Cyber Security in India

Building a proactive cyber security and detection capability is difficult for countries. As cyber-attacks become more complex, states need cybersecurity that not only protects today but provides proactive defense against new and future risks to confidently respond to new challenges. Read here to know more about India’s cyber security capabilities.

The internet has merged seamlessly into our daily lives. It has changed how we interact with others, make new acquaintances, share information, engage in entertainment, and shop.

The majority of our daily activities are being impacted by them. We virtually communicate with billions of online users around the world through cyberspace.

Cybercrimes including cyberstalking, cyberbullying, cyberharassment, child pornography, rape content, etc., targeting women and children, in particular, are fast rising along with the usage of cyberspace.

Education is one of the major sectors for dissemination of information on the prevention of cyber-crimes and reaffirmed that students can act, as a force multiplier to establish an ecosystem for cyber security and to prevent cyber crimes.

Also read: Atomic Clocks: One-Nation One-Time

What is Cyber Warfare?

A cyberattack or series of attacks that target a nation is typically referred to as cyberwarfare. It can destroy civilian and governmental infrastructure and interfere with vital processes, causing harm to the state and possibly even fatalities.

The majority of the time, nation-states engage in cyber warfare by attacking other nations, but occasionally, terrorist groups or non-state actors carry out the assaults to further the objectives of an adversary state.

There have been many reported instances of cyber warfare in recent years, but there is no established definition of what constitutes an act of war in the context of a cyber strike.

There are 7 main types of cyber warfare attacks:

1. Espionage: Refers to monitoring other countries to steal secrets. In cyber warfare, this can involve using botnets or spear phishing attacks to compromise sensitive computer systems before exfiltrating sensitive information.
2. Sabotage: Government organizations must determine sensitive information and the risks if it is compromised. Hostile governments or terrorists may steal information, destroy it, or leverage insider threats such as dissatisfied or careless employees, or government employees with affiliation to the attacking country.
3. Denial-of-service (DoS) Attacks: DoS attacks prevent legitimate users from accessing a website by flooding it with fake requests and forcing the website to handle these requests. This type of attack can be used to disrupt critical operations and systems and block access to sensitive websites by civilians, military and security personnel, or research bodies.
4. Electrical Power Grid: Attacking the power grid allows attackers to disable critical systems, disrupt infrastructure, and potentially result in bodily harm. Attacks on the power grid can also disrupt communications and render services such as text messages and communications unusable.
5. Propaganda Attacks: Attempts to control the minds and thoughts of people living in or fighting for a target country. Propaganda can be used to expose embarrassing truths, spread lies to make people lose trust in their country, or side with their enemies.
6. Economic Disruption: Most modern economic systems operate using computers. Attackers can target computer networks of economic establishments such as stock markets, payment systems, and banks to steal money or block people from accessing the funds they need.
7. Surprise Attacks: These are the cyber equivalent of attacks like Pearl Harbor and 9/11. The point is to carry out a massive attack that the enemy isn’t expecting, enabling the attacker to weaken their defenses. This can be done to prepare the ground for a physical attack in the context of hybrid warfare.

Cyber-attacks in India

• Recently, the servers of Delhi AIIMS were compromised due to a ransomware cyber-attack. The personal data of millions of patients in the top premier medical institute is at risk after a ransomware attack on its servers.
• In February 2022, Air India experienced a major cyberattack that compromised approximately 4.5 million customer records. Passport, ticket, and some credit card information were compromised.
• In 2020, approximately 82% of Indian companies suffered ransomware attacks.
• In 2021, A high-profile India-based payment company, Juspay, suffered a data breach impacting 35 million customers. This breach is very noteworthy because Juspay handles payments for online marketplaces, including Amazon and other big players.
• In May 2017, the top five cities in India (Kolkata, Delhi, Bhubaneswar, Pune, and Mumbai) got impacted due to the WannaCry ransomware attack.

India’s cyber security

A simultaneous surge in cyber risks has grown more worrisome as India’s internet base expands, with over 900 internet users anticipated by 2025. With the development of digital technology, cybercrimes are becoming more sophisticated as well.

India must therefore carefully assess the vulnerabilities in its cyberspace and address them holistically through a more thorough Cyber-Security Policy.

A cyber and information security division operates under the aegis of the Ministry of home affairs which deals with matters relating to Cyber Security, Cyber Crime, National Information Security Policy & Guidelines (NISPG), and implementation of NISPG, NATGRID, etc.

It has the following wings:

• Coordination wing
• Cyber-crime wing
• Information security
• Monitoring unit
• Cyber-crime coordination center

Challenges to India’s cyber security

1. Devices used for internet access are not all the same:

• Not everyone in India can buy pricey phones due to the wide range of economic levels.
• Apple holds a market share of nearly 44% in the US. Less than 1% of mobile users in India, despite the greater security standards, use iPhones.
• It is becoming increasingly difficult for regulators to define legal and technical requirements for data protection due to the growing security gap between high-end mobile devices like the iPhone and less expensive ones.

2. Lack of a national-level architecture for cybersecurity:

• The military has its firefighting organizations, while critical infrastructure is owned by the commercial sector.
• To analyze the nature of any danger and effectively counter it, all of these agencies must work together as part of a national security architecture, which does not yet exist.
• The Prime Minister’s Office has established a position in support of this cause, although India still lacks the required infrastructure.

3. Lack of separation:

• Unlike countries or governments, cyberspace has no borders, making it possible for cyberattacks to come from anywhere on the armed forces, digital assets of ONGC, banking operations, etc.
• This might lead to national security lapses that cost money, property, or even lives.
• There is a need for a technically advanced multi-agency organization that can base its judgments on policy inputs and a strong strategy to respond to potential threats to the nation’s most valuable resources.

4. Lack of awareness:

• Since there is no national regulatory policy in place for cybersecurity, both businesses and individuals lack awareness.
• Only in the presence of a regulated and overseen legislative framework can domestic internet users defend themselves and receive protection from cyberattacks.

Government Initiatives Related to Cyber Security

• Indian Cyber Crime Coordination Centre (I4C)
• Indian Computer Emergency Response Team (CERT-In)
• Cyber Surakshit Bharat
• Cyber Swachhta Kendra
• National Cyber Security Coordination Centre (NCCC)
• National Cyber security policy 2013

Way forward

The government must harness and refocus efforts on the strategic use of India’s highly qualified IT workforce.

If the government offered incentives to the sector, the private sector would be more likely to invest in a national cybersecurity agency. Future Indian firms will be more competitive on a global scale and build a safer digital India with enhanced cybersecurity defenses.

All public and commercial organizations that deal with personal data should be forced to follow strict data protection guidelines.

The young population can work as a force multiplier to be conscious of their participation in cyberspace, establish an ecosystem for cyber security, and prevent cybercrimes, which is why education is one of the crucial sectors for disseminating knowledge on the prevention of cybercrimes.

-Article written by Swathi Satish