Introduction:
Cyberspace, a global domain of interconnected IT infrastructure, has witnessed a surge in cyber intrusions and attacks in recent years, impacting personal data, critical operations, and the economy.
India’s substantial internet user base, ranking 3rd globally, exposes it to heightened cyber threats.
The Cyber & Information Security (CIS) division of MHA is responsible for various aspects of cybersecurity, cybercrime, and national information security policy.
Types of Cyber Threats:
Malware and Attacks:
Malicious software disrupts computers; viruses and worms compromise systems.
Example: The WannaCry ransomware attack targeted worldwide computer systems in 2017, crippling operations.
Theft of Intellectual Property or Data:
Cybercriminals target sensitive information for financial gain.
Example: The Equifax breach in 2017 exposed personal data of millions.
Hacktivism:
Socially or politically motivated cyber protests.
Example: Anonymous targeted various institutions for their activism.
Mobile Devices and Applications:
Vulnerabilities in mobile platforms exploited for unauthorized access.
Example: The Pegasus spyware incident revealed potential state-sponsored surveillance.
Social Engineering and Spear Phishing:
Users deceived into clicking malicious links or sharing confidential information.
Example: The 2016 DNC email hack involved spear-phishing to access sensitive data.
Domain Name System (DNS) Attacks and Router Security:
Manipulation of DNS for redirecting users or network hijacking through router vulnerabilities.
Example: The 2016 Dyn attack disrupted major websites using DNS manipulation.
Denial of Service (DoS):
Overwhelm target websites or networks to block access.
Example: The 2016 Mirai botnet launched massive DoS attacks.
Steps to Strengthen Cyber Security in India:
- Network Security: Safeguard networks against external and internal threats.
- Malware Protection: Establish anti-malware defenses across business areas.
- Incident Management: Develop incident response plans, test them, and provide specialized training.
- Monitoring: Continuously monitor ICT systems and networks, backed by clear policies.
- User Education and Awareness: Educate users on secure system usage through policies and training.
- Home and Mobile Working: Develop and enforce mobile working policies with secure baselines.
- Secure Configuration: Apply security patches and maintain secure configurations of systems.
- Removable Media Controls: Establish policies for controlling access to removable media.
- Managing User Privileges: Limit privileged accounts and establish account management processes.
- Information Risk Management Regime: Create effective governance and risk management structures.
Conclusion:
The government should prioritize raising awareness about cybersecurity among citizens and small businesses.
Capacity building, professional training, extending programs like ISEA, integrating cybersecurity curricula in academia, and organizing conferences can further enhance cyber defenses.
Recent incidents like the AIIMS Hospital cyber attack underscore the urgent need for robust cybersecurity measures.