Tackling Asian smart city security: the first steps

Source: Trend Micro blog post. Smart cities are vulnerable to cyber attacks.

Trend Micro is calling for security and privacy to be baked into smart city infrastructure from the ground up, and has compiled some of the related concerns for smart cities around the world.

"The cost of bolting on security after the event is always significantly higher, and the end result less effective. But we must also be aware of the scale of the task. Smart cities represent a large and complex attack surface, where vulnerabilities in cloud servers, mobile app ecosystems, data transfers and more could all have serious repercussions for end users and smart city providers," said Ed Cabrera, Trend Micro's CSO, in a blog post.

The task is a complex one, Trend Micro notes. A two-year study completed using Shodan, the search engine for Internet-connected devices, surveyed 2.2 million Internet facing assets between 2012 and 2014. The results in Project SHINE (Shodan Intelligence Extraction) list 586,997 Internet connection-sharing (CS) devices, 13,475 heating, ventilation, air conditioning (HVAC) and building automation systems - and that was as at 2014. Numbers are likely higher today, and each asset needs to be secured, while any user data collected will require prior consent.

Trend Micro's records on cyber attacks has implications for smart cities around the world. In 2015, a December 23 outage at two of Ukraine’s top energy distributors was traced to destructive malware, for example. While these are individual companies, smart cities are heavily interconnected. An attack on one system could lead to failures of other systems.

"The Yokohama Smart City Project (YSCP) uses a smart grid to throttle high-volume appliances at peak hours and optimises the use of in-house energy through real-time data. But what if the centralised system controlling this were hacked? Could we see a city-wide blackout?" Cabrera asked. Trend Micro cites a report by the EU-Japan Centre for Industrial Cooperation, which states that data security is not assured in its smart grid.

Besides Yokohama, smart cities in Asia include the Songdo International Business District (IBD) in Korea, Singapore,  Jaipur in India (one of 100), and 386 cities in China. Areas of concern include the need to balance convenience with data privacy, the security of captured information as well as the possibility of mobile malware masquerading as genuine smart city-related apps.

Interested?

Read the Trend Micro blog post detailing smart city features and vulnerabilities