From Buzzword To Battlefield: The Cybersecurity Challenges Of Smart Cities

Marina Bochenkova argues that smart cities need to be treated as a security problem of their own, because they combine IT systems, operational technology, IoT devices and many different stakeholders. Each of these brings its own weaknesses, so protecting one department in isolation does not work. The talk opens by framing that definition and then walks through how a city creates exposure. Open data portals with APIs can give an attacker a detailed picture of organisations and infrastructure, and property and civic records add personal details. Examples from the Netherlands include insider misuse of COVID track and trace data, an access control misconfiguration that exposed every record to every employee, and an exposed database of a private testing company.

The middle section moves to operational technology and IoT. Sensors and actuators in water and traffic systems have long lifecycles, are costly to patch and are often connected to the internet without adequate protection. Using examples from Belval in Luxembourg and Amsterdam, the talk describes planned sensor deployments that collect pedestrian and vehicle data, and how city-owned hardware can capture phone identifiers even when no one connects to city Wi-Fi. A flood-gate control failure in Amsterdam during a storm, which left gates open until staff noticed, shows how one unnoticed fault can have physical consequences. The talk also notes rising attacks on OT organisations, some causing physical damage.

The closing part argues for security built in from the start, repeated testing and use of existing guidance such as IEC 62443, cyber-informed engineering and an adapted NIST framework for smart cities. The speaker stresses that well-informed legislation and community involvement are needed, since trust in institutions depends on protecting citizens' data.