Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!
SHARE:
Cyberattacks and critical infrastructure protection
Read more on - Polity | Economy | Schemes | S&T | Environment
- The story: It emerged in May 2021 that a major cyber attack had crippled one of the largest pipelines in the United States (US), Colonial Pipeline, which carries about 45% of all fuel consumed on the country’s East Coast. The attack disrupted fuel supplies and caused a surge in gas prices in some parts of the country. This was a case of ransomware attack, where hackers usually threaten to block the system or publish the targeted company or victim’s confidential data, unless a ransom is paid. This attack drew the attention of President Joe Biden, who made serious observations on it.
- A trend: The attack on Colonial Pipeline fits the broader trend witnessed in recent years of cyberattacks on critical infrastructure which require to be operational at all times such as traffic systems, banks, power grids, oil pipelines and nuclear reactors. Given the increasing number of cyber attacks on critical infrastructure, it is essential for countries like India to develop a robust cyber security architecture.
- Defining 'Critical Infrastructure': It is the body of systems, networks and assets that are so essential that their continued operation is required to ensure the security of a given nation, its economy, and the public’s health and/or safety.
- Need for security framework - In recent years, attacks targeting critical infrastructure and businesses have surged. These include the 2017 WannaCry and NotPetya ransomware attacks, the 2015 attack on Ukrainian power grids and 2010 Stuxnet attack on Iranian nuclear reactor. In 2020, a China-linked hacker group RedEcho targeted India’s power sector, ports and parts of the railway infrastructure.
- Cyber wars - States are deploying cybersecurity attacks in order to have geo-political gains. To escape responsibility for such debilitating attacks, many States use hacking syndicates as proxies. This has made critical infrastructure protection a cybersecurity priority for India.
- Challenges: Firs is the reluctance in sharing information. There is a general inhibition in the private (and public) sector to share information about the vulnerability of their systems. By revealing their vulnerabilities and, therefore, their proprietary information, businesses fear exposing themselves and losing a competitive edge over rivals. So Indian regulators have warned that only reactive measures to cyberattacks overlooks the possibility of concerted cyber warfare by adversarial States against India.
- Capability asymmetry - India lacks indigenization in hardware as well as software cybersecurity tools. This makes India’s cyberspace vulnerable to cyberattacks motivated by state and non-state actors.
- Absence of a strategy - The absence of a credible cyber deterrence strategy means that states and non-state actors alike remain incentivized to undertake low-scale cyber operations for a variety of purposes — espionage, cybercrime, and even the disruption of critical information infrastructure.
- Opportunities: There is a need to clearly articulate a doctrine that holistically captures its approach to cyber conflict, either for conducting offensive cyber operations or the extent and scope of countermeasures against cyber attacks. India should see the National Cyber Security Strategy as a key opportunity to articulate how international law applies to cyberspace.
- Specifying redlines - The National Cyber Security Strategy should include positioning on not just non-binding norms but also legal obligations on ‘red lines’ with respect to cyberspace-targets, such as health-care systems, electricity grids, water supply, and financial systems.
- Promoting Swadeshi - There is a need to create opportunities for developing software to safeguard cybersecurity and digital communications. The Government of India may consider including cybersecurity architecture in its Make In India program. There is also the need to create suitable hardware on a unique Indian pattern that can serve localized needs.
- Public-Private Partnership - Given the mutual distrust and vulnerability of the public and private sector, any solution involves sharing responsibility through a public-private partnership for critical infrastructure protection.
- Summary: Given the future of technology under Industrial Revolution 4.0, only an integrated, whole-of-the-ecosystem approach for securing critical infrastructure will be successful for India. Cyber-threats are real, and wishing them away won't work. Digital India is an empowering tool, but it also exposes entire systems to attackers.
* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your
own subscriptions. Copyrights acknowledged.
COMMENTS