The status of India’s national cyber security strategy

Published
25th Apr, 2022

Context

The National Security Council secretariat organises National Cyber security incident response exercise NCX, for Government officials and Critical sector Organisations.

It will be a hybrid exercise of 10-days aim to strengthen India’s cyber position.

Background

Cybercrime is vastly growing in the world of technology today. Criminals of the World Wide Web exploit internet users’ personal information for their own gain.
They dive deep into the dark web to buy and sell illegal products and services. They even gain access to classified government information.
Cybercrimes are at all-time high, costing companies and individuals billions of dollars annually. What’s even more frightening is that this figure only represents the last 5 years with no end in sight.
The evolution of technology and increasing accessibility of smart tech means there are multiple access points within users’ homes for hackers to exploit.
While law enforcement attempts to tackle the growing issue, criminal numbers continue to grow, taking advantage of the anonymity of the internet.
As the world gets absorbed by the COVID-19 pandemic, cyberattacks have become a critical area for all technology-focused organizations in India.

Recent incidents of cyberattack

In 2016, banks had reportedly announced a leak of personal information of 3.2 million debit cards.
In 2018, Pune-based Cosmos Bank lost Rs 94 crore in a malware attack.
In 2019, the Kudankulam plant was attacked using malware.
And, CERT-IN has recently issued an advisory that there is a threat of a massive phishing attack.
In 2018, when Wannacry disrupted the National Health Service systems in the UK, the country’s health system was brought to a standstill.
For three months in 2019, India faced the most cyber-attacks in the world.
While the US was the most cyber-targeted nation in 2019, India held the top spot in April, May and June.
The most cyber-attacked countries in 2019 were the US, India, UK, Singapore, Ukraine, UAE, Nigeria, Japan, South Korea and Spain respectively.
Pegasus is spyware developed by the Israeli cyber-arms company NSO Group that can be covertly installed on mobile phones running most versions of iOS and Android. Pegasus is able to exploit iOS versions up to 14.6, through a zero-click exploit.

What is NCX India?

Aim: It aims to train senior management and technical personnel of the Government/Critical Sector organizations and agencies on contemporary cyber threats and handling cyber incidents and response.
Areas to cover: The participants will be trained on various key cyber security areas such as Intrusion Detection Techniques, Malware Information Sharing platforms (MISP), Vulnerability Handling & Penetration Testing, Network Protocols & Data Flows among others.
Significance: The exercise will help strategic leaders to better understand cyber threats, assess readiness and develop skills for cyber crisis management and cooperation.
The National Security Council Secretariat (NSCS) in association with Data Security Council of India (DSCI) as the knowledge partner with support of Defence Research and Development Organization (DRDO) will organize the NCX.

National Security Council (NSC)

NSC is an executive government agency tasked with advising the Prime Minister’s Office on matters of national security and strategic interest.
It was established by the former Prime Minister of India Atal Bihari Vajpayee in 1998.
Structure:
o NSC is a three-tier structure body.
o The three tiers are the Strategic Policy Group, the National Security Advisory Board and a secretariat from the Joint Intelligence Committee.

What’s upping India’s cybersecurity threat?

Increasing digitalisation: India is one of the fastest-growing markets for digital technologies fuelling government’s push towards actualising its Digital India mission.
- Whether creating broadband highways or rolling out services such as DigiLocker and e-governance schemes like the Jan Dhan Yojana, the government has pushed for as much digital adoption as possible over the past few years.
Pool of digitally vulnerable targets: India now has over 1.15 billion phones and more than 700 million internet users and makes it a large pool of digitally vulnerable targets.
Heavier dependence on digital technology: The pandemic has only exacerbated this problem as it resulted in an even heavier dependence on digital technologies. From payments to e-shopping to WFH, the pandemic led to greater adoption of interconnected devices and hybrid work networks.

What does India need?

Comprehensive standards: With countries resorting to digital warfare and hackers targeting government processes, India needs comprehensive cybersecurity guidelines and standards for checking cyber vulnerabilities and cyber responses.
Cyber defence network: In many cases, as it happens, the government itself uses legacy systems which are vulnerable to cyberattacks; countries like China and Singapore, in the meanwhile, have progressed towards creating cyber defence networks.
Strengthened policy framework: National cybersecurity projects such as the National Cyber Coordination Centre (NCCC), National Critical Information Infrastructure Protection Centre (NCIIPC) and the Computer Emergency Response Team (CERT) need to be strengthened, manifold and reviewed.

Types of Cybercrime

Cyber threats are of varied nature and some of the key notable ones would be
Malware, Viruses, Trojans, spywares
Backdoors, which allow remote access
DNS (Domain Named System) poisoning attacks, which compromises the DNS and redirect websites to malicious sites
DDoS Attacks: These are used to make an online service unavailable and take the network down by overwhelming the site with traffic from a variety of sources. Large networks of infected devices known as Botnets are created by depositing malware on users’ computers. The hacker then hacks into the system once the network is down.
Botnets: Botnets are networks from compromised computers that are controlled externally by remote hackers. The remote hackers then send spam or attack other computers through these botnets. Botnets can also be used to act as malware and perform malicious tasks.
Identity Theft: This cybercrime occurs when a criminal gains access to a user’s personal information to steal funds, access confidential information, or participate in tax or health insurance fraud. They can also open a phone/internet account in your name, use your name to plan a criminal activity and claim government benefits in your name.
Cyberstalking: This kind of cybercrime involves online harassment where the user is subjected to a plethora of online messages and emails. Typically cyberstalkers use social media, websites and search engines to intimidate a user and instill fear. Usually, the cyberstalker knows their victim and makes the person feel afraid or concerned for their safety.
PUPs: PUPS or Potentially Unwanted Programs are less threatening than other cybercrimes, but are a type of malware. They uninstall necessary software in your system including search engines and pre-downloaded apps.
Phishing: This type of attack involves hackers sending malicious email attachments or URLs to users to gain access to their accounts or computer.

Indian laws concerning Cyber Security

Information Technology Act, 2000: The act provides legal recognition to e-commerce and e-governance and facilitates its development as an alternative to paper-based traditional methods. It aims to protect the advancement in technology by defining crimes, prescribing punishments, laying down procedures for investigation and forming regulatory authorities.
Crime and Criminal Tracking Network System (CCTNS): It is a nationwide network infrastructure for evolution of IT-enabled state-of-the-art tracking system around “investigation of crime and detection of criminals”.
National Cyber Security Policy, 2013: It provides for:
To build a secure and resilient cyberspace.
Creating a secure cyber ecosystem, generate trust in IT transactions.
Creation of a 24 x 7 National Critical Information Infrastructure Protection Center (NCIIPC).
Indigenous technological solutions.
Testing of ICT products and certifying them.
National Technical Research Organization (NTRO): NTRO is a highly specialized technical intelligence gathering agency. It develops technology capabilities in aviation and remote sensing, data gathering and processing, cyber security, cryptology systems, strategic hardware and software development, and strategic monitoring.
National Critical Information Infrastructure Protection Centre (NCIIPC): Creation of National Critical Information Infrastructure Protection Centre, the national nodal agency in respect of protection of critical information infrastructure. It is placed under the National Technical Research Organization.
CERT-In: CERT-In has been designated to serve as the national agency to perform the following functions:
Collection, analysis, and dissemination of information on cyber incidents.
Forecast and alerts of cybersecurity incidents
Emergency measures for handling cybersecurity incidents
Coordination of cyber incident response activities
Issue guidelines, advisories, vulnerability notes and white papers relating to information security practices, procedures, prevention, response and reporting of cyber incidents
National Cyber Coordination Centre (NCCC): It is a critical component of India’s cyber security against hackers and espionage as well as to track terrorist activity online.

Cyber Surakshit Bharat: Cyber Surakshit Bharat is an initiative from the Ministry of Electronics and Information Technology (MeitY) that pointed at creating a robust cybersecurity ecosystem in India.
India-ITU Joint Cyberdrill event: Last December, the Department of Telecommunications (DoT) and the International Telecommunication Union (ITU) launched the India-ITU Joint Cyberdrill event that aimed at training Indian critical network infrastructure operators. Industry experts discussed cybersecurity policy initiatives in India and across the globe.

Way forward

India cannot afford to be complicit about cybersecurity. An attack explicitly directed towards these services can cause much more damage. India should not wait for an attack to upgrade its infrastructure. In India, the private sector has started playing a significant role in operating critical information infrastructure, particularly in power, transportation and healthcare.