# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 1 Introduction
In 2019, law enforcement agencies responded to more attacks on CNI than we ever saw before; this trend was highlighted as a key emerging threat by Europol [32]. CNI such as smart energy, water or transport are complex, large-scale interconnected CPSs converging physical and cyber domains and utilise geographically dispersed ubiquitous distribution networks, which extend beyond the boundary of a smart city, often across national borders and legal jurisdictions. The rise of cybercrime has been greatly facilitated by the proliferation of modern advanced electronic communication technologies and the integration of IoT with physical systems [17, 28, 33]. High profile cyberattacks on ICSs have been well reported for some years, such as the Stuxnet malware targeting the Iranian nuclear plant [34], the attack on the Ukrainian power grid [35] or Norsk Hydro, a renewable energy supplier and the world's largest aluminium producer, which was compromised by the LockerGoga ransomware [32]. In case of a successful cyberattack, the disruption of power, water or fuel supplies to these facilities could have a potentially serious socio-economic impact including civilian unrest; however, consequences could be more profound. For example, in the widely reported Kemuri Water Company attack, the mixture of chemicals used to treat a water plant was altered. In this attack, the sensors responsible for monitoring the water treatment plants were compromised [29]. Due to the distributed nature and heterogeneity of CPSs, human interactions and the omnipresence of the underpinning technologies create hugely diverse attack vectors which increase the threat of cyberattacks on critical systems. Comparatively, smart cities, smart healthcare and smart homes are in the earlier stages of development with several evolving projects including initiatives to improve the wellbeing of elderly people through early changes detection [36] or application of digital forensics as a service in the context of smart homes [37]. Furthermore, connected appliances and app-based utility management will become the norm in connected homes [38] whilst automated congestion control, smart traffic lights or parking [39,40] will be part of smart cities' digitalization projects [14]. The cyber challenges in these smart sectors differ but the effect could be just as profound. For example, the ransomware attack against the San Francisco Municipal Transportation Agency's transport service only resulted in financial impact [41]. Accidents caused by cyberattacks including GPS ghosting, hijacking command and control systems, ransomware or attacks targeted at sensors, actuators or controllers could result in serious accidents and increase the pressure on healthcare systems. Digital transformation utilising mobile and emerging technologies such as artificial-intelligence (AI)-enabled networked medical devices or wearable health sensors are identified as enablers for healthcare organisations. However, healthcare does not escape cyberattacks as learnt from the WannaCry incident in May 2017 affecting over 300,000 computers, some of which belonged to 80 National Health Service (NHS) Trusts across the UK [26,32,42]. Due to the attacks becoming more sophisticated and targeted, the countermeasures also need consistency and coordination [5,26,28,32]. Therefore, a new paradigm must address cyber threats and cybercrime. Formulating cyber resilience to counter cybersecurity threats is required to resist cyberattacks and continue to function effectively under adverse conditions [43]. Accepting that not all cyberattacks are avoidable and computer-related crime is on the increase, the IR becomes an important component of CPS security management [32] including the need for digital evidence (DE). Forensic DE gathering must be carried out without compromising the integrity and authenticity of the DE to ensure admissibility in a court of law [44].