National Cyber Security Strategy

National Cyber Security Strategy

News: Recently, Chinese state-sponsored hackers targeted Indian electricity distribution centres near Ladakh. Amid a surge in cyberattacks on India’s networks, the Centre is yet to implement the National Cyber Security Strategy which has been in the works since 2020.

Cyber-attacks in India:
• As per American cybersecurity firm Palo Alto Networks’ 2021 report, Maharashtra was the most targeted State in India — facing 42% of all ransomware attacks.
• India is among the more economically profitable regions for hacker groups and hence these hackers ask Indian firms to pay a ransom, usually using cryptocurrencies, in order to regain access to the data.
• One in four Indian organisations suffered a ransomware attack in 2021.
• Indian organisations witnessed a 218% increase in ransomware — higher than the global average of 21%.
• Software and services (26%), capital goods (14%) and the public sector (9%) were among the most targeted sectors.

National Cyber Security Strategy:
Conceptualised by the Data Security Council of India (DSCI), the report focuses on 21 areas to ensure a safe, secure, trusted, resilient, and vibrant cyberspace for India.
• There needs to be a focus on security in the early stages of design in all digitisation initiatives and for developing institutional capability for assessment, evaluation, certification, and rating of core devices.
• Monitoring and mapping of the supply chain of the Integrated Circuits (ICT) and electronics products. Leveraging the country’s semiconductor design capabilities globally at strategic, tactical and technical levels.
• Mapping and modelling of devices and platforms deployed, supply chain, transacting entities, payment flows, interfaces and data exchange.
• State-level cybersecurity policies and guidelines for security architecture, operations, and governance need to be developed.

Recommendations made by the report:
• A minimum allocation of 0.25% of the annual budget, which can be raised upto 1% has been recommended to be set aside for cyber security.
• The report suggests investing in modernisation and digitisation of ICT, setting up a short and long term agenda for cyber security via outcome-based programs and providing investments in deep-tech cyber security innovation.
• The DSCI also recommends creating a ‘cyber security services’ with cadres chosen from the Indian engineering services.
• Cyber insurance being a yet to be researched field, must have an actuarial science to address cybersecurity risks in business and technology scenarios as well as calculate threat exposures.
• Cyber diplomacy plays a huge role in shaping India’s global relations. To further better diplomacy, the government should promote brand India as a responsible player in cyber security and also create ‘cyber envoys’ for the key countries/regions.
• It also suggests charting a five-year roadmap factoring possible technology transformation, setting up exclusive courts to deal with cybercrimes and remove backlog of cybercrimes by increasing centres providing opinion related to digital evidence under section 79A of the IT act.
• The DSCI suggests advanced forensic training for agencies to keep up in the age of AI/ML, blockchain, IoT, cloud, automation.

Government’s Initiatives:
• Cyber Surakshit Bharat Initiative
• Cyber Swacchta Kendra
• Indian Cyber Crime Coordination Centre (I4C)
• Information Technology Act, 2000
• National Critical Information Infrastructure Protection Centre (NCIIPC)