# Cybersecurity Risk Assessment in Smart City Infrastructures +
## 2 The Cybersecurity Threats Typical to the Smart City Network Infrastructure  
The smart city concept implies the interaction of information and communication technologies for the management of modern urban services: transportation, medical care,power planting and supplying, etc. Data processing and analysis of dataflow received from a variety of smart sensors allow it to monitor and predict the occurrence of cyber threats of different types [12]. Currently, intruders using network infrastructure and wireless data transmission channels can remotely invade a target device (group of the connected devices), intercept network traffic, launch the denial of service (DoS) attacks (including the distributed ones), and capture IoT devices to construct a botnet of smart devices [13; 14]. The security issue for the smart city is the variety of horizontal connections, the heterogeneous nature of the network infrastructure, and a huge number of entities at a constantly changing topology. Making risk-based security management in real-time requires the availability of a powerful operating center that aggregates data from many different sources with different characteristics. Software vulnerabilities also pose a serious problem for ensuring a high level of security for smart city systems [15]. Connected devices implement different functions, they have various capabilities and features, they are produced by different manufacturers, and with different versions of hardware and software, they meet different security standards. All of these form fertile soil for an intruder to exploit the software vulnerabilities and applied protocols. The main problem is that attacker can make a successful attack on a poorly protected device that can directly or through a device-to-device chain interact with the target device (or digital service) of the attack. Software vulnerabilities can vary from developer's errors to backdoors, as well as from the hardware level to the city-specific application level. A complete enumeration of different reasons causing most of the security alerts in the self-organizing network of the smart city includes:  
* The absence of fixed network topology and central nodes makes it impossible to organize a centralized security policy;
* There are no protective tools on each network node;
* This type of the smart networks is public, which makes it possible to spoof a message, signal, or even a network node;
* There is a wide range of possibilities to compromise the poorly protected nodes;
* There is a huge number of connected nodes, and, correspondently, there is a requirement to process large data of cybersecurity;
* There is a set of channel vulnerabilities;
* The network has a limited computing power of the connected devices. There is a large amount of research devoted to the analysis of cyber threats and the creation of methods of protection against them in smart cities. In [16], the authors point out that the main threats to medical applications in a smart city are threats aimed at breaching privacy and security, including a DoS attack, MitM attack, and password sniffing. The authors argue that when developing cybersecurity systems, it is necessary to take into account the characteristics of the IoT, creating lightweight solutions. The work of [17; 18; 19; 20] highlights the danger of network threats, while two types of intruders can be distinguished: internal and external. The work of [21] formulates security requirements, which smart city systems must meet: authentication and confidentiality, availability and integrity, lightweight intrusion detection and prediction, as well as privacy protection. The authors have developed a classification of possible approaches to ensuring the cybersecurity of the smart city infrastructures: cryptography, blockchain, biometrics, machine learning and data mining, game theory, ontology, and non-technical supplements. Cyberattacks on the dynamic self-organizing networks of the smart city can be divided into passive and active ones. The passive cyberattack usually violates confidentiality.