Patching the gaps in India's cybersecurity

Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!

Patching the gaps in India's cybersecurity

---

Read more on - Polity | Economy | Schemes | S&T | Environment

---

• Sensational disclosure: Feb 28, 2021 brought a shocking report in the New York Times, of a major cyberattack on India by China. The possibility contemplated was that the blackout in Mumbai on October 13, 2020, may have been induced by a Chinese cyberattack!
• Political speak: Maharashtra govt. confirmed that its cyber experts agree that grid failure was due to cyber sabotage. The Union govt. denied any such attack, claiming human errors were responsible. No data in public is available.
• Prior attacks: This isn't the first time India was targeted. The 2009 GhostNet cyber espionage attack targeted many, including the Tibetan government in exile, and embassies. An entity called "Shadow Network" was found, and its vast footprints were discovered. Then minister Sachin Pilot claimed investigations were underway. 
• Later attacks: Then came attacks called Stuxnet (also on Iran), and Suckfly (attacked private firms and NSE), and Dtrack which attacked banks and Kudankulam nuclear power plant in 2019. Not one report was ever tabled in the Parliament. All governments have responded superficially, and evaded questions. The benefit of publicly discussing the truth is that a robust response can be created.
• Who attacked really: Suspicions are China did it, but China also has helped the security community in dismantling the infrastructure used in some of these attacks. Also, WikiLeaks has shown that the US CIA has the UMBRAGE project that can carry out 'false flag attacks' that takes the blame to others! 
• Twenty years of effort: India has worked hard for 20 years to build a structure to tackle these problems.

1. In the PMO, there are multiple cyber structures, starting with the NSC (National Security Council), chaired by the NSA. It shapes the cyber policy system.
2. NSA chairs the National Information Board, for cross-ministry coordination
3. The NCIIPC was created in Jan 2014 to protect critical information infrastructure [NCIIPC - National Critical Information Infrastructure Protection Centre]
4. In 2015, the National Cyber Security Coordinator office was set up, to advise the PM
5. CERT-In is the nodal agency, under the MEITY, and tackles threats to non-critical infrastructure [CERT-In - Computer Emergency Response Team]
6. The Defence Ministry has formed the Defence Cyber Agency, a tri-service command of armed forces for joint cyber operations
7. Ministry of Home Affairs has many coordination centres to ensure law enforcement in cyber domain

• 'All of government' approach: So this framework is designed to counter and mitigate threats at a national level. But there are many overlaps, and lack of clear boundaries and accountability. That needs clarification in the new NCSS of the NSC, an upgrade to the 2013 NSC Policy.  [NCSS - National Cyber Security Strategy] Its goal ought to be coherence across the spectrum.
• The Doctrine: India hasn't stated its cyber conflict doctrine yet. Will it attack, or remain defensive always? In the nuclear domain, India has clarified that it'll always follow the "no first use" policy. That helped prevent a catastrophe in South Asian region. It created some deterrence. But the absence of any articulation on cyber strategy means there are no clearly drawn red lines, and all kinds of actors feel encouraged to undertake adventures against India.
• Red Lines: India must declare its zero tolerance policy for any cyberattack on areas like health-care systems, electricity grids, water supply and financial systems. 
• Bring clarity: Overall, if India declares its cybersecurity posture clearly, it will help build confidence in citizen minds, and reassure allies. The adversaries get a clear message as well, be they state actors, or their proxies, or criminals.

Read more on - Polity | Economy | Schemes | S&T | Environment

Join UPSC Self Prep course | Online Course (PT Gurukul)  | Covid Special Course | Join PT courses

* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your own subscriptions. Copyrights acknowledged.