How to protect cities from the test of cyberattacks

#ForumZéroCarbone Paris - Securing the city from cyber threats, protecting infrastructures

It was the day after a party, more precisely December 26, 2020... The City of La Rochelle suffered a cyber attack on its information system that day. “We didn't know at the start what the extent of the damage was. So we made the choice, on the recommendations of the gendarmerie, to cut everything. And cutting everything means a city, an agglomeration, an administration, which are 'flat', "recalls Marie Nédellec, deputy to the City of La Rochelle and community adviser in charge of institutional communication, digital transformation and systems. of information. For several days, services such as heating in some buildings in the city, access to underground car parks, the service for issuing burial permits were “out of order”. With, opposite, the fear of seeing data disclosed and the incomprehension of the inhabitants...

A scenario that is far from isolated. Because the assaults on communities are increasing: the public interest group Acyma recorded a 50% increase in reports of these cyberattacks in 2020, compared to 2019. In large part, the threat comes from "ransomeware", in other words , malware that blocks access to the computer or files by encrypting them and demanding payment to open access again. The threat hangs over all communities, from small to large.

In Paris, where the City uses more than a thousand applications for its some 300 professions, the challenge is truly "titanic", underlines Antoine Guillou, deputy to the Paris City Hall in charge of human resources, social dialogue and the quality of public service. “Given the criticality of a certain number of services, we are obliged to protect ourselves as much as possible against any type of threat. And to prepare ourselves, if ever an attack were to break through our defences, to be able to operate in a degraded manner - which is complicated...", he says.

Strengthen the protection

But to protect yourself, the challenges are enormous. First, in a large information system, identifying a threat the very day it occurs is like "looking for a needle in a haystack", says Guillaume Doyen, professor of cybersecurity at IMT Atlantique, specializing in security of very large systems. A task that is all the more difficult “if we use service providers and we are in black box mode, in a way,” he adds. The whole issue, according to him, is to be able to have “a very short reaction time and real detection reliability”. And find, moreover, "the root cause" among the thousands of alerts that can be triggered when an attack takes place. Good news, researchers are working on solutions of the type "highly distributed architectures, which aim to deal with these problems", he assures, to add: "we are working more and more to automate detection systems , reaction, mitigation and recovery. In fact, in smart city critical infrastructures, which are “very complex systems of systems, it is no longer possible to give all the keys to the human operator. He has a real role to play, certainly, but at the height of what he can do. »

Another avenue, for Philippe Rondel, security architect at Checkpoint Software, a provider of security solutions, “separate critical systems, on which appropriate and differentiated security must be provided, from other systems. " But it is still necessary to define what, for a local authority, is a critical system... "The most critical includes the distribution of water, traffic, waste collection, management of cemeteries, social services ... “, abounds Antoine Guillou. However, "some systems, in the immediate future, may not appear as critical as others, but become so if they are incapacitated for a long time", he nuances.

Connected objects, the weak link

Among the weak links in the smart city that are of particular concern are connected objects. “We feel like we're going back to the IT of 15 years ago, with, for example, unique passwords, or the same certificates on all objects,” notes Philippe Rondel. Often, "as much as the surface software was created recently, the background software was created years ago and therefore contains a lot of vulnerabilities", he continues. The watchword, in all cases, is to regularly update all these tools. What is more complicated when subscribing to a complete service with an external company... "In this approach, organizations must ensure the level of security that is delivered, as well as the ability to update day,” he warns. For his part, Guillaume Doyen notes that “if you are the operator of your infrastructure, you are responsible for updating your information system and this operation is not trivial. »

Ways to beef up protection therefore exist. Still, in the battle against the scourge of cyberattacks, one of the answers, in the longer term, undoubtedly lies in security by design, according to Guillaume Doyen. Finally, communities that have been victimized by hackers are learning some lessons. "When choosing a tool, it is not only necessary to base oneself on the technical capacity, but also on the relationship with this service provider, which implies reactivity and agility", notes Marie Nédellec, who also wonders on questions of digital sovereignty in the choice of infrastructure software. "We have developed our own data center to have control over the storage of our data", indicates Antoine Guillou in this regard. Without forgetting the training of staff... "Each agent can be a gateway, hence the need to raise awareness among all staff", concludes the elected official.

6 mins

Share :