Scaling smart streetlighting safely in times of AI (Highlights)

1
It's not enough to have a product
that was conceived safe today

2
because today is gone already.

3
It's already tomorrow, right?

4
And the bad guys

5
keep going, and AI,
unluckily, today helps them.

6
So hello all and welcome to
this panel, Scaling Smart Street

7
Lighting in Times of AI.

8
AI is creating new opportunities,
but with those opportunities

9
come challenges, and those challenges
are related to cybersecurity,

10
reliability, and quality assurance.

11
So how can cities and utilities
scale smart lighting while minimizing

12
these risks?

13
For the panel, I have
3 amazing panelists.

14
As smart street lighting grows
from pilots to territory-wide

15
networks, which cybersecurity
risks deserve more attention,

16
and what should cities
prepare for the next 5 years?

17
Maybe ladies first.

18
It's very easy to think
of technology risks,

19
which are certainly there, and we can

20
look into them. But what we
like to think, and what we also

21
practice in our company, is thinking
of cybersecurity as technology,

22
people, and processes.

23
I would like to point out

24
that the main challenge, at least for,

25
again, energy service company or
operator, infrastructure operator

26
like us, is to find the right
balance and the right trade-off

27
between the deployment of
technology at scale with redundancy,

28
infrastructure in order to be
100% sure or close to 100% sure

29
that everybody

30
can be resilient. And the
sustainability in terms of economic

31
sustainability of the project.

32
So I suppose the main
challenge is also scalability,

33
because doing some
small pilots, it's easy,

34
and the impact is also smaller.

35
But if you scale it, the
attack surface, it grows,

36
it goes much bigger than that.

37
So I suppose for a vulnerability,
if you have it on one device,

38
it's maybe not worse.

39
But if you scale it and you have
millions or hundreds of thousands

40
of devices and a vulnerability,
it scales also on all of those

41
devices.

42
So we have to take into account,
we live in a public space.

43
The products will be
there for multiple years,

44
like 10, 20, 15 years, and it has
to be safe during the complete

45
lifetime of that product.

46
There's this concept of
like ethical hacking.

47
So continuously monitoring
threats that emerge on the market

48
day after day, test your technology
against those threats day

49
after day, and fixing it immediately
and deploy the fix safely

50
and securely on field so that
cities can rely for multiple years

51
on the investment they made.

52
May I answer this with a question?

53
Do you think it's only the
responsibility of the supplier

54
or also for the municipalities?

55
It cannot be only
responsibility of the supplier,

56
as much as it may look
that I'm, you know,

57
downloading some of the
responsibilities that we do have.

58
But there's no way that the
product or the supplier itself can

59
make everything.

60
And a product can be as secure
as it is, but then you have one

61
person in the office which
replies to a phishing email,

62
right? And you're done.

63
Cybercrime is getting
more and more refined.

64
We play phishing drills
inside the company day in,

65
day out, and they're so
refined that it's very,

66
very hard not to fall for
them, even if you know—

67
because I'm the CEO,
I know when they play them,

68
right? But it's very hard
not to fall for them.

69
But I think it's a partnership
with the suppliers,

70
and that's the important part.

71
It doesn't stop when you just buy it.

72
You bought it and then it starts
because you have a rollout,

73
you have to do tests.

74
Obviously, public lighting and
street lighting is a public service,

75
so cannot be any way

76
interrupted for any reason.

77
So are you seeing major changes
in the way cities prepare their

78
tenders and the requirements
they ask related to the level of

79
service quality or cybersecurity

80
rather than just
focusing on the price?

81
So price is always the king, but

82
I would say that in the recent
past we have seen a change in

83
the approach of cities

84
when evaluating a project.

85
Because, I mean, if you just
link the evaluation of a project

86
on the cheapest one, I mean,
you are missing the big part of

87
the picture.

88
For what concerns cybersecurity,
to be frank and honest,

89
we are not seeing in the
tender specific requirements.

90
So today is something that also
the city itself sees as a risk,

91
but I would say not in my garden,

92
The mentality of it's
never gonna happen to me.

93
Proactively the industry should be
faster than the public administration.

94
Order to propose a specific
checklist or tests that could support

95
also the city itself, the
specific technician of the city,

96
to understand

97
the matter.

98
And already explaining,

99
already showing them
the benefit of, I say,

100
something very disruptive,
the benefit of changing the lamps

101
from sodium to LED is something
new that is very difficult to

102
transfer in terms of
technical benefit, you know.

103
So I imagine to explain to a
specific technician in the small

104
city in the mountain of Italy
there is the cybersecurity risk,

105
or even worse, waiting this
technician to write inside the tender

106
specific requirements for
the cybersecurity risk.

107
So it's impossible today.

108
What would convince you to pay more
today to reduce risk throughout

109
the project's life?

110
That's a good question, but I
don't think we want to pay more.

111
We want to pay less,
especially as an end customer.

112
So let's pay less for
the right product.

113
I think you have to set the
baseline at least that it's for

114
everyone the same and
standards can help with that,

115
and even education can
help a lot with that.

116
As smart lighting scales and
thrives, what are the key measures

117
you have put in place to be recognized
as a highly robust solution?

118
We run on the zero trust approach,
so always mutual authentication

119
in every exchange.

120
If I may react on that,
I think it's very important,

121
again, the transparency.

122
My cybersecurity team
always scolds me because

123
I tend to communicate too much,
and cybersecurity is a matter

124
of going in a sort of a stealth mode.

125
So the more you tell about what
you do, the more attackers can

126
threat you, right?

127
There's a trade-off.

128
It's something that we can't
really promote in the open and

129
put in the internet, but we need
to enter into a conversation

130
with customers together very openly.

131
And I agree with you on that.

132
What are the real risks and the
worst-case scenario that you

133
have taken into account when
you're preparing and running your

134
project? Because you do have

135
1.2 million points.

136
I suppose worst case you get
in the platform and you do some

137
operations that can't be undone
or changed directly and then

138
cut off the complete communications
so you can't access them.

139
And you can't visit them all
because you have 1.2 million light

140
points. You can't visit each
luminaire at once to fix it.

141
And if you have that large
scale and, for example,

142
they turn it on and off
for 5 times a second,

143
you can see it from space, I suppose.

144
And it wouldn't be a very good

145
commercial for us, I suppose.

146
You have to think a
little bit more in layers,

147
starting from the luminaire,
the controller,

148
to the platform.

149
And people who don't need access,
remove it and keep track of

150
it. And those are the simplest
things because if someone leaves

151
the company, maybe

152
he was not really happy
for leaving the company,

153
but is the access removed?

154
Looking ahead, what's one
change in product standards,

155
procurement, or industry cooperation
would most improve cybersecurity

156
at scale? And how can customers
verify that it makes a real

157
difference?

158
So I think that as

159
a private industrial player,
we have responsibility to

160
move in advance with respect to
municipalities in order to prevent

161
such kind of risks.

162
Well, if I had to change one thing,
I suppose it would be move

163
from self-declared security
to a more verifiable

164
lifecycle security.

165
It can be an independent party
that does the certification.

166
And it doesn't stop again
when you buy the product,

167
you have to do it for
the whole lifecycle.

168
So also, for example,
penetration tests and other things.

169
But the risk that I see there
is that it becomes just another

170
requirement that is slapped into
a tender because somebody has

171
to, yes, comply to some
cybersecurity because nowadays,

172
without really knowing what
it implies and what's behind.

173
We had a city in the past years,
they wanted to run VAPT on

174
our products. And

175
I will not hide that at
the moment we were like,

176
you want to run VAPT?

177
I don't know how you run them.

178
So, because I don't want to
expose my product to you without

179
knowing what you're gonna do,
even if I'm sure I will pass those

180
tests. So if there was
somebody in the middle

181
to help this process and grant
for the integrity of the process,

182
for none of the parties to

183
be at risk, I think that might help.

184
Well, thank you so much for all
your answers and for the wonderful

185
chemistry the three of you had.

186
It was amazing. I think
for me, a key takeaway,

187
or the idea I'm going to keep in
mind, is that as street lighting

188
thrives, cybersecurity
can't be an afterthought,

189
especially now with AI.

190
It has to be the first thought.

191
We have to think in advance.

192
And I'll also keep that
idea of a checklist,

193
standards, and the collaboration
between all parties.

194
So thank you very much.