Local and regional governments are increasingly investing in connected systems to leverage an array of devices to improve the quality of life for the residents they serve.
According to Statista, the Smart Cities market worldwide is expected to witness significant revenue growth, with projected revenue reaching $79.94 billion this year. This growth is further expected to continue at a compound annual growth rate (CAGR) of 9.60% from 2025 to 2029.
With increased investment comes increased risk and, despite the relatively young age of Smart City initiatives, they have already proven attractive targets for hackers with increasingly troubling attacks. The massive amount of data collected by these edge and cloud deployments places them in the crosshairs of bad actors looking to disrupt the order of things, whether these are criminal or state actors seeking ransom or causing chaos.
Smart cities incorporate edge devices throughout municipal areas to improve daily life
Public safety, for example, has been a key focus of smart city development. This includes capturing the faces of individuals who may or may not be committing crimes, which raises privacy issues.
Environmental sensors can be deployed in public spaces to help detect fires and other safety issues and to sense possible terrorist attacks early on.
The structural integrity of bridges and buildings can be remotely monitored to allow for more efficient preventative maintenance. Intelligent Transportation Systems (ITS) can monitor and optimize vehicular traffic, and smart lighting can lower energy consumption and provide additional benefits, such as free public Wi-Fi.
Improvements to public transportation for convenience, efficiency, and security have also been popular applications, with often complex telemetry and spatial computing used to better control and monitor traffic congestion and keep commuters updated about the arrival of trains, buses, and ferries.
This only scratches the surface of the potential for IoT devices in smart cities. As the technologies continue to develop and mature, the applications for IoT in public spaces are nearly endless.
More Edge Devices Means More Risk
"Effective smart city systems often require tens of thousands of devices to interconnect and share data," said Jason Shepherd, CEO of Atym, a company that leverages WebAssembly to bring OCI-like app containerization and cloud development principles to the billions of constrained edge devices that don't have the resources to support a Linux-based container runtime like Docker. "If not properly secured, all those endpoints present a lot of opportunity for hackers to gain access to city networks and wreak havoc."
Shepherd explained that the majority of devices distributed throughout the physical world are powered by microcontrollers or lightweight CPUs that don't have enough onboard memory or processing power to support modern software development processes. There are also complexities in managing and securing large fleets of these devices.
"There is no more heterogeneous environment than a large, smart city deployment," Shepherd said. "At Atym, we're borrowing from practices that are commonplace in the cloud to solve for the diversity, complexity, and constant change within connected cities across myriad applications with a more unified approach to deployment and management over time, including isolating applications on constrained devices in containers and performing secure, fractional updates. This is a risk management approach, which also is an operational efficiency and cost-containment approach, including communications between the edge devices, their apps, local and regional infrastructure, the cloud, and back again."
A study from UC Berkeley found that emergency alert systems, street video surveillance, and traffic signals are the devices in a Smart City that are most vulnerable to incursion.
Developers of smart city applications are asking for better tools to modularize and secure software, especially for resource-constrained devices. This is to address challenges with traditional approaches of leveraging firmware or embedded Linux that are expensive to develop and maintain, rigid to innovation, and introduce risk. For example, one flaw in firmware code can provide an attacker with access to the entire device and, therefore, the network.
"We are seeing more and more interest in embedded AI for myriad products, including sensors, cameras, drones, robots, EV chargers, and appliances," Shepherd explained. "Many bad actors target edge devices specifically, which can allow criminals to acquire credentials that grant access to sensitive systems. So, developers need tools that support on-device AI while improving their security posture and reducing overall engineering complexity."
Intelligent Infrastructure
All of these connected devices need infrastructure to provide services and augment their processing locally to aid in real-time response and limit cloud upload to only meaningful data. This inherently requires strong collaboration between public and private organizations in order to develop the necessary interoperability standards, deployment practices, and service models.
"Intelligent infrastructure will be the most transformational investment asset class for enabling AI within our communities to build a stronger, safer, and more connected nation," said Jeff DCoux, Chairman of The Autonomy Institute, a non-profit organization focused on advancing investment in intelligent infrastructure through public/private partnership. "21st-century infrastructure, like Public Infrastructure Network Nodes (PINNs), edge data centers, vertiports, drone depots, and smart hubs, will complement existing cell towers, fiber optic connections, and regional data centers. The era of autonomy will create millions of new jobs and economic growth nationwide".
Zero Trust is Key
Organizations dealing with highly connected, heterogeneous ecosystems have embraced a zero trust mindset, which asserts that all on-premises or remote users, devices, and apps must verify their identities and privileges before interacting with each other. A zero trust mindset is especially important in smart cities due to the mix of public and private interests that are dynamically coming in and out of environments. As part of this, all IoT devices, APIs, and server-to-server interactions must be strongly identified, authenticated, and authorized.
"Smart cities require network-independent connectivity for simplified, centralized control and visibility spanning broad-scale deployments," stated Galeal Zino, CEO of NetFoundry, which provides a universal zero trust connectivity platform. "A secure-by-design approach is imperative to avoid the complexities and costs of day two, bolted-on security."
"When it comes to bringing together heterogeneous ingredients and stakeholders, especially considering public and private interests, unification, automation, and simplification are table stakes," Shepherd said. "This includes compliance in the areas of managing privacy, PII, and more. There's a lot to gain by leveraging lightweight virtualization technologies like WebAssembly, cloud development practices, and zero trust security principles to enable embedded devices and systems with root of trust, robust authentication methods, secure application containerization, policy-based access control, and more."
Edited by
Erik Linask
