Security Researchers Start Effort to Protect ‘Smart’ Cities - The New York Times

The New York Times, by Nicole Perlroth

It’s a brave new world when hackers step in to protect citizens because regulators are not getting the job done.

Two years after President Obama signed an executive order setting voluntary guidelines that companies could follow to prevent cyberattacks — especially on critical infrastructure like dams and water treatment facilities — security experts have found that American critical infrastructure is still wide open to attack.

The order was a weakened alternative to cybersecurity legislation that the White House tried and failed to push through Congress after Senate Republicans argued the minimum standards would be too onerous on the private sector.

Last year, Cesar Cerrudo, an Argentine security researcher, began pointing out critical vulnerabilities in America’s so-called smart cities, where wireless sensors control a growing portion of city infrastructure from traffic lights to water and waste management systems.

One year later, Mr. Cerrudo discovered that little had been done to patch those basic vulnerabilities, even as cities around the world poured billions of dollars into bringing more of their basic infrastructure online. Without renewed focus on security, he and other researchers warn, those cities are just creating larger and larger targets for nation states and cyberterrorists.

“What I found is that there are a lot of security problems — the situation is really bad — but I didn’t want to just point out problems without offering solutions,” Mr. Cerrudo said.

In response, on Tuesday, he and others from IOActive Labs; Kaspersky Lab, the Russian cybersecurity company; and a growing list of security experts will announce a new Securing Smart Cities initiative. Their goal is to bring private security researchers and public administrators together to set up basic cybersecurity checklists for smart cities, including properly installed encryption, passwords and systems that can be easily patched for security holes. Read more.