# Privacy and Security in Cognitive Cities: A Systematic Review
## 4 Discussion
### Dealing with Legacy Software and Hardware Updates  
While the cognitive city paradigm develops and gradually pervades our cities, different technologies are expected to converge and interact with each other within the urban arena. From _the old good_ IoT devices to state-of-the-art ML systems, every single piece of hardware and software that comprises cognitive systems will play its part in the daily routines of citizens. Therefore, security vulnerability management processes must be planned thoroughly before deploying any technology, and periodically executed through all its life-cycle to detect security or privacy risks. Moreover, special care should be taken in managing obsolescence, so that discontinued or simply obsolete ICT components be identified beforehand and replaced by newer and patched equivalent products.  
From a pure technological perspective, some new developments may help lessen the risks of using older technologies, by adding an extra layer of security on top of the latter. For example, with respect to the security problems of IoT, [PERSON] et al. have suggested to take advantage of blockchain features [65], such as distributed consensus and pseudonymity, to address confidentiality and integrity issues. They have also argued that data modification attacks are useless in public blockchains, because there is no single point of attack, and that the cost added to making new transactions protects the network against flooding and DDoS attacks [66]. However, while in some of these examples the addition of an extra technological layer may help deter vulnerabilities exploitation, attackers will always try to find _the weakest link_, as long as the outcome worths the cost. For this reason, although WoT could be an improvement with regard to IoT, it is not the ultimate solution because there are still many privacy and security issues within the Web itself, which is built upon underlying protocols that have not been widely updated since they were created back in the past decades. As an example, the Domain Name Service (DNS) protocol, upon which the web relies, is still vulnerable to attacks such as cache poisoning, which can redirect data from a WoT device to some attacker-controlled infrastructure, thus affecting privacy and security of the information transmitted by the device. Fortunately, DNS security extensions, which provide DNS resolvers with cryptographic authentication of the retrieved data, and malware-aware public DNS resolvers, such as _Quad9_[67], pave the way for more secure name resolution services. Similar approaches could be adopted for name resolving tools in top-level domains used within the devices and information systems of the cognitive city ecosystem. Nevertheless, the interactions between coupling technologies must be analyzed to uncover new hidden security risks and attack vectors. For example, a study on the security issues of machine and deep learning algorithms coupled with IoT is provided in [68]. Moreover, new technologies can also introduce new unexpected risks, even when trying to protect from others. As [PERSON] et al. have shown in [69], adversarial defense methods for ML models can increase vulnerability levels to privacy attacks. Also, [PERSON] et al. have highlighted in [70; 71] the threats of adversarial examples in speech recognition systems, which may play a key role in the cognitive cities of tomorrow. Therefore, the integration of any new technology in the cognitive city environment must be studied thoroughly, for each layer of the architecture, to guarantee end-to-end privacy and security of citizens' data.  
In summary, we sustain that ICT components will need to be managed over their entire life-cycles, from planning and integration to substitution and disposal stages, and the use of distinct technologies will require an in-depth study of its implications, particularly when mixing older with newer components.