
worse. Because they're
proving in this graph that it's almost two
to one attacks on cities versus industrial
sectors. Industrial sectors. Have
Bit more resources to spend on security cities.
However, don't and you see huge uptick in
attacks in the last last couple
in the last few years. And so this is again an
opportunity for those that are taking this course or watching
this, this these videos to see an opportunity there
to help cities become better at
defense.
So this is a fun little diagram where
we can kind of take apart the various threats and
countermeasures for any smart cities. The threats
we covered in the previous section and
that's important to understand the terms, such
as the kind of attacks, like man, the middle device.
Hijacking, privacy data
identity, theft permanent. Denial-of-service DDE
OS attacks. Application Level
destruction, denial of service.
Tax. So these are all very, very common ways
of attacking cities, but maybe for this illustration. We'll
be focusing more about the Contra measures. IE what you can
do to help secure your municipality your
city against these types of attacks. So for the man
in the middle attack, the countermeasure would be good authentication and
encryption security lifecycle management for
device hijacking. It's the little
bit old school but a good counter measure would be device
identification and access control.
Security. And again, lifecycle management. The
lifecycle management is a good one, because there's
a lot of hardware dependencies, and you've got to make sure that that Hardware is
not going to be sniffed and
breached and accessed because that's where the trouble starts.
Oh, that's really lifecycle management for
a DDOS attack. A good kind of measure is
device. Identification, Access Control, security
monitoring and Analysis for
PD OS.
There are some good kind of measures like authentication, encryption
Access Control, application
Level, DDOS protection, and security, monitoring
analysis, and for privacy
data, and identity theft. A good kind
of measure is good authentication, encryption and
access control. You see a lot of
terms here like authentication so that could be strong
passwords or to two-factor authentication where you use
your combination of your
You're injured and your phone's as lots of
lots of ways to make sure that the bad guys
don't get into your system.
So we can now assume that
maybe the bad guys did get into your system and we
need to look at what kinds of data sets. Get
stolen. So there's the common identity
theft really bad case. There
were 550 million Indian
citizens that had their biometric data
stolen and 2018. That's
not good. You can imagine what people would
use with that data, this information.
Again, another poor Indian example, where
2275 million Indians citizens had
a personal identification stolen, including
their education resumes salary information.
Those are really kind of important details
to access even more kinds of
credit cards or other kinds of
health records and those kinds of things.
So, these are really bad examples of
what kinds of data.
The sets but they were stolen stealing infrastructure. So,
hackers targeting city, city infrastructure can
start monitoring monitoring or even organizing crime.
So imagine if you got control of
CCTV cameras, you could make them go blind and
allow the bad guys to do bad
stuff like robbing banks Network control.
This is a baddie as well.
And in some cases hackers are less interested in the
data than they are.
Taking over entire control and this
is good. Ransom opportunities for the bad guys. Digital
infrastructure. What the hackers can do here,
is they reach the city infrastructure and then
they see this and they store their own data and
applications for free. That's
a naughty naughty thing to do. There's
certainly less than a police. Is there, confidential product
information? That's
the design, informations are products, and
This is that are often stolen before his the market. So that's intellectual
property. Those are leaks
a spoiler alerts, those kinds of things.
And those that can also do a great deal
of harm.
So another bold statement here unit per research. One
of the most credit research groups in the world reports
that the ransomware will hit five
trillion in the next couple of years. Today
that's around three trillion. So it
it almost doubles every one
to two years now. So therefore we need
people to help defend ourselves against these ransomware
attacks.
So needless to say cyber
security is a super top priority. It's
not just about the cost. But
in this section in the previous section, it's
about the digital rights and the Privacy for all citizens and
digital rights is a 21st century kind
of concept but it's still a human, right?
And once the bad guys hackers
and the attackers get their hands on biometric
data. They can
Can use these things in the various ways and
what we need to
be very, very careful about how
much of our ourselves is available.
In other databases. CCTV
is a, is the kind of common
Whipping Boy where it's big brother surveillance
State stuff, but street cameras can recognize lots
of things in the public space, like license plates. And
with license plates, you can use contains data.
Like the the the type of the car, the owner
of the value, so when people get
access to these algorithms or these cameras, they
can start pinpointing individuals. Crypto
is the preferred payment
of choice and it's a system
that is making it more and more difficult to
actually find who these attackers are because there's no bank records.
Yeah, the hacking let's say
is getting more complicated because
All good old days. It used to be a kind of individual white
hacker, black hacker that could do things because
they were either asked to, or just because they could
technically. But nowadays, it's getting lot
more complicated because they're state-sponsored, and
they're working internationally 24-day at
hours, seven days a week and the consequence
to all this is, of course, a great blackout, which
is when the entire systems
collapse in a city,
From banking, from energy, from Transportation Healthcare
and education. If the cities don't
beef up their security, a blackout
isn't necessarily a matter of question of
if but when and so security,
really really becomes a huge factor
in importance for a smart
City.
So in the next section, I am going to
be asking you how you can help secure your own Smart
City.