Notifications
Clear all
Topic starter
11/07/2026 8:28 pm
TL;DR: Smart city deployments expand the attack surface because connected devices, gateways, and municipal networks can be disrupted at scale if identity, authentication, and encryption are not designed in from the start, according to GlobalSign. The security lesson is that operational resilience in IoT programmes depends on device identity lifecycle control, not just network connectivity.
NHIMG editorial — based on content published by GlobalSign: security by design for smart cities and the IoT
By the numbers:
- In 2050, 68% of the world's population is expected to live in urban areas, up from 55% today.
- Gartner projected that 50% of private US companies, critical infrastructure operators, and countries would adopt the cybersecurity framework by 2020.
Questions worth separating out
Q: How should organisations govern identity for smart city IoT devices?
A: Organisations should govern smart city IoT identities through a full lifecycle model that covers issuance, authentication, monitoring, rotation, and revocation.
Q: Why do smart city deployments create security risk so quickly?
A: Smart city deployments create risk quickly because they connect physical services to distributed device fleets, often before identity and logging controls are mature.
Q: What breaks when IoT security is added after rollout?
A: When IoT security is added after rollout, organisations usually inherit inconsistent onboarding, poor revocation, and incomplete asset visibility.
Practitioner guidance
- Standardise device onboarding and offboarding Create a mandatory onboarding workflow for every smart city device, including identity proofing, certificate issuance, asset registration, and a defined offboarding path for decommissioning or compromise.
- Rotate and revoke machine credentials on a fixed schedule Set certificate and key rotation requirements for gateways, sensors, and management services, and test revocation as part of incident response.
- Segment municipal control planes from device networks Separate management APIs, operational networks, and public connectivity paths so a compromised node cannot easily reach the rest of the environment.
What's in the full article
GlobalSign's full post covers the operational detail this post intentionally leaves for the source:
- How the PKI-based identity platform is used to issue and manage device identities across the full lifecycle.
- How the article frames authentication, authorisation, and encryption as a single security model for smart cities.
- How GlobalSign positions its IoT identity platform within broader smart city and utility ecosystems.
- How the article connects industry groups and standards bodies to large-scale IoT adoption.
👉 Read GlobalSign's analysis of smart city IoT identity and security design →
Smart city IoT identity governance: are your controls keeping up?
Explore further
11/07/2026 8:58 pm
Security from design is the only sane model for smart infrastructure: retrofitting controls onto deployed IoT estates almost always leaves blind spots in onboarding, certificate management, and revocation. Smart cities mix physical and digital risk, so weak identity design can produce outsized operational harm. The practical conclusion is simple: identity controls must be part of architecture decisions, not added after deployment.
A question worth separating out:
Q: What should teams prioritise in smart infrastructure identity controls?
A: Teams should prioritise strong authentication, explicit authorisation, certificate lifecycle management, and segmentation between device and management planes. Those controls reduce the chance that one compromised device can affect the broader environment. For municipal programmes, resilience depends on controlling trust boundaries, not just connecting more devices.
👉 Read our full editorial: Smart city identity governance depends on secure device lifecycle control
