Modern public lighting, combining streetlights and sensors, incorporates technology to connect services. Smart cities are therefore focused on streamlining operational efficiency and improving user experience, within the overall context of reducing costs. This is the third paper in a series of articles on cybersecurity issues in smart and connected cities.
Behind the modernization of practices in urban environments lurks the same problem as any other element of a smart city: the more connected a city is, the greater its exposure to cyber attacks. What are the cyber risks involved? What cyber security strategies should be adopted to meet these new challenges? This article provides answers to these questions.
Increasingly connected public lighting
In a connected city, the need to ensure the cyber security of the infrastructure that manages energy, water and urban transport is clear, but as every device in the connected city can return data, public lighting also needs to be monitored, supervised and protected. Street lights, sensors and other devices are becoming a full part of the Internet of Things (IoT) that powers this connected city. As a result, public lighting networks have become a significant source of energy consumption for cities: in an era when energy efficiency is the watchword, public lighting in France consumes more than €2 billion of local government budgets. Report While smart cities aim to reduce operational costs, they also need to improve the safety of their residents. At issue is the continuity of services in local government.
In the broader context of public lighting, replacing existing lighting fleets can address environmental and economic issues as well as cybersecurity. “Once luminaires and lighting control points are networked in a centralized architecture, the lighting system becomes programmable and capable of generating data.” he explains. Article from a French specialist site. “This data can be applied to strategies such as optimizing space utilization, tracking inventory and providing location-based services. These strategies can have tangible effects on cost savings, process efficiency, branding strategies and occupant satisfaction.” When lamps are equipped with sensors, public lighting becomes “smart”: it can detect the presence or absence of occupants and adjust brightness accordingly, inspect equipment and report faults, and schedule maintenance work proactively.
But this hyperconnectivity also expands a smart city’s attack surface, potentially making it not only more vulnerable to attacks, but also its entire infrastructure.
Public lighting: vulnerable to cyber attacks
This proliferation of connected devices in urban environments brings with it various constraints and cyber threats. This complexity is explained by the diversity of equipment used as sensors (temperature, humidity, motion), GPS beacons, sensors and actuators mounted on fixed or moving components. This complexity is further compounded by the remote accessibility of these devices, mainly for maintenance, and involves different parties (owners, agents, subcontractors) with different cybersecurity skills, interests etc.
When it comes to public lighting, the attack surface is exactly the same as the entire installed network: centralized architectures are vulnerable, as is the data passing through them. While data on lighting activity and intensity may seem of little interest to cybercriminals, access-related data is much more attractive. Cybercriminals can first gain access to connected objects and then move laterally to other internal networks of the smart city. In this IT environment, traditional threats such as spyware, computer worms and ransomware pose a real risk to the control and monitoring environment. Cyberattacks such as sniffing attacks aim to obtain this access information by intercepting data flows between lighting fixtures, lighting control points and remote management systems. Finally, the sheer number of network points makes them particularly attractive for cybercriminals to launch DDoS (distributed denial of service) attacks. In this respect, there are similarities with smart surveillance cameras in urban environments. In 2021, cybersecurity experts will be able to predict the development of Mirai-based Moobot Botnet The attack targeted a flaw in equipment from Chinese company Hikvision, a major player in the global surveillance camera market, that could be used by cybercriminals to launch DDoS attacks.
In addition to the immediate service disruption issues, the costs of repairing affected systems and protecting them from future attacks can also be substantial.
What is a good cybersecurity philosophy for public lighting?
By adopting an end-to-end cybersecurity philosophy, risk mitigation strategies can be implemented in these urban environments. This requires restructuring the architecture of the connected city, taking into account the different layers of industrial networks to the smart public lighting in the streets. To this end, the concept of defense in depth is the foundation of urban cybersecurity – an approach that aims to ensure the security of each subsystem, rather than focusing only on perimeter security.
This includes prioritizing the implementation of network segmentation, flow control, encryption of communication channels, and multi-factor authentication for accessing critical systems. In addition, continually updating the software of smart equipment can help prevent security breaches and effectively respond to ever-evolving cyber threats. However, this is easier said than done. Preventive measures such as regularly backing up collected data and implementing robust risk management policies that include strong procedures for handling security incidents are also part of this philosophy. The aim is to create a secure environment in which information flows freely. This is a key requirement for operating smart services: the ability to distribute information within the network with confidentiality, authenticity, integrity and reliability.
Smart cities therefore face a twin challenge: to protect their infrastructure from cyber attacks while leveraging the benefits of new technologies in terms of public lighting and the urban environment. The adoption of a consistent and effective cyber security strategy, backed by detailed knowledge of the solutions used, is essential for the success of smart cities.