# A Comprehensive Survey on the Societal Aspects of Smart Cities
## 3 Smart Cities' Technologies
### Security  
As stated before, data assume a great importance for smart cities since they generate enormous volumes of data during their operation. These data contain sensitive and personal information that must not fall into the hands of malicious actors. Therefore, robust security measures are required to guarantee the data security and privacy. In this section, we will discuss the security risks in a smart city environment as well as what measures can be taken to prevent them and maximize security.  
The first place to start is not technological but legal. A solid body of laws and enforcement mechanisms on how data can be collected, accessed, shared, and used ensures that developers must add security and privacy measures to their solutions to be used in commercial environments. This is challenging due to how technological evolution outpaces legal analysis and decision-making. Furthermore, the different laws of different countries are also an obstacle, as an application that is legal in one country can be illegal to use in others [286]. Nevertheless, progress has been made, and initiatives such as the European Union (EU) General Data Protection Regulation (GDPR), despite only being enforceable on EU member countries, incentivize developers across the world to comply with it, ref. [287], as well serve as a foundation for future law changes and as a template for legislation in other countries [288,289].  
To guarantee the GDPR, it is necessary to consider the possible risks and measures to minimize them. Starting with data collection, it is necessary to guarantee that any data collected has any identifying information obfuscated or erased to protect the privacy and safety of the person whose data was collected. This is especially important on data collected from social networks, as users share a lot of personal information (e.g., location or names) that might be used by malicious agents to attack the individual (e.g., identity theft, inference attacks, or cyber-bullying) [290].  
The next point is data transmission, since all data collected must be transmitted to a centralized location for analysis and storage, which leaves the data in transit vulnerable to various types of attacks (e.g., man-in-the-middle or spoofing). While there are ways to detect if these types of attacks are occurring, the best way to prevent them from being successful is to guarantee that all data transmitted is encrypted [291]. Systems like public key cryptography allow for both authentication of nodes as well as the ability for those nodes to encrypt their data [292,293]. Although these systems are robust, they may be too resource intensive for the IoT systems used in smart cities, which opens the way to architectures like SafeCity that allow for the encryption of data in resource-strapped systems [294].  
Finally, the data must be secured while it is in storage and, therefore, measures should be implemented to prevent access from unauthorized sources and identify attacks [295]. Moreover, encrypting the stored data means that these data must be decrypted before being used, which can only be performed by authorized users. Data encryption is a key measure in countering data breaches, so that even if the security measures of the storage systems fail, the data stolen will be valueless as the breach perpetrators cannot access them [296]. In turn, robust logging and auditorial systems also help to prevent authorized users abusing data for which they do have permission access. Finally, the use of blockchain technology enables the secure and redundant storage of data while creating a security system that is very hard to tamper with and distribute, along with integrated auditing systems [297].