Analysis

Tech In the City: The Cyber Security and TPRM Implications of Smart Cities

Smart cities aim to create more efficient, sustainable and liveable urban environments, but also introduce new cyber security challenges. Find out about smart cities and their third-party risk management implications in this new article.

Tech In the City:  The Cyber Security and TPRM Implications of Smart CitiesTech In the City:  The Cyber Security and TPRM Implications of Smart Cities

Smart cities aim to create more efficient, sustainable and liveable urban environments, using integrated technologies to support economic growth and improve the quality of life for citizens. However, the introduction of vast data-hungry technology networks as well as the unprecedented integration of systems within smart cities raises concerns about data protection, privacy and cyber security. In this article, we explore the challenges that smart cities will pose for third-party risk management. 

What are smart cities?

Smart cities are urban centres where technology is used to manage and deliver more efficient, responsive and sustainable infrastructure and services. By harnessing advanced technologies, city authorities and developers around the world are attempting to optimise the way cities function – to stimulate economic growth and improve the quality of life for residents, while minimising environmental impacts. 

Smart city initiatives worldwide prominently include such grandiose projects as NEOM in Saudi Arabia, but also projects such as Telosa in the US and Xiong'an New Area in China. Today, Singapore city state is regarded as an exemplar of an incipient smart city, already incorporating sensors and internet-connected cameras to monitor and manage everything from traffic congestion and crowd density to energy use and street cleanliness. 

How do smart cities work?

Smart cities rely on data gathered in real time by vast networks of Internet of Things (IoT) devices, cameras and sensors. This data is processed using advanced analytics and artificial intelligence to inform rapid decision-making on service delivery, information provision and the efficient management of infrastructure and resources. 

Residents and visitors can access up-to-the-minute information on, for example, parking spaces, traffic conditions, air quality or service availability. The technology can be used to enhance the provision of public services, from healthcare and education to water and waste management. 

Smart cities also use technology to improve sustainability. Smart electricity grids use digital technology to monitor energy demand, production and distribution to minimise waste and maximise renewable energy use. Energy-efficient buildings incorporate intelligent building management systems to align heating, lighting and cooling with real-time demand. Environmental impacts are minimised through intelligent transport systems too, which use sensors and cameras to manage traffic flows and reduce congestion, while optimising public transport services.

What are the implications for cyber security and third-party risk management?

The operation of smart city infrastructure and the delivery of essential services relies on huge volumes of data being collected, analysed and transmitted rapidly every minute of every day. This requires a multitude of systems and software to continuously gather, process and disseminate data at high-speed. 

The reliability and availability of these systems is vital to the functioning of the smart city, meaning they must be protected constantly against the risk of failure or cyber-attack. Critics of smart cities fear that data security and privacy could easily be compromised in such complex, dynamic IT networks – exposing individuals, organisations or entire cities to the consequences of hacking and data misuse. 

Specific cyber security risks associated with smart cities include:

  • Multiple points of failure: the number of integrated technologies, AI and IoT devices associated with smart cities offers a significantly expanded attack surface for cyber criminals to exploit. The interconnectedness of these devices means that a vulnerability in any one system could enable hackers to wreak havoc across the entire smart city infrastructure. A failure in one area could have a cascading effect on vital energy, transport or public services. That means city administrators need to ensure that all third-party software or system providers meet and maintain the strictest security standards. 
  • Compromised data privacy: the massive volumes of data being collected and analysed continuously throughout smart city networks means there is a greater risk of data falling into the wrong hands. How can city authorities maintain watertight data-protection protocols when so much data is being moved around so quickly across multiple systems, and being integrated and stored centrally? It’s vital that third-party suppliers undergo thorough and ongoing vetting of their data-handling and IT security systems, to ensure they comply with stringent data-privacy regulations.
  • Reliance on global supply chains: many of the devices and systems used in any smart city will be sourced from suppliers in many different countries. Today’s global supply chains provide fantastic opportunities to access the best services and systems from around the world, but they also introduce potential vulnerabilities due to a lack of visibility of all supply chain partners and dependencies, as well as geopolitical and other risks they could face. Thorough third-party risk management processes need to be implemented to ensure that the complex network of suppliers associated with any smart city do not compromise the security and integrity of its infrastructure.
  • Vendor interoperability: if the systems running a smart city rely on proprietary technologies, certain vendors can become indispensable and “locked in” to the city infrastructure, making it difficult to switch to new providers or technologies.  To prevent this, city planners should prioritise open standards and interoperability when choosing third-party solutions.
  • Regulatory compliance: a plethora of data protection laws, accessibility requirements and industry-specific regulations apply to any smart city. All supply chain partners must therefore be thoroughly assessed to ensure they can support the city’s compliance with this raft of regulations.

Focus on resilience in smart city development

The highly interconnected nature of systems and devices in a smart city require a holistic approach to cybersecurity and risk management. Smart city planners, developers and authorities need to prioritise the ongoing resilience of their systems, including not just prevention but also mitigation and recovery. 

Smart cities could transform urban living in the future, unlocking economic value and improving social wellbeing, while enabling more efficient and sustainable resource use. However, developers need to be cognisant of the cyber security and digital supply chain risks of creating complex data-driven, highly integrated systems and services in our cities. These risks need to be carefully managed through robust third-party risk management, cyber security and operational resilience strategies – allowing smart cities to fulfil their bold mandates without compromising the welfare and security of their citizens. 

Look out for future articles from Risk Ledger on how third-party risk management can be deployed to protect organisations and supply chain partners.

Analysis

Download for free

By submitting this form, you agree to Risk Ledger’s Terms of Service, Privacy Policy, and Risk Ledger contacting you.

Thank you!
Download
Oops! Something went wrong while submitting the form.
Analysis

Download for free

Download
Pattern Trapezoid Mesh

Join our growing community

Sign up to our monthly newsletter to receive exclusive research and analyses by our experts, the latest case studies from our clients as well as guides, explainers and more to turn your supply chain risk management programme into a resounding success story.