With everything getting connected to the Internet these days, the “smart city” could become the entry point for hackers to infiltrate vital networks and infrastructure.
This is according to e-security firm Kaspersky, which stressed that a smart city – no matter how intelligent – will always be susceptible to attacks from bad elements if not properly secured.
At its recent Industrial Cybersecurity Conference held in the Russian city of Sochi, Kaspersky executives emphasized the importance of integrating security in designing smart cities.
“The smart city is the next weakest link because it has the gateways in automating various endpoints in buildings and other structures,” said Kirill Kruglov, senior research developer at Kaspersky.
Kruglov said an actual incident in San Francisco, California a couple of years back showed that a cybersecurity breach could paralyze a major transport line. In this case, he said, hackers disabled the ticketing machines of the city’s train system, preventing commuters from using them.
A lot of stories have also been told about traffic cameras being used as entryways by attackers to steal data or valuable information.
“It’s difficult to know the number of incidents in industrial cybersecurity because companies are not so open [in disclosing them],” said Georgy Shebuldaev, head of industrial cybersecurity business development at Kasperky.
But based on the company’s monitoring, Shebuldaev said power and chemical plants are the most hacked in the industrial sector, while banks posted the most number of attacks in the commercial side.
A main component of the smart city grid that needs to be secured is the cloud because this is where important data is stored, the cybersecurity firm said.
Kasperky said a cloud platform — when correctly secured — could integrate various data from different engineering systems, which in turn can help a local government unit or a utility firm reduce the cost of its operations.
With Internet-of-Things (IoT) adoption now accelerating at a much faster pace, the Russia-based security firm said it is important to note that devices such as low-level sensors that collect data can serve as an opening where a vicious attack can be launched.
“Electronic devices now have the ability to speak to one another without human intervention. However, they could also spark that malicious explosion. It’s very dangerous. We see more and more different vulnerabilities in these types of devices. So we understand that classical approach is not enough,” said Shebuldaev.
This is the reason, he said, why Kaspersky created an integrated security system that can be installed even at the device level to ward off different forms of attacks.
The official emphasized that Kaspersky developed its portfolio of products and services to “empower” machine learning and automatic anomaly detection for IoT devices.
“As I already said, vulnerability management process is very critical. And we see that currently, information about vulnerabilities in IoT components is not consistent. Most of them do not do unique research. They just aggregate information and do not add value for customers to understand actionable information,” Shebuldaev said.
With Kaspersky’s industrial solution, Shebuldaev said information on intrusion detection is available in both human and machine readable format.
“Thus, customers with different stages of maturity will be able to use this information for appropriate action. This will significantly help build or improve the vulnerability management processes of our customers,” the official said.
Although incident response is a crucial service that Kaspersky provides, Shebuldaev noted that its customers have become more pro-active in recent years.
“For many years, Kaspersky has been doing incident response service for our customers. If something happens, our response team is able to collect information, investigate the matter, find the root cause and provide mitigation tactics, give out advice how to avoid it in future. But today, with the maturity of our customers rising, we started to get requests on how to prepare for these types of incidents,” he said.
