Modern public lighting combines streetlights and sensors with technologies that connect services. Therefore, in the context of cost-cutting, smart cities focus on improving operational efficiency while improving the user experience.
The modernization of urban environmental practices is accompanied by the same issues as other elements of smart cities: the more connected a city is, the greater the likelihood of cyberattacks. What are the associated cyber risks? What cybersecurity strategies should be adopted to address these new challenges? This article will answer these questions.
Increasingly Connected Public Lighting
In connected cities, the need to ensure the cybersecurity of infrastructure that manages energy, water and urban transportation seems obvious. However, public lighting must also be monitored, supervised and protected, because every device in a connected city is able to return data. Streetlights, sensors and other devices are becoming part of the Internet of Things, powering this connected city. As a direct consequence, public lighting networks are a significant energy consumer in cities. In an era where energy saving is the watchword, according to a 2021 report, public lighting in France consumes no less than 2 billion euros of the local government budget. The goal of smart cities is to reduce operating costs on the one hand, but also to improve the safety of residents on the other. The key issue is: the continuity of local government services.
From a broader perspective on public lighting, replacing existing lighting can not only solve cybersecurity issues, but also ecological and economic ones. "When luminaires and lighting control points are networked in a centralized architecture, lighting systems become programmable and able to generate data," explains an article on a French professional website. "This data can be applied to strategies such as optimizing space use, tracking inventory and providing location-based services. These strategies, in turn, can have a tangible impact on reducing costs, improving process efficiency, brand strategy and occupant satisfaction." Public lighting becomes "smart" when luminaires are equipped with sensors: it detects the presence or absence of people, enabling it to adjust brightness levels, and checks the equipment to report faults or schedule advance maintenance operations.
However, this hyperconnectivity expands the attack surface of smart cities. In addition to being sensitive, its entire infrastructure can become vulnerable.
Public lighting: vulnerable to cyberattacks
The proliferation of such networked devices in urban environments brings with it a certain level of limitations and cyber threats. This complexity is caused by the wide variety of devices used as sensors (temperature, humidity, motion), GPS beacons, sensors installed on fixed or moving parts, and actuators. This complexity is also exacerbated by the remote accessibility of these devices, which are mainly used for maintenance, involving various actors (owners, representatives and subcontractors) with different cybersecurity skills and interests, etc.
For public lighting, the attack surface is exactly equivalent to the entire installed network: the centralized architecture is vulnerable, and so is the data that passes through it. While data related to lighting activity or intensity may seem of little interest to cybercriminals, data related to access is much more attractive. Cybercriminals first gain access to networked objects and can then move laterally to other internal networks of the smart city. In such IT environments, traditional threats such as spyware, computer worms and ransomware pose a real risk to the control and supervision environment. Cyber attacks (such as sniffing attacks) aim to gain this access information by intercepting the data flow between luminaires, lighting control points and remote management systems. Finally, the large number of network points also makes it particularly attractive for cybercriminals to launch DDoS (distributed denial of service) attacks. In this respect, it can be compared to smart surveillance cameras in urban environments.
Besides the immediate problem of service interruption, the costs of repairing the affected systems and protecting against future attacks can be very high.
What is the right cybersecurity philosophy for public lighting?
By adopting an end-to-end cybersecurity philosophy, these urban environments can implement risk mitigation strategies. This requires rebuilding the architecture of the connected city, taking into account all levels of the industrial network, all the way to the smart public lighting on the street. To this end, the concept of defense in depth is fundamental to urban cybersecurity: it is an approach that aims to protect each subsystem, rather than focusing only on perimeter security.
This involves implementing network segmentation, traffic control, encryption of communication channels and multi-factor authentication for access to critical systems as a priority. In addition, continuous software updates of smart devices prevent security breaches and effectively respond to evolving cyber threats - although this is often easier said than done.
Precautions such as regular backups of collected data and the implementation of strong risk management policies (including strong procedures for handling security incidents) are also part of this philosophy. The aim is to create a secure environment in which information can flow freely. This is a key requirement for operating smart services: the ability to distribute confidential, verified, complete and reliable information within the network.
Smart cities therefore face a dual challenge in terms of public lighting and urban environments: taking advantage of new technologies while protecting their infrastructure from cyberattacks. Adopting a coherent and effective cybersecurity strategy, with a deep understanding of the solutions used, is essential for the success of smart cities.
