Cybersecurity

The first principle

Anything connected to a network can be reached by anyone on that network, and the attacker needs to find only one weakness while the defender must close all of them. Attacks are cheap and hard to trace, so punishment deters less than in the physical world. Cybersecurity therefore rests on resilience: keep systems hard to break, notice an intrusion quickly and recover fast.

The core

What is being protected

• The CIA triad. Security means protecting confidentiality (only the right people can read data), integrity (no one can change it undetected) and availability (it is there when needed), the CIA triad. A data leak breaks confidentiality, a tampered bank record breaks integrity, and a ransomware attack that locks a hospital's files breaks availability.
• Critical information infrastructure (CII). Section 70 of the Information Technology (IT) Act defines it as a computer resource whose incapacity or destruction would have a debilitating impact on national security, the economy, public health or safety. Power grids, banking, telecom and transport are examples.
• Three levels of threat. Cyber crime is an offence against individuals and firms, such as fraud or identity theft; cyber terrorism, punishable with up to life imprisonment under Section 66F, is an attack meant to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people; and cyber warfare is the use of cyber means by one state against another, now called the fifth domain of war.

How attacks work

• Malware is malicious software. A virus attaches to a file and spreads when it is opened, a worm copies itself across a network without user action, and a trojan hides inside a harmless looking program.
• Ransomware encrypts the victim's files. It typically locks them with a fast symmetric key and then locks that key with the attacker's public key, so only the attacker's private key can release them; guessing that key is impractical, so backups are the real defence.
• Phishing and social engineering trick a person into giving away a password or approving a payment, as in the digital arrest scam, where callers pose as police on video.
• Distributed denial of service (DDoS) floods a server with more requests than it can answer, using a botnet of hijacked computers and Internet of Things devices such as cameras.
• Advanced persistent threats (APTs) are long, quiet intrusions, usually by state linked groups, that steal data over months; they often use a zero day, a flaw unknown to the software maker, so no patch exists yet.
• Supply chain attacks compromise a trusted supplier's software or hardware so that the victim installs the attack itself; hence the origin of telecom equipment and chips matters (see the computing note).

Dimensions

• Security. State linked groups seek to steal defence and diplomatic secrets and to place hidden access inside power and telecom networks that could be used in a crisis, which makes cyberspace a front in hybrid war.
• Economic. Payments, stock markets, ports and tax systems run online, so an attack on one platform can freeze commerce, while frauds take savings from households.
• Military. The armed forces depend on networks for command, navigation and surveillance; the Defence Cyber Agency, a tri service body set up in 2019, handles defence and response.
• Legal. Cyber crime crosses borders in seconds, while requests for evidence under mutual legal assistance treaties take months.
• Technological. India imports most of its chips, network equipment and operating systems, whose hidden flaws it cannot fully inspect; the National Security Directive on the Telecom Sector (2020) therefore lets operators buy only from trusted sources.
• Privacy. Puttaswamy (2017) made privacy a fundamental right, so security measures collecting data must be lawful, necessary and proportionate.

In practice

Data

• Incidents are rising. The Indian Computer Emergency Response Team (CERT-In) handled about 11.6 lakh cyber security incidents in 2020 and about 20.4 lakh in 2024, according to a Rajya Sabha reply of February 2025.
• Crime follows. The National Crime Records Bureau (NCRB) recorded 86,420 cases of cyber crime in 2023, a rise of about 31 per cent over 65,893 in 2022, with fraud the main motive.
• Quick reporting saves money. The Citizen Financial Cyber Fraud Reporting and Management System, started in 2021 and reached through the helpline 1930, had saved more than Rs 7,000 crore from over 23 lakh complaints by December 2025 by freezing money before it left the banking system.

Cases and their lessons

• Estonia, 2007. Weeks of DDoS attacks took down government, bank and media websites during a dispute with Russia over moving a Soviet war memorial. A digitised state could be hit without a shot.
• Stuxnet, 2010. A worm damaged centrifuges at Iran's enrichment plant at Natanz by changing their speed while showing operators normal readings. Code could destroy physical equipment, even on a network cut off from the internet.
• WannaCry, May 2017. Ransomware spread worldwide through a flaw in older Windows systems for which a patch already existed, hitting hospitals in the United Kingdom among others.
• Cosmos Bank, Pune, August 2018. Attackers broke into the bank's payment switch and took about Rs 94 crore within hours through cloned cards abroad and a transfer over the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network. Cooperative banks need the security of large banks.
• Kudankulam, 2019. The Nuclear Power Corporation of India Limited confirmed malware on an administrative network of the plant and stated that the separate control systems were unaffected. Separation worked, but strategic sites are clearly targets.
• All India Institute of Medical Sciences (AIIMS), New Delhi, November 2022. A ransomware attack forced the hospital to run registration and records manually for about two weeks, showing that hospitals need offline backups and separated networks.

Institutions

• Coordination. The National Cyber Security Coordinator, first appointed in 2015 in the National Security Council Secretariat (NSCS), coordinates across ministries, and a 2024 amendment to the government's business rules gave the NSCS overall coordination and strategic direction for cybersecurity.
• CERT-In, set up in 2004 under the Ministry of Electronics and Information Technology (MeitY) and given statutory powers by Section 70B in the 2008 amendment, is the national agency for incident response. It runs the Cyber Swachhta Kendra for cleaning botnet infections and the Cyber Surakshit Bharat programme for training government security officers.
• The National Critical Information Infrastructure Protection Centre (NCIIPC), notified in January 2014 under Section 70A and placed under the National Technical Research Organisation (NTRO), protects CII and advises its owners.
• The Indian Cyber Crime Coordination Centre (I4C) of the Ministry of Home Affairs (MHA), inaugurated in January 2020, runs the National Cyber Crime Reporting Portal and the 1930 helpline, and since 2024 a suspect registry, a cyber fraud mitigation centre and the Samanvaya platform for police across States; police and public order are State subjects, so investigation itself stays with State police.
• Sectoral bodies. The Department of Telecommunications (DoT) notified the Telecom Cyber Security Rules in November 2024 under the Telecommunications Act 2023, requiring operators to report incidents within six hours, and regulators such as the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI) set cyber standards for banks and markets.

Law and policy

• The IT Act 2000, amended in 2008, defines cyber offences such as identity theft (Section 66C), cheating by personation (Section 66D) and cyber terrorism (Section 66F), and creates the powers for protected systems, NCIIPC and CERT-In.
• The National Cyber Security Policy 2013 aimed to train five lakh cyber security professionals in five years. A National Cyber Security Strategy drafted after 2019 had not been released as of 2025.
• The CERT-In directions of 28 April 2022, issued under Section 70B(6), require organisations to report specified incidents within six hours, keep system logs for 180 days within India and synchronise their clocks with national time servers, and require virtual private network (VPN), data centre and cloud providers to keep subscriber records for five years.
• The Digital Personal Data Protection (DPDP) Act 2023 obliges every data fiduciary to take reasonable security safeguards and to report breaches to the Data Protection Board and to affected persons, with a penalty of up to Rs 250 crore for failing to protect data. Its Rules were notified on 14 November 2025, with most duties phased in over 18 months.
• Internationally, India is not a party to the Budapest Convention on Cybercrime (2001), which it did not help draft; the United Nations General Assembly adopted the first global Convention against Cybercrime in December 2024.

Issues and way forward

• No published strategy. Without a strategy, agencies' roles overlap and budgets are not tied to goals; releasing one with clear roles is the first step.
• Too few skilled people. Government and small firms cannot match private salaries, so a cadre of cyber specialists is needed.
• Weak police capacity. Most police stations lack trained investigators and forensic tools, so cases pile up and conviction is rare; the Cyber Commandos programme of I4C and forensic laboratories in every State help.
• Weak links. Cooperative banks, hospitals and small suppliers are easy entry points into larger networks, so baseline standards and audits should reach them.
• Fraud ecosystem. Mule accounts, rented SIM cards and scam centres abroad sustain fraud, so linking banks, telecom operators and police in real time matters more than prosecuting single cases.
• Global rules. Faster sharing of evidence and norms against attacks on civilian infrastructure would shrink safe havens.

Common confusions

• CERT-In and NCIIPC. CERT-In responds to incidents across all sectors under MeitY; NCIIPC protects only critical information infrastructure and sits under the National Technical Research Organisation.
• Cyber crime and cyber terrorism. Cyber crime targets people and firms for gain; cyber terrorism under Section 66F targets the nation's security or seeks to strike terror, and carries up to life imprisonment.
• Cybersecurity and data protection. Cybersecurity protects systems from attack; data protection governs how personal data is used, though the DPDP Act links them through the duty to keep data safe.
• Virus and worm. A virus needs a user to open an infected file; a worm spreads across networks by itself.

For the exam

• Keyword bank: CIA triad, critical information infrastructure, ransomware, DDoS and botnet, advanced persistent threat, zero day, supply chain attack, CERT-In, NCIIPC, I4C and 1930, Section 66F, six hour reporting rule, DPDP Act 2023, National Cyber Security Strategy, cyber resilience.
• Previous year questions: Practise the previous year questions on this topic →
• Use in an answer:
  • Introduction with data: CERT-In handled about 20.4 lakh cyber security incidents in 2024, against about 11.6 lakh in 2020, while NCRB recorded a 31 per cent rise in cyber crime cases in 2023.
  • Introduction with a law: The IT Act's Section 70 treats a computer resource whose loss would cripple national security, the economy or public safety as critical information infrastructure, recognising that a digital economy has digital points of failure.
  • Conclusion: Cybersecurity is won by resilience, not by walls alone; a published strategy, trained people and quick reporting matter more than any single tool.
  • Conclusion: As India's economy and governance move online, securing cyberspace is as basic to internal security as guarding the borders.