Connect with us

Featured

Smart cities must prepare for cyber war

Published

on

IoT and Smart Cities have become terms we are all too familiar with, but looking at the rate at which they grows, we cannot ignore the growth of the attack areas, writes PAUL WILLIAMS, Country Manager SADC, Fortinet.

Smart cities are being planned the world over. Technology development always goes through two phases for any new discipline: First – tools are developed, and infrastructure is built and enabled. And second – the technology is scaled up. In the case of smart cities, we are in the first phase, where many of the kinks and challenges are still being ironed out.

Here are some examples of services a smart city might provide:

·         Coordinated energy control of air conditioners at homes during hot summer days to manage and preserve city power resources

·         Directed local discounts in retail and restaurants to avoid city congestion

·         An automatic fee for driving a vehicle during highly congested periods

·         A smart directed parking app that automatically discounts congestion charges for parking in specific parking lots

·         Real-time sensor data to warn citizens affected by allergens and irritants

·         Real-time sensor data of standing water for mosquito breeding, etc.

·         Vehicle-to-vehicle communication, autonomous driving technology, and infrastructure with embedded sensors to warn of things like imminent traffic jams, construction, best routes for navigation during emergencies, etc. based on real-time traffic patterns.

To enable such services, smart cities will need to deploy plenty of IoT devices and services for metering, sensing, and controlling.

The Attack Surface of Smart Cities

The increase in the size of a smart city’s IoT device footprint corresponds to an increase in the size of its attack surface.

As was seen recently in a series of IoT-based denial of service attacks, IoT devices can be compromised and hijacked into a Shadownet (an IoT-based botnet that can’t be seen or tracked using normal browsers or tools) and controlled by a command and control (C&C) center run by hackers. Alternatively, these devices and services may be attacked in order to deny services to legitimate users.

Here are some examples of what hackers and attackers can do:

·         Take control of parking, traffic lights, signage, street lighting, and automated bus stops, etc. For example, changing highway signs to read “terrorist threat in area” or “danger, toxic spill ahead” could seriously disrupt traffic and cause panic among drivers.

·         Direct all cars and buses to a specific area to create congestion and gridlock.

·         Disable local transportation, thereby disrupting businesses and services, such as banking, because employees can’t get to work.

·         Open causeways to spill sewage and untreated waste water into parks, rivers, and communities.

·         Cut off access to drinking water.

·         Send fake SMS directing to people to a specific location, such as a targeted business or government agency

·         Remotely switching off air conditioners or furnaces during extreme temperature days

·         Randomly turning on fire and burglar alarms throughout the city

Increasing the Security in Smart Cities from the Inside

While it’s not possible to secure every possible security breach in a totally connected environment, it doesn’t mean we need to go back to the Stone Age. Instead, it’s possible to take some key initial steps to strengthen the smart city’s security posture and architecture:

·         Use strong encryption

·         Design systems that have strong protection against tampering.

·         Provide strong access control, authentication, and authorization

·         Maintain detailed logging of activities

·         Segment services for individual sub-systems, and then aggregate and pool data that you want to make publicly accessible

·         Create centralized management, analysis, and control systems through segmented and secured administration channels to troubleshoot problems

·         Set baseline standards that trigger alarms or require manual override when thresholds are crossed or anomalous behavior is detected, such as rerouting traffic or disabling water treatment.

Segmentation is the Key

With a complex smart city network, segmentation is the key. For example, the Smart Transportation network needs to be logically segmented from other smart networks, such as user services, websites, or energy networks, etc. This aids in isolating an attacks, and allows for the advanced detection of data and threats as attacks and malware move from one network zone to the other. This also divides the smart city network into security zones, which aids in compliance, monitoring internal traffic and devices, and preventing unauthorized access to restricted data and resources.

Such segmentation will ensure that the majority of the IoT components deployed across the smart city only communicate with those devices and systems they should, and only talk in the protocols they have been assigned. This will also ensure that the interior network doesn’t get hacked and can’t participate in a DDoS attack.

In a similar way, other smart networks in the city can be segmented and isolated from each other, thereby avoiding the spread of malware and reducing the impact of any hacks and attacks. Further, smart cities must make include the ability of IoT equipment to support and control such traffic an essential purchasing requirement.

Increasing the Security in Smart Cities from the Outside: DDoS Attacks

While network segmentation will ensure that the internal network is protected and its integrity and availability are preserved, we need to increase the availability of the smart city’s Internet facing properties. DDoS attacks can be easily used to overwhelm this infrastructure. Depending on the size of the pipe, and expected worst-case scenarios, city IT teams must develop and implement and effective DDoS attack mitigation strategy. This may be comprised of either an over provisioned appliance solution, or a hybrid solution consisting of appliances combined with a cloud based scrubbing center.

An over provisioned appliance solution enables you to manage DDoS attacks that are larger than your normal bandwidth usage. For example, if your normal user traffic is 1 Gbps, develop a plan for a 20 Gbps DDoS attack that includes deploying an appliance to mitigate such attacks, and provision for such potential bandwidth requirements from your service provider. If the actual attack is expected to be larger than your service provider bandwidth, however, you may need a hybrid solution that includes a cloud-based scrubber that works closely with your DDoS appliance solution.

From Smart to Smarter

As time passes, smart cities will become even smarter as they learn from researchers, from each other, and from incidents that are bound to happen.

Featured

Seedstars seeks tech to reverse land degradation in Africa

A new partnership is offering prizes to young entrepreneurs for coming up with innovations that tackle the loss of arable land in Africa.

Published

on

The DOEN Foundation has joined forces with Seedstars, an emerging market startup community, to launch the DOEN Land Restoration Prize, which showcases solutions to environmental, social and financial challenges that focus on land restoration activities in Africa. Stichting DOEN is a Dutch fund that supports green, socially-inclusive and creative initiatives that contribute to a better and cleaner world.

While land degradation and deforestation date back millennia, industrialization and a rising population have dramatically accelerated the process. Today we are seeing unprecedented land degradation, and the loss of arable land at 30 to 35 times the historical rate.

Currently, nearly two-thirds of Africa’s land is degraded, which hinders sustainable economic development and resilience to climate change. As a result, Africa has the largest restoration opportunity of any continent: more than 700 million hectares (1.7 billion acres) of degraded forest landscapes that can be restored. The potential benefits include improved food and water security, biodiversity protection, climate change resilience, and economic growth. Recognizing this opportunity, the African Union set an ambitious target to restore 100 million hectares of degraded land by 2030.

Land restoration is an urgent response to the poor management of land. Forest and landscape restoration is the process of reversing the degradation of soils, agricultural areas, forests, and watersheds thereby regaining their ecological functionality. According to the World Resources Institute, for every $1 invested in land restoration it can yield $7-$30 in benefits, and now is the time to prove it.

The winner of the challenge will be awarded 9 months access to the Seedstars Investment Readiness Program, the hybrid program challenging traditional acceleration models by creating a unique mix to improve startup performance and get them ready to secure investment. They will also access a 10K USD grant.

“Our current economic system does not meet the growing need to improve our society ecologically and socially,” says Saskia Werther, Program Manager at the DOEN Foundation. “The problems arising from this can be tackled only if a different economic system is considered. DOEN sees opportunities to contribute to this necessary change. After all, the world is changing rapidly and the outlines of a new economy are becoming increasingly clear. This new economy is circular and regenerative. Landscape restoration is a vital part of this regenerative economy and social entrepreneurs play an important role to establish innovative business models to counter land degradation and deforestation. Through this challenge, DOEN wants to highlight the work of early-stage restoration enterprises and inspire other frontrunners to follow suit.”

Applications are open now and will be accepted until October 15th. Startups can apply here: http://seedsta.rs/doen

To enter the competition, startups should meet the following criteria:

  • Existing startups/young companies with less than 4 years of existence
  • Startups that can adapt their current solution to the land restoration space
  • The startup must have a demonstrable product or service (Minimum Viable Product, MVP)
  • The startup needs to be scalable or have the potential to reach scalability in low resource areas.
  • The startup can show clear environmental impact (either by reducing a negative impact or creating a positive one)
  • The startup can show a clear social impact
  • Technology startups, tech-enabled startups and/or businesses that can show a clear innovation component (e.g. in their business model)

Also, a specific emphasis is laid, but not limited to: Finance the restoration of degraded land for production and/or conservation purposes; big data and technology to reverse land degradation; resource efficiency optimization technologies, ecosystems impacts reduction and lower carbon emissions; water-saving soil technologies; technologies focused on improving livelihoods and communities ; planning, management and education tools for land restoration; agriculture (with a focus on precision conservation) and agroforestry; clean Energy solutions that aid in the combat of land degradation; and responsible ecotourism that aids in the support of land restoration.

Continue Reading

Featured

The dark side of apps

Published

on

Mobile device security threats are on the rise and it’s not hard to see why. In 2019 the number of worldwide mobile phone users is forecast to reach 4.68 billion of which 2.7 billion are smartphone users. So, if you are looking for a target, it certainly makes sense to go where the numbers are. Think about it, unsecured Wi-Fi connections, network spoofing, phishing attacks, ransomware, spyware and improper session handling – mobile devices make for the perfect easy target. In fact, according to Kaspersky, mobile apps are often the cause of unintentional data leakage.

“Apps pose a real problem for mobile users, who give them sweeping permissions, but don’t always check security,” says Riaan Badenhorst, General Manager for Kaspersky in Africa. “These are typically free apps found in official app stores that perform as advertised, but also send personal – and potentially corporate – data to a remote server, where it is mined by advertisers or even cybercriminals. Data leakage can also happen through hostile enterprise-signed mobile apps. Here, mobile malware uses distribution code native to popular mobile operating systems like iOS and Android to spread valuable data across corporate networks without raising red flags.”

In fact, according to recent reports, 6 Android apps that were downloaded a staggering 90 million times from the Google Play Store were found to have been loaded with the PreAMo malware, while another recent threat saw 50 malware-filled apps on the Google Play Store infect over 30 million Android devices. Surveillance malware was also loaded onto fake versions of Android apps such as Evernote, Google Play and Skype.

Considering that as of 2019, Android users were able to choose between 2.46 million apps, while Apple users have almost 1.96 million app options to select from, and that the average person has 60-90 apps installed on their phone, using around 30 of them each month and launching 9 per day – it’s easy to see how viral apps take several social media channels by storm.

“In this age where users jump onto a bandwagon because it’s fun or trendy, the Fear of Missing Out (FOMO) can overshadow basic security habits – like being vigilant on granting app permissions,” says Bethwel Opil, Enterprise Sales Manager at Kaspersky in Africa. “In fact, accordingly to a previous Kaspersky study, the majority (63%) of consumers do not read license agreements and 43% just tick all privacy permissions when they are installing new apps on their phone. And this is exactly where the danger lies – as there is certainly ‘no harm’ in joining online challenges or installing new apps.”

However, it is dangerous when users just grant these apps limitless permissions into their contacts, photos, private messages, and more. “Doing so allows the app makers possible, and even legal, access to what should remain confidential data. When this sensitive data is hacked or misused, a viral app can turn a source into a loophole which hackers can exploit to spread malicious viruses or ransomware,” adds Badenhorst. 

As such, online users should always have their thinking caps on and be more careful when it comes to the internet and their app habits including:

  • Only download apps from trusted sources. Read the reviews and ratings of the apps as well
  • Select apps you wish to install on your devices wisely
  • Read the license agreement carefully
  • Pay attention to the list of permissions your apps are requesting. Only give apps permissions they absolutely insist on, and forgo any programme that asks for more than necessary
  • Avoid simply clicking “next” during an app installation
  • For an additional security layer, be sure to have a security solution installed on your device

“While the app market shows no signs of slowing down, it is changing,” says Opil. “Consumers download the apps they love on their devices which in turn gives them access to content that is relevant and useful. The future of apps will be in real-world attribution, influenced by local content and this type of tailored in-app experience will lead consumers to share their data more willing in a trusted, premium app environment in exchange for more personalised experiences. But until then, proceed with caution.”

Continue Reading

Trending

Copyright © 2019 World Wide Worx