Information Security Applications in Smart Cities: A Bibliometric Analysis of Emerging Research

1. Introduction

The advancement of solutions and tools focused on information security for smart cities is gaining prominence worldwide [1,2,3,4,5,6,7]. Furthermore, there has been a noticeable increase in the production of large volumes of data, agility in information exchange, data analysis (Data Science), development of smart cities, and connectivity between various devices. These continuous interactions with internet-focused solutions (Internet of Things - IoT) must be conducted in compliance with regulations [8,9,10]. However, they concurrently introduce profound challenges, especially in terms of data governance, and there is a growing emphasis on safeguarding the integrity, confidentiality, and availability of data as it’s generated, processed, and exchanged across diverse entities, spanning from private organizations to public sectors and the general populace [11,12,13,14].

As public services gravitate towards interconnected digital ecosystems, we can identify significant potential benefits, such as streamlined operations and bolstered resilience in critical infrastructures. Nonetheless, for metropolises and regions striving to transition into the smart city paradigm, it is imperative to not only meticulously assess but also proactively mitigate the inherent cybersecurity risks stemming from such integration [13,14,15,16,17,18,19,20,21]. While no technology solution can guarantee complete security, communities need to implement smart city technologies while considering the need to balance efficiency, innovation, and cybersecurity [20,22,23,24,25].

This context demands promoting privacy protections, national security, and the secure operation of infrastructure systems. Cities should tailor best practices to their specific cybersecurity requirements, ensuring the protection of citizens’ private data as well as the security of sensitive government and business information [20,24,26,27]. By promoting protection through proper guidelines, communities can strive to create a safe and secure environment while embracing the benefits of technological advancements [28].

In recent years, organizations have turned their attention to the increased risks that the lack of information security causes in the evolution and survival of businesses, mainly due to the large offer of technological devices and the growing access and dissemination of data and information [29,30,31,32]. The lack of information security evidence many losses for the different business stakeholders, especially when it negatively impacts the trust of customers and suppliers, the efficiency of services, the availability of operations, the credibility of the business, and the image of the company [33]. In this sense, organizations have adopted strategies to prevent the occurrence of security flaws caused by Denial of Service Attacks (DoS), hacking, malware, phishing, spoofing, ransomware, spamming, and other types of cyber-attacks [31,34,35,36,37]. Strategies, in general, are adopted to protect the business performance and maintain operational efficiency at competitive levels [38]. Thus, excellence in the cybersecurity process is essential to ensure the integrity, availability, and confidentiality of business data and information [39,40].

The discussion over the importance of information security has been highlighted in recent literature. The advancement of research in the area has considered aspects from risk assessment to recovery and resilience of cybersecurity [41,42]. On many occasions, Information Technology (IT) managers seek to analyze solutions to conduct operational strategies aimed at protecting business [43]. In recent years, although many researchers [44,45,46,47,48,49] have presented approaches to the importance, investment, and contribution of cybersecurity to organizations, society, and government, there is still a gap in the current literature: there are no studies that analyze the most influential works in the area of cybersecurity with an integrated view.

One of the premises for understanding the application of information security in smart cities research activities is to analyze its manifestation in the form of scientific production. In this sense, this paper aims to perform a bibliometric analysis to deepen knowledge of new applications of information security in smart cities to identify the main groups of researchers working collaboratively in the area. Moreover, this study provides a summary of research patterns, based on an institutional network, to present a better understanding of research advances and what is the latent content about information security in smart cities published in journals during the period from 2015 to 2023. The relevant articles were retrieved from the Scopus database.

The bibliometric analysis allows the visualization of the technical quality and impact of research, as well as grouping authors and co-authors, identifying the relationship between studies through keywords and number of citations, and displaying intellectual contributions from research fields, among other analyses. In addition, solutions and review of smart cities opens many opportunities and scopes for open research.

This paper is structured as follows: Section 2 presents a theoretical reference with related works about Smart Cities and information security research; Section 3 is devoted to Materials and Methods; Section 4 presents the Findings and Discussion; Section 5 contributes to the theory and presents practical implications; the conclusion, limitations, and further research are provided in Section 6.

2. Smart Cities and Information Security

Before starting a discussion about papers that have reviewed the literature on smart cities, it is essential to address some concepts. A smart city is understood as an urban area where electronic sensor technology is used to collect data from devices as well as assets and citizens for analysis and processing of the data to manage and monitor public infrastructures [50,51]. Smart cities are characterized by the following characteristics in terms of digitalization: Internet of Things (IoT), Big Data, and Cloud Services to promote integration [52,53].

At the heart of a smart city lies a tapestry of devices interconnected via wireless networks, often operating on open network protocols or APIs [54,55,56]. These elements, by their very design, can be susceptible to breaches, even by the smallest snippets of malicious code [57,58,59]. Consequently, information security shifts beyond the individual user’s realm and emerges as a communal imperative within the smart city landscape [60,61,62]. Moreover, the escalating intricacy of these system’s network infrastructures, magnified by digital communication, interconnected devices, and diverse network architectures, inevitably poses heightened security challenges [1,63,64,65,66,67].

The consequences of successful cyberattacks against smart cities can be severe and wide-ranging. They may include disruptions to essential infrastructure services, substantial financial losses, exposure of citizens’ private data, erosion of trust in smart systems, and even physical harm or loss of life due to impacts on physical infrastructure. According to Shin et al. [68], global spending on cybersecurity hardware, software, and services has significantly grown in the past few years, and the annual cybersecurity investment averages $ 1 billion by some financial and tech companies. Cyberattacks are a serious threat to the successful implementation of smart cities-related services. Comprehensive security mechanisms and a security-oriented mindset throughout the entire organization are essential to avert and control this risk.

Table 1 presents the risk domain in information security to smart cities found in the literature, addressing different perspectives on provider and user application of technologies.

The analysis of these works allows us to conclude that information security risk in smart cities is still in the development stage, in different devices. Thus, more comprehensive, and complete research and analysis of all recent publications in the field of information security is necessary and still lacking. In this sense, a bibliometric study is a valuable tool to present the interrelationships of researchers, their contributions, and the gaps to be worked on.

3. Materials and Method

The bibliometric analysis uses statistical methods to evaluate on the evolution of a particular research area. In this sense, it is possible to (i) evaluate the number of publications, the level of quality, the impact, and the contribution of the results; (ii) to carry out a mapping of the scientific activities of the authors; (iii) to understand networks of citations based on the authors; (iv) to obtain a real and detailed visualization of the results and intellectual structures of a scientific domain; (v) to promote the construction of knowledge; (vi) to monitor the evolution of a research field and (vii) to clarify unexplored research topics.

In the past ten years, the advance of cybersecurity research has developed significantly by influential authors in different journals and research areas. The present study consists of a technical and structured analysis of the progress of literature on cybersecurity, with the objectives of presenting collaborations in the editorial production of researchers, highlighting new insights on the role of information security engineering in the world, and stimulating development on future research lines. To direct the research, some questions are posed:

Q1 – What are the patterns of information security applications found in research on smart cities?

Q2 – What are the most demanding areas for information security and smart city studies?

Q3 – What research has the most influence on the application of information security and smart cities?

To answer these questions, this study adopts a theoretical approach, aiming to understand the state-of-the-art in the information security and smart cities research fields through bibliometrics and content analysis. Figure 1 shows the research design used in this paper which consists of five steps.

Step 1 starts with the data sources definition, considering the Scopus database, followed by search strings creation. In this study, two combinations of keywords were defined to compose the search string: (I) “information security” and “smart city”; and (II) “cyberattacks” and “smart city”. These terms are broad and expand the knowledge about the different knowledge application areas of the theme. The search was applied to titles, abstracts, and keywords of complete published articles.

In Step 2, the data set consists of complete articles published in journals indexed in the Scopus, ranging from 2015 to 2023. We decided to start searching for published results from 2015 due to the high number of citations from one of the articles of greater relevance to the area, published in the same year.

The work entitled "Cyber security challenges in Smart Cities: Safety, security and privacy", indicated in the reference list, has obtained 650 citations to date [15]. For this reason, we consider this time interval as the most relevant to collect data. A filter was used to remove articles that emerged from books, categorized. The purpose of using this filter was to focus on the article and conference reviews with significant academic impact and relevance in the research platform. In addition, other categories of publications have also been removed, so the objective is to identify the sectors and fields in which there are one or more surveys and the sectors and methods in which there are no surveys available. Scopus database was selected due to the broad approach of indexed sources, among journals, conferences, and books, increasing the range of data collection for the bibliometrics analyses.

As shown in Figure 2, there is a significant increase in articles on information security and smart city. The search results returned a total of 1978 articles, thus conference papers (55,5%) and journal articles (44,5%).

In Step 3, the VOSViewer software [137], which is a text-mining tool that supports comprehensive and useful compilation of metadata, supporting data generation, and graph visualization, was used as a bibliometric analysis tool.

In Step 4, the quantitative analysis involved the implementation of statistical, network, and content methods through the development of descriptive and cluster analyzes, comprising information regarding articles, journals, authors, citations, references, and keywords in terms of annual progress in the field of cybersecurity research. The objective was to discover the implications of quantitative results in terms of the historical development of the application of information security and smart city research field, its patterns, and evolution, to answer the three research questions.

Finally, in Step 5, qualitative analysis was used to investigate production indicators (most productive authors, number of publications, types of authorship, area of training), the international authors who constitute the research interface in the area or related areas, and the information security and smart city community. Also, the analysis of citations and their different relationships contributed to the identification of epistemological, methodological, and theoretical influences in the domain investigated. From this, through distinctive classifications and thesaurus, the universe of articles analyzed was categorized, which allowed identifying the gaps regarding the study object and contributing to improving the representation schemes on smart city knowledge.

4. Findings and Discussion

The advancement of IT and the emergence and growth of the internet led organizations to adopt new business models based on the potential market focused on creating and using cyberspace information. This business model allows organizations to obtain advantages, but on the other hand, they need to face several problems related to cyberspace security management, which are currently quite prominent.

The first publication in the area is "Cyberspace Security Management," published in 1999 by Chou et al. [138] in the journal of Industrial Management & Data Systems. This first publication evidences the leading causes of Internet security incidents. It starts the discussion about real concerns involving inherent risks, technology weaknesses, policy weaknesses, unauthorized intruders, and legal issues often provoked by players, which affect several business and government organizations in cyberspace. Chou et al. define as leading players the users, business sectors, and regulatory agents that influence the evolution of business and can interfere with principles of cybersecurity, such as confidentiality, integrity, and availability of data and information. The contributions of Chou et al. encourage the development of discussions on potential techniques, methodologies, and investment in IT solutions that address issues related to cybersecurity. As a result, several authors developed studies associated with the area and presented the results of a significant impact on the literature. Therefore, an analytical study of the main trends in the field, discussed in recent years, is suitable.

4.1. Identifying the information security applications in smart cities clusters of research through bibliographic

To analyze and visualize the knowledge clusters of research on information security applications in Smart Cities, the graph of relation in Figure 3 was created, considering the authors’ groups according to application theme.

Table 2 details the cluster’s compositions, separating them by name (related to the application domain) and listing their sizes as well as the most representative articles.

Cluster 1: Smart power grid in Smart Cities

One of the applications of information security is related to smart power grid maintenance in smart cities. A smart power grid can offer support to a smart communications grid since society increasingly requires information transfer infrastructure in daily activities [65]. Over the years, utilities have invested in communication networks to improve awareness of the power grid assets and to control, automate, and integrate the service delivery systems. The key point of integrating systems and working in real-time is connectivity. Most of the time, the web facilitates systems integration and benefits society with this support.

On the other hand, the web environment allows targeted attacks and attempts to break into the system. The North American Electric Reliability Corporation [325] highlighted compliance concerns in strengthening essential cybersecurity across the entire power system and emphasized that this requires a series of cybersecurity concerns [87,88,326,327].

For some authors, the smart grid needs to be observed and measured before being controlled and automated [328]. To that end, the automation of the power substation helps utilities add sophisticated protection and control functions while offering more visibility into the performance and integrity of the network infrastructure. Also, it is essential to note that the resilience of physical, and electrical networks must also be improved according to the flow of information, as critical operations can cause failures or can be combined with physical attacks to create a blackout [329].

A reliable smart grid requires layered protection applications that consist of a cybernetic infrastructure that limits adversary access and limits the operation of the transmission accurately during an attack.

Cluster 2: Authentication in Smart Cities

One of the mechanisms for protecting data and information is access control policies for systems. Access control helps to prevent unauthorized people from entering the virtual and/or physical environment and engaging in unauthorized behavior. By ensuring access control, the integrity of employees and service providers is provided, as well as the integrity of data and information [327].

Over the years, the growing number of companies that select an outsourcing strategy for managing the entire IT infrastructure has been noticed. This interest is often motivated by the high investment in current IT security solutions, which require constant adaptations to the environment [330]. On the other hand, this need for adjustments makes many outsourced companies assume that their technology service providers are responsible for data control. However, when it comes to information security and compliance, the organization promoting the leading service remains responsible for all the information it has, especially if the company wants to obtain more profitable results from the data.

In this context, the objective of managers is to ensure that the large volumes of data collected and stored by their organizations can be used as instruments that help to generate better business strategies, making companies more objective and eliminating any types of confusion that may be caused by the total amount of information to be evaluated, adopting control systems with different types of possibilities, which can be physical or digital [207,331].

Cluster 3: Cyber-attack in Smart Cities

The popularization of cloud computing encouraged the development of new businesses and reduced the need for high investment in IT infrastructure for small businesses, in particular. On the other hand, cybersecurity has become a significant concern for these companies. In the virtual environment, attackers create different threats to the systems of different businesses, from financial services agencies to sizeable industrial control systems [241,332,333]. Attack methods vary widely, using simple techniques to exploit the vulnerabilities of access and communication protocols, or through combined operations for the use of multiple web bots [334].

One of the strategies to combat these threats is intrusion detection, the most effective security mechanism for detecting internal attacks that consists of the process of monitoring and analyzing events that occur in a computer system or network in search of patterns of possible security incidents. For the authors, these security incidents are violations or threats to security policies defined as attempts to compromise the reliability, integrity, or availability of system resources [335,336,337,338]. Many types of malware can be programmed to destabilize the operation of a system, such as viruses, worms, Trojans, and backdoors [339,340].

One of the main concerns of the authors is that the automatic detection of known and unknown kernel rootkits on virtual machines is becoming an urgent problem. For the virtual environment, an Intrusion Prevention System (IPS) is considered an extension of the Intrusion Detection System (IDS) and can be executed when threats or malicious activities are detected [341]. Thus, there is a tendency for new solutions to be made available to promote a kind of digital investigation and detect cybercrimes [342].

Cluster 4: Security platform for vehicular Smart Cities

For current businesses, one of the main assets is useful information. However, defining the monetary value of threats to this information can be a complex process. Economic decision models have been used to quantify the cyberattack process or demonstrate the intruder’s detailed behaviors [343,344]. The advances in this area are mainly based on structured ways to present the consequences of the inventions to the IT Manager and recommend viable actions to avoid possible theft of information, for example, which represent the highest external cost, followed by the costs associated with interrupting operations of business [345].

To deal with rapidly evolving threats and risks, different approaches can be used to perform the command injection attack on the cyber component in the SCADA system: Model of the SQL Injection Attack, Model of the Secure Sockets Layer (SSL), Model of the Address Resolution Protocol, Model of the Buffer Overflow Attack [64,346]. In this context, dealing with an analytical decision model under conditions of uncertainty can be important for IT managers when planning information security programs.

Cluster 5: Evaluation of threats to cybersecurity

The domain of cybersecurity threats is directly related to discussions about cybersecurity control and data in online services. Form IT advancement, new communication technologies, and control methods may allow better regulation of the smart grid; however, they also introduce serious threats to cybersecurity. In the Digital Age, security is the keyword. For the authors, having reliable data, systems, and people is indisputable, because cyberattacks happen frequently, and systems capable of preceding an attack are essential [347].

Cyberattacks may also cause cascading failures in a power system, thus posing a serious threat to national infrastructure. Because of this, authors suggest that the preconditions for managing cybersecurity risks are: discovering incidents, collecting data, and viewing that data [163,348]. Three principles support this management cycle: maintaining the right data, robust IT infrastructure (systems), and an appropriate scope of sharing (people).

Impact analysis of threats is necessary to analyze the consequences of interruptions in the flow to protect and enable the evolution of business through technology, as well as to monitor users, observe the behavior, and monitor the development of attacks. Therefore, making potential threats clear can improve the protection shield and allow for new business opportunities [331].

The idea of resilience against a cyberattack, in addition to helping to know how to deal with a situation for which companies are not prepared, is to recognize the complexity of a scenario and have a contingency plan and defenses at different levels of security. In this way, it is possible to mitigate possible impacts resulting from cyberattacks [349].

In this sense, performing defensive security planning is essential, as the systems will cease to function over time, generating large potential losses for companies. Hong et al. [350] comment that investing in business cybersecurity is essential, given that criminals focus on operating systems with security gaps that have not been fixed or that have not yet been updated to a newer version. This vulnerability increases the risk and highlights the importance of investing in a consistent monitoring process [351].

In several countries, cyber defense constitutes a national security framework in which states establish policies at all levels (public and private), to guarantee individual freedoms, and to respond to aggressions and invasions by developing response and cooperation systems [352]. Taking these security policies as a reference, related to cyber resilience, emerging countries can adopt the definition of tasks and missions to establish security standards in the public and private environment, highlighting the specific criticality of the IT infrastructure [353].

Cluster 6: Cybersecurity and Society

One of the most recent discussions related to cybersecurity has involved the influence of social aspects applied to the advancement of IT solutions [354]. Given the increase in urbanization around the world, growing populations are overloading the social services provided by the government, which in turn aims to facilitate the processes that citizens trust and need. This aspect motivates the emergence of the concept related to the construction of functional cities, which allow residents to have happier and healthier lives in a smart environment. In so-called "cities of the future," communities and organizations make extensive use of information technology to ensure broad and efficient access to early childhood education programs, professional recycling, and other vital social and citizenship programs that can be digitally connected [355].

However, one of the central points of the discussion is that there is no human consensus on ethics, especially on the sharing of information and space. Ethics is interpreted as a concept applied to a given context and, therefore, extremely complex to be programmed [356]. For the authors, machines need to be programmed with the minimum ethics necessary to avoid consequences in the future, but when human ethics is assumed, it does not seem to be the best model for teaching machines [357]. This motivation stimulates the discussion about new ethics, something close to the consensus that would be used to program the artificial intelligence of the future.

This cluster involves the relationship between cybersecurity incidents and understanding of human behavior, in particular incidents registered in business environments. For the authors, the protection of confidential data in companies is fundamental for business development and allows risks to be minimized [356]. This protection is based on two factors: technical and human factors. In general, the functional element involves investing in IT solutions that ensure access control mechanisms, user identification, antivirus systems, and restricted access to components of the IT infrastructure. On the other hand, the human factor refers to the user’s perception of information security related to the knowledge of vulnerabilities and severity of risk regarding the lack of corruption of data and information, information shared on the internet, practices, and experiences with information security in the business environment.

The relationship between these factors raises a relevant discussion for the development of protection strategies that ensure control over the influence of human behavior in detriment to the investment of technical factors [332]. Cybersecurity strategies can be developed based on the perception of human behavior in an integrated manner with specialized solutions and IT governance, to monitor the movement of confidential data that can be transmitted outside the company. The destructive consequences of spills are clear, but the risks caused by the human factor are often overlooked and can cause a company to go bankrupt. A situation that can exemplify this loss is when a sales employee improperly uses customer data, being able to use private information regarding business transactions in an unworthy manner [356].

In this context, awareness must be an ongoing effort to educate employees about policies, threats to data and information security, and how to deal with them [358]. Protection Motivation Theory can be applied to understand and develop a culture that motivates employees to maintain safe practices in their daily lives and transform awareness training into something personal. In addition to these theories, educational games can help support the concepts of awareness and improve understanding of possible incidents and their impacts on the organization and its business [129].

4.2. Top authors with the highest number of publications and citations

Table 3 presents the 20 highly cited articles in information security and smart cities in the Scopus database.

These results show the importance and impact of smart city studies. Another important fact is that in recent years new challenges regarding application information security in smart cities have emerged due to new technologies. As an output of the analytical process, papers have addressed these new issues and consequently have a high potential for being more cited in the future. For instance, the automation of vehicles in the field of intelligent transport systems [369] and human beings as potential targets for cyberattacks or even participating in a cyberattack with ethical implications for society.

4.3. Most active and cited journals

Journals play an essential role in the development of a research area. Table 4 reports the most prominent journals in the number of publications on cybersecurity in the Scopus database and their impact factor in 2022.

It is worth mentioning that the top journals, showing that the topic of information security and smart city has attracted the attention of researchers from different fields. Because smart city is a multidisciplinary field, scholars often struggle to figure out the most appropriate outlet for their research that would have a significant impact. The information reported in this table indicates this willingness to publish in each specific area.

4.4. Country co-citation analysis

Figure 4 highlights the collaboration networks among countries. The countries with most co-authorships are the USA (n = 945), the UK (n = 150), China (n = 111), Australia (n = 75), Italy (n = 66), Germany (n = 38), Spain (n = 73), Canada (n = 54), South Korea (n = 48), India (n = 57), France (n = 26), Japan (n = 51), Netherlands (n = 30), Saudi Arabia (n = 15), Belgium (n = 16), Brazil (n = 23), and Portugal (n = 12).

As can be seen, the research collaborations appear with a higher level of intensity among countries of the European Union and those of North America. In addition, there is also a collaboration network among Asia, North America, and Europe. Research collaboration in cybersecurity indicates the complexity of the interrelations and the opportunity for future cooperation.

4.5. Keyword co-occurrence analysis

Figure 5 highlights the network visualization for the most common terms used in the authors’ keywords. The network reports the most relevant keywords of these items in terms of occurrences and their interactions between documents. A total of 267 keywords emerged with at least one occurrence [370,371]. From this network, 36 items are considered independent, in which case the item does not bring any significant contribution to designing applicable queries and identifying pertinent empirical surveys.

According to the network shown in Figure 5, the high-frequency keywords for research in the field of guidance between 2014 and 2022 were: smart city (1146 occurrences), internet of things (699 occurrences), network security (470 occurrences), security (374 occurrences) computer security (324 occurrences), cyber physical system (314 occurrences), data information (291 occurrences), blockchain (198 occurrences), energy efficiency (174 occurrences), energy security (166 occurrences), cryptography (156 occurrences), green computing (141 occurrences), information security (139 occurrences), smart grid (133 occurrences), sustainable cities (131 occurrences), urban development (127 occurrences), urban planning (123 occurrences), accident prevention (119 occurrences), attack detection (119 occurrences), authentication (117 occurrences), authentication protocols (117 occurrences), information exchanges (116 occurrences), intelligent transportation systems (116 occurrences), privacy preservation (115 occurrences), public key cryptography (110), network protocols (102), security vulnerabilities (102 occurrences), unmanned aerial vehicles (UAV) (88 occurrences), vehicular networks (81 occurrences), wireless sensor network (78 occurrences), 5g mobile communication systems (64 occurrences), anomaly detection (58 occurrences), city securities (46 occurrences), deep learning (39 occurrences) data mining (34 occurrences), image processing (32 occurrences), image segmentation (30 occurrences), machine-learning (30 occurrences), monitoring neural networks (27 occurrences), public safety (23 occurrences), real time systems (23 occurrences), surveillance cameras (22 occurrences), sensors (20 occurrences), virtual reality (20 occurrences), malware (19 occurrences).

4.6. Methods in Cybersecurity

Methods play an essential role in the development of a research area. We have included Table 5 with 11 main cybersecurity methods applied in main areas such as Computer Science, Engineering, Mathematics, Social Sciences, Business Management, and Accounting.

These results demonstrate that Management Risk and Machine Learning have a total of 129 and 101 articles published respectively. They allow the consideration of important factors that can lead to better decision-making in information security, and smart cities have become more widely used in actions focused on defense strategies.

5. Discussion

The discussion on information security and smart cities is not restricted to the area of computer science. The concern about data and information security is multidisciplinary and influences the evolution of different types of business. Health professionals, government institutions, and academic environments benefit from the opportunities for advancing research while they can take advantage of this study to indicate potential solutions and improve the level of information security, predicting the consequences of information loss. For this, when planning on cybersecurity, it is necessary to prioritize strategic actions that will be implemented, both for the organization, as well as for the government and society in smart cities.

Smart cities use information and communication technologies to improve the quality of life of their inhabitants, making public services more efficient and creating innovative solutions to urban challenges. However, as cities become more connected and dependent on technology systems, information security becomes an ever-increasing concern. Citizens’ data, as well as operational information on critical city systems, can be at risk from cyberattacks. Therefore, smart cities must have a comprehensive information security strategy to protect their systems and data. This involves implementing cybersecurity measures at all layers of the city’s infrastructure, from the communication network to IoT (Internet of Things) devices and data management systems.

To decrease the probability of a cyber threat causing damage, some cyber security measures should be implemented such as Encryption, Authentication of users, Network Security, Cyber security training, and Regular software updates. These shared vulnerabilities can be exploited by hackers and other malicious users to compromise city security, directly affecting citizens’ lives. For example, a cyber-attack on a traffic management system can lead to severe congestion and delays in emergency services. Some of the most common shared vulnerabilities in smart cities are weak passwords, Delayed software updates, and Insecure IoT devices. This work contributes to presenting new information security technologies to minimize shared vulnerabilities in smart cities, it is essential to adopt comprehensive cybersecurity measures.

A challenge for developing countries will be the integration of smart cities. The decision to plan information security for the management of cities is essential to guarantee engagement in municipal services through intelligent digital systems. So, the smart city ecosystem requires new skills and competencies in various ways through strategic partnerships and contracts with service providers. Maintaining a safe and smart city involves creating a public/private infrastructure to carry out activities and provide technologies that protect and protect citizens. Considering dimensions (I) intelligence and shared communications. Physical and cyber threats come from many areas, including state-sponsored critical infrastructure, criminals, natural disasters, and neglect. (2) Integrated operational management activities to prevent, mitigate, respond, and recover from incidents. (3) Acquiring a plethora of emerging technologies that facilitate physical and cyber security.

5.1. Theoretical and Practical Implications

The results contribute to developing a practical perspective in computer science, particularly providing a conceptual framework integrated with information security and smart city knowledge and leading research in the world. IT security professionals can take advantage of this study by using this structure as a reference to design new solutions in cybersecurity and formulate specific security policies to combat and prevent cyberattacks in smart cities. Moreover, this study shows the importance of developing information security strategies with a focus on user behavior in the city, characterized as the primary agent that causes security failures in IT solutions. In addition, IT researchers can obtain guidance to explore new fields of research, develop new trends and perspectives, develop applications to fill gaps in the literature and provide attention to different types of problems in information security and smart cities, which highlights the validity and relevance of this work.

Clustering bibliometric networks through co-citation analysis has practical contributions to the business area. By integrating knowledge between the disciplines of information and computing systems, managers and practitioners can quickly identify the most relevant concepts and best practices concerning information security and smart cities and perception of human behavior, smart power grid, online services, prevention systems for cyberattacks, the critical cyber infrastructures, threats, resilience, and social prospects of cybersecurity, designed by the clusters of co-citation analysis. As stated by [372] such a repository of terms associated with the scientific literature is a strategic tool for the continuous improvement of business, which can designate appropriate software features or necessary maintenance for the security of information systems, and support decision methods in the treatment and prevention of information security incidents. This systematic view can also highlight organizations’ responsibility of managers for smart city decisions related to control and data privacy, and potential correlations between data security and the organization’s value judgments on security devices.

Although developments and research related to the creation of control software, infrastructure improvement, risk prevention, and failure prevention, investment in IoT and Data solutions Science have increased in the last ten years as shown by the results of this research, cybersecurity is still treated as a secondary element in government organizations and institutions in developing countries. In this context, the acquisition of new IT solutions must be considered a strategy as important as the investment in cybersecurity, as it can directly affect the users’ perception of smart cities. Service providers must adhere to service-level agreements regarding system operation, data generation, and the use and sharing of information. Additionally, they should undergo privacy impact assessments to ensure compliance with privacy regulations and protect individuals’ personal information. By enforcing these requirements, organizations can ensure that service providers maintain a high standard of service delivery, respect privacy rights, and safeguard sensitive data.

This research presents an integrative theoretical framework conceptualized in the presentation of the state of the art on the scope of application and development of the term "information security and smart city." The theoretical framework presented can provide conceptual support to researchers and professionals in the field and can be used as a reference for understanding the connections between the lines of research, the composition of clusters of researchers, and the relationship between related areas, and can serve as a conceptual basis for the cybersecurity planning project in different businesses.

6. Conclusion

This study reported the construction of a systematic review, involving bibliometric aspects, oriented to the identification of the main applications of the information security and smarty city concept, such as cybersecurity and human perception behavior, cybersecurity and smart electrical network, cybersecurity control and data in services online and intrusion detection for cybersecurity. For data collection, relevant articles published in journals indexed in the Scopus database between 2015 and 2023 were selected. With the computational aid provided by the VOSviewer software, it was possible to map researchers and their academic contributions around the world and obtain significant outcomes to the growing index of publications that highlight cybersecurity as a concept discussed worldwide in several knowledge areas.

Through the bibliographic collection raised and the analytical results obtained by this study, auxiliary managers, professionals, and academics from different areas can explore opportunities in the literature. Thus, this work aims to highlight that the concept and concerns about information security and smarty city are not restricted to the areas of computational sciences, but it is possible to confirm that information security and smart city can promote actions for business, social development, improvement in services provision, among others. From this perspective, this study is one of the first to highlight this interdisciplinarity that exists in information security applications and smart cities.

The main results of this study expand knowledge and it presents a diagnosis directed at the cybersecurity and information security research. From this, it is possible to present the progress of the research and show the trends for future studies in the area. The results show that there is a great deal of research in cybersecurity based on computational sciences. However, it is observed that cybersecurity is the product of an interdisciplinarity that borders on engineering, administration, psychology, economics, and law, showing as research opportunities for theoretical and practical support to these complementary areas, emphasizing the importance theme for public and private institutions. In the future, cybersecurity research should not focus on a single perspective but rather promote interdisciplinarity and general development. For example, it is worth noting that it is necessary to include new management and control training for the development of cybersecurity and professional ethics applied to business strategy for virtual business models that require a high standard of confidence in the management of customer, employee, and business data. In this way, managers can understand new solutions against cybernetics and adopt studies to minimize business risks, considering them as premises of various sciences.

In addition, it is possible to state that: (i) the countries that most developed studies in the area of cybersecurity are the United States, United Kingdom, and China; (ii) cybersecurity studies are still poorly explored in developing countries, often due to their technological limitations (China is an exception); (iii) it is clear that researchers are increasingly engaged in international collaborations, due to the growing trend of studies over the years. In some cases, collaborations between researchers may arise from an opportunity to fund collaborative research, and in other cases, they are based on previous formal or informal collaborations; and (iv) there is an opportunity to start new research on cybersecurity solutions management process in virtual service systems, such as solutions for non-face-to-face medical care and telehealth services.

Telehealth services, as an intrinsic part of Smart Cities related services, require paying attention to technical computational aspects and to the management of patient’s data and their health status, which are generally stored in distributed databases and shared via the Internet for medical centers. The data-sharing flow can highlight aspects of systems cybersecurity vulnerability that, in general, are related to communication and content-sharing protocols in the data transfer process, data integrity, authentication process, and data access, others among. Despite the different existing techniques to protect telehealth services, cyberattacks can cause enormous damage to business problems and can cause irreparable damage to patients’ health. These cybersecurity concerns grow as new business models are set up in the digital era. From this perspective, the development of strategic management actions is essential for the training of employees, control over operational processes, and support for the decision-making process, which highlights the interdisciplinary nature of the cybersecurity concept.

6.1. Limitations and Future Works

Although the work has a full scope in information security and smart cities, some limitations can be mentioned. First, some of the research on frontier applications may have been lost during the detailing steps. Search strings are not perfect; they need constant updates with a large amount of information and publications that are added daily to the scientific literature. Second, this study did not consider cybersecurity software in this review. This could be an exciting gap for future research. To carry out such an in-depth assessment of cybersecurity software options, there are several possibilities. For example, one can contact all software distributors and develop an exhaustive classification scheme. Alternatively, one can focus on commercial manufacturers and identify their collaboration to define some minimum resource scheme, or one can only analyze open-source or free programs.

In developing nations, there’s a growing call for collective initiatives and educational campaigns centered on information security. A deeper public understanding in this domain can catalyze a stronger trust in the technologies underpinning smart cities, bolstering their adoption and seamless integration into citizens’ daily lives. Information security is undeniably a foundational pillar for the successful assimilation of these technologies. Consequently, it becomes imperative to address not only the technical facets but also the subjective and objective dimensions highlighted in this study, which clearly impact the global landscape.