Billions of devices connected to the Internet, thousands of sensors in our (Smart) City.. IOT Security, System and Network Security, Application Security, Malware, Ransomware.. What could possibly go wrong? A brief introduction to the cybersecurity issues and challenges for the Smart Cities: what are the risks, what are the consequences, how can we avoid them?

1. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 1
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity
Billions of devices connected to the
Internet.. thousands of sensors in our
(Smart) City..
..IOT Security, System and Network
and Application Security, Malware,
Ransomware..
What could possibly go wrong?
..a brief introduction to the
cybersecurity issues and challenges for
the Smart Cities.

2. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 2
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Agenda
•Introduction
•What are the risks?
•How to minimize the risks?
•References
•Q&A
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity

3. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 3
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
$ whoami$ whoami
•work:
•penetration testing,
risk assessment,
training, ..
•fun:
•ISACA Venice
•sikurezza.org
•(f|er-|bz-)lug
Speaker:Speaker:
Igor FalcomatàIgor Falcomatà
CEO & founderCEO & founder
ifalcomata@enforcer.itifalcomata@enforcer.it
Partner commerciale:Partner commerciale:

4. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 4
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Agenda
•Introduction
•What are the risks?
•How to minimize the risks?
•References
•Q&A
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity

5. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 5
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
IntroductionIntroduction

6. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 6
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
IntroductionIntroductionhttp://www.smart-cities.eu/model.html

7. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 7
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
TechnologyTechnology
Web 2.0 &
mobile
ICS/
SCADA
(I)IoT/
Custom
Legacy/
Embedded
Smart
City

8. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 8
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Agenda
•Introduction
•What are the risks?
•How to minimize the risks?
•References
•Q&A
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity

9. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 9
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Smart (?) Cities..Smart (?) Cities..

10. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 10
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Smart (?) Cities..Smart (?) Cities..

11. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 11
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Web 2.0..Web 2.0..

12. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 12
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Mobile..Mobile..

13. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 13
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
IOT..IOT..
The S in IOT
stands for Security

14. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 14
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
IOT..IOT..

15. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 15
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
OWASP IoT Attack Surface AreasOWASP IoT Attack Surface Areas
Image credits: Dan Miesseler
https://hackaday.com/2016/06/13/iot-security-is-an-empty-buzzword/

16. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 16
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
ICS/SCADAICS/SCADA

17. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 17
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
ICS/SCADAICS/SCADA

18. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 18
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
CyberwarCyberwar

19. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 19
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Agenda
•Introduction
•What are the risks?
•How to minimize the risks?
•References
•Q&A
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity

20. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 20
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
Remeber:
You’re exposed to
ole-wild Internet

21. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 21
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
GDPR:
Privacy by design
Security by design

22. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 22
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
Open standards /
Compliance

23. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 23
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
“Don’t reinvent
the wheel”

24. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 24
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
SSDLC

25. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 25
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
Beware:
Cloud lock-in

26. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 26
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
“Future proof”

27. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 27
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
Research / Risk
assessment /
VA / PT / ...

28. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 28
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
How to minimize the risks?How to minimize the risks?
The bug, the
bounty and
the white
hat..

29. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 29
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Agenda
•Introduction
•What are the risks?
•How to minimize the risks?
•References
•Q&A
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity

30. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 30
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
ReferencesReferences
OWASP (eg. Top Ten, Testing Project, cheat sheets, IoT Project, ..)
https://www.owasp.org/
CIS Critical Security Controls
https://www.sans.org/critical-security-controls
ISO 27k
https://www.iso.org/isoiec-27001-information-security.html
NIST Cybersecurity for IoT Program
https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program
IoT Security Foundation
https://www.iotsecurityfoundation.org/
GOV.UK - Secure by Design
https://www.gov.uk/government/publications/secure-by-design
Shodan - The search engine for Security ..
https://www.shodan.io/
Thinkst ConCollector (eg. “zigbee”)
http://cc.thinkst.com/

31. © Igor Falcomatà <ifalcomata@enforcer.it>, alcuni diritti riservati: http://creativecommons.org/licenses/by-sa/2.0/it/deed.en - Page 31
Smart Cities vs (?) Cybersecurity – SFScon 2019 – 15/11/2019 - Bolzano
Agenda
•Introduction
•What are the risks?
•How to minimize the risks?
•References
•Q&A
Smart Cities vs (?) CybersecuritySmart Cities vs (?) Cybersecurity