# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 1 Introduction  
Industry 4.0, synonymously known as cyber-physical production systems (CPPSs), is a concept formed in 2011 at the Hannover Fair to describe how cyber-physical systems (CPSs) can be applied within production and manufacturing industries with enabled automation [1; 2; 3; 4]. From the inception of the visionary notion specifically for factories and large-scale enterprises, CPSs' reach have extended beyond production enterprises linking the Industry 4.0 concept with aspects of smart city initiatives [3; 4]. Smart cities have evolved and transformed over the past two decades becoming deeply integrated within the society facilitating an interconnected digital environment [3; 4; 5]. The estimated growth of the urban population is estimated to reach 5 billion by 2030 globally [6]. A variety of definitions for the term \"smart city\" [7; 8; 9; 10; 11; 12], its sectors and components [3; 13; 14; 15; 16; 17], the variants [8] and concepts of the term \"smart\" [18; 19; 20; 14; 21; 6; 14] have been suggested. The description of smart cities is heterogeneousand commonly agreed facets converge sustainability, ICT-based technology and community needs. Therefore, in this study, we consider the smart city as an urban space using technology and resources innovatively, intelligently and securely to improve the lives of its citizens focusing on the spectrum of attributes that improve the cyber resilience of smart cities. A key component of smart cities, CPSs can be described as smart, embedded and networked systems within production systems [22]; a tangible element that is not completely controlled by an automated system and a cyber element that focuses on the digital information form CPS entities capable of autonomous interaction regardless of human supervision [23]. Furthermore, these complex and growing networks of connected objects incorporate human-users and form complex cyber-physical-natural (CPN) ecosystems interrelating systems, software, people and services. As such, a problem within this complex cyberspace, including cybersecurity challenges, can have a cascading effect on the entirety of the ecosystem [24, 25]. The motivation and tactics of the cyber threats landscape shifted from individuals hobby hacking to gain kudos amongst their peers toward well-organised cybercrime [26, 27, 28]. The motivations are often intensified by the possibilities to gain sensitive information, which can be used in subsequent attacks including cyberattacks against industrial control systems (ICSs) or critical national infrastructure (CNI). Verizon reported in their 2016 Data Breach Investigation Report the outcome of the investigation of 500 cybersecurity incidents in over 40 countries. In 89% of the cases, the key motives reported were described as \"financial\" and \"espionage\" fixated on targets including manufacturing, healthcare, utilities and public services by organised crime and state-affiliated groups. Many of these attacks had a secondary motive to aid an intrusion of another target [29, 30]. This class of attacks known as advanced persistent threats (APTs) characterise a well-resourced group of attackers that carry out multi-stage and often multi-year persistent targeted campaigns. Traditional incident response (IR) methods fail in mitigating APTs because they assume successful intrusion before IR takes place. A kill chain model enables one to map such campaigns, identify patterns linking individual intrusions and through an iterative intelligence gathering enables the development of a resilient intelligence-driven mitigation approach [31]. In 2018, although the key motives remained largely unchanged, the most noteworthy attack vectors reported by the European Union Agency for Network and Information Security (ENISA) included malicious attachments, URLs in emails targeting the human element, web browser-based malicious scripts, malvertising, exploit kits and password reuse or weak service credentials in Internet exposed assets [26].