Securing a Smart City: What’s at Risk?

The U .S. Department of Homeland Security has designated transportation among the top infrastructure sectors where a hack could massively impact national security. It's not hard to see why. As cities prep for the arrival of EV fleets, autonomous vehicles and connected cars, they're deploying a massive amount of IoT devices and communication networks, creating a highly interconnected system. system with many entry points to the network. Just one attack on a device could put an entire city at risk. Cyber security is an increasing concern for us. The city of Tampa, Florida is in the midst of a $40 million transit upgrade, which will see the city updating its servers, building out more fiber. As well as using this project for an opportunity to pilot some newer technologies, including some network monitoring. devices in our cabinet. All Tampa had to do was look north to see that cybersecurity is essential for transit. In April 2021, hackers believed to be linked to the Chinese government penetrated New York City's MTA computer systems. The malware provided hackers a backdoor to remotely access and control certain servers over a long period of time. Now, there are many components to an IoT ecosystem and a hack can happen at any point. But many experts we spoke to agree that the IOT security gap often centers around the devices themselves. There are some pieces of this equipment that actually shipped from some countries with malware pre -installed. And we've seen cities fall victim to that. In 2018, investigators in San Francisco discovered that 86 % of the 1 ,000 networking devices supplied by Cisco to its transit system contained intentionally planted spots. after being decommissioned in hostile nations years earlier. There are also forgotten features of the IoT devices that can lead to a massive breach. Contos gives the example of a light-out management system. These are little cards that are essentially Linux servers. They're little cards that are plugged into the back of most servers. Now, your server, you could be spending millions or tens of millions of dollars on all your application security and your database security and encryption and all that, and that's great. and you should still do that for sure but they have these lights out management cards they're just a little ethernet port by and large these devices are never updated their firmwares are out of date their passwords are default you can go on shodan or some other searches to find out hey bring up this device do i see any and you'll probably find tens of thousands if not hundreds of thousands of these that are just exposed to the internet let alone getting into an organization then attacking the device of course there'd be much more So you find these devices with default credentials. Well, here's the problem. If I can access that, I can change your network settings. I can shut your device down. I can reboot it. I can upload software, upload malware, wreak all sorts of havoc. And to put into perspective just how easily these devices can be tampered with, let's turn our attention to Ukraine, where a group of journalists recently were able to hack into CCTV cameras attached to police cars. Using that process described by Contos, the journalists changed the default passwords and usernames and instantly got access to the footage from the cars as they moved along the roads. The journalists have since alerted the government to that vulnerability. It's an interesting example, but I think these IoT -type solutions that are being deployed in these smart cities and throughout enterprises and other organizations, it's kind of equivalent. to i .t security back in the like the mid -1990s when people are talking about wow most of these devices have default passwords they're running firmware that's end of life or five or six or seven years old they're running all these extraneous services where where people can get in and get access and to be quite honest with you and this is probably the saddest fact is most most people looking at smart cities and in the enterprise and even government agencies they don't even know what they've got they they might guess oh maybe we have 10,000 or 20,000 IOT devices I've seen this time and time again most guesses are off by about 40 to 60 percent it's because of those difficulties in managing and securing the IOT devices that vendors have embraced a distributed IT architecture as seen in Chicago Genetec is a provider of physical security solutions the company worked with Intel and Digi to deploy a predictive passenger counting system on Chicago's buses. The project deployed cameras with edge computing and genetics says that edge computing does more than data processing. It actually adds an extra layer of security. When the sensor detects a person coming in or out, it immediately sends that event to our application running at the edge. And we do a once per second aggregation of those counts to send to the cloud. So we need that... can be used to aggregate, to buffer the data, but also to create the right type of IoT connection, right? It acts as a gateway for the sensors because if the sensors needed to talk directly to the cloud, that might not be a secure way of doing things. So now what we're doing is we're aggregating locally and we're sending the data through Azure IoT Hub, which is a secure connection between the Edge device and the cloud. Certainly, if the data has to travel less distance, and has to interact with more systems and more third parties. You can reduce risk as far as that goes. But man, we've got so many critical things we need to address before we get there. I think the basics are, figure out what IoT devices I've actually got. Figure out how do I secure the credentials on those IoT devices. And third, how am I gonna do all the patch management and firmware updates on those? For that reason, we're seeing companies increasingly automate these tasks and a push to mitigate their risks. That's where a company like IoT Inspector comes in, which provides an automated security analysis. We receive the firmware of IoT devices and are then able to remotely detach from the device itself, so we don't need network connectivity, we don't need the source code, but purely based on the firmware of the device, able to assess the security, identify vulnerabilities affecting the device, and also rate its compliance. Now this all comes at a time when cyber tension is at an all-time high as a result of the Ukraine -Russia war. As experts put it, this is one, if not the, first war in which really anyone can participate. And the numbers show many are. In the first three days following the invasion, online attention. attacks against Ukrainian military and governmental sectors have increased by 196 percent. Both the U.S. Cybersecurity Infrastructure Security Agency and the European Central Bank have issued warnings of potential cyber attacks. Transit systems are, of course, a top concern because of their interconnected nature. But as we learned in this interview, anywhere there's an IoT device, there's a risk. For more coverage on how you can stay secure, be sure to follow Current Insights.