# Privacy and Security in Cognitive Cities: A Systematic Review
## 3 Results
### Actionable Security and Privacy Proposals  
Most of the analyzed articles discuss the need for privacy and security solutions and point out some of the main challenges that cognitive cities will face. However, only six articles present actual actionable proposals to face some of these issues [47; 49; 50; 54; 55; 56]. We summarize them next:  
In the context of a cognitive city mobile application, [PERSON] et al. [56] proposed a privacy menu that allows users to decide which data would be shared only with the system and which data would be shared in an anonymized manner with other users. Other aspects mentioned are: storing user information only in secure servers, using encryption, and clearly stating the purpose of the assembled (and shared) information. [PERSON] and [PERSON] [54] discussed the need for taking into account cybersecurity aspects during the design process of the infrastructures that support smart and cognitive cities, and proposed to use a triple-category security metrics intended to measure and assess the security level of infrastructures. These metrics are (i) _target metrics_: a binary measure used to represent whether the system complies with a given standard configuration. Components would be weighted by component criticality and the compliance of each type of component would be measured separately. Finally, measures for each component type are aggregated, (ii) _vulnerability metrics_: consist of a vulnerability assessment combined with basic threat design, which describes how the system is likely to be attacked, and (iii) _usability metrics_, which test the ability of the system to provide the functionalities required by stakeholders. Also in the design stage, [PERSON] and [PERSON] [49] proposed a privacy-by-design (PbD) approach that should be embedded into _\"every technology, system, standard, protocol and process that touches the lives and identities of citizens in a Cognitive City\"_[49] (p. 62). This is an integrative approach to privacy and data protection measures, which includes technology, networked infrastructures, and physical design (besides policies, procedures, and operational processes). The proposed framework comprises seven principles that the aforementioned elements should fulfill: (i) proactive privacy, including managerial actions to demonstrate the value of privacy, a culture of continuous improvement, and advancing controls to detect and prevent privacy breaches, (ii) privacy as the default setting, with no action required to protect data, (iii) embedded into the design of technologies, operations and information architectures, (iv) avoiding the trade of privacy with other interests (e.g., performance), (v) end-to-end security-full life-cycle protection of confidentiality, integrity and availability, (vi) visibility and transparency of the policies and practices, and (vii) keeping interfaces _user-centric_, so that citizens are able to make informed privacy decisions in a reliable way. The authors also recall the concept of _SmartData_[62], as a cognitive web-based intelligent agent that holds an individual's personal information and the rules to protect security and privacy, so that the agent would be transmitted or stored as a proxy for data, not the personal information itself. The article considers that this cognitive SmartData agent could learn and respond to unforeseen security or privacy situations, and applies it for building a privacy-protective surveillance architecture. The architecture balances the collection of just the right significant data associated with terrorist-related activities by intelligence agencies and preserves privacy of other personally identified data, so that it would only be disclosed to the appropriate authorities for law enforcement. Following a different approach, [PERSON] et al. [47] suggested the adoption of the Web of Things (WoT) [63] as a more secure paradigm for building cognitive cities, instead of IoT, which is the most accepted approach for smart and connected cities.