Cybersecurity Risks in Smart Street Lighting Systems

Smart street lighting is usually introduced as a way to reduce electricity use and maintenance costs. A lamp can dim when a street is empty, brighten when movement is detected, and report faults through an online dashboard. However, once a streetlight is connected to WiFi, a cloud database, and a remote-control interface, it becomes more than an electrical device. It becomes a cyber-physical system installed in a public environment. This paper analyzes cybersecurity risks in a low-cost smart street lighting architecture based on an ESP32-class controller, motion and ambient-light sensors, Firebase-style cloud storage, and a web dashboard. The study uses a threatmodeling approach to identify risks across the device, sensor, network, cloud, application, and operations layers. The main risks include hardcoded credentials, weak provisioning, insecure cloud rules, sensor spoofing, firmware tampering, unauthorized remote control, botnet abuse, and dependency on connected smart city infrastructure. The paper proposes practical controls such as unique device identity, TLS, secure boot, signed firmware updates, deny-by-default cloud rules, role-based access control, audit logging, network segmentation, and fail-safe local behavior. The main conclusion is that smart street lighting should be designed not only for energy efficiency, but also for security, resilience, and public safety.