Cyber security and challenges

The worst ransomware attack the world has ever seen has just been thwarted, or so it might seem, with a $10 web domain. WannaCry drove thousands to tears around the globe, and held out a stark warning about the vulnerabilities of our digital, inter-connected, existence.

What exactly happened?

WannaCry, a crypto-ransomware that is also called WannaCrypt, affected at least 200,000 computers in 150 countries, including India, described as the largest ever of its kind. The WanaCrypt encrypts data on a computer within seconds and displays a message asking the user to pay a ransom of $ 300 in Bitcoins to restore access to the device and the data inside.

Alarmingly, the attack also hit the National Health Service of the United Kingdom, stalling surgeries and other critical patient care activity across the British Isles, and making confidential patient information and documents inaccessible.

But what is ransomware? How is it different from other malicious software?

There are many types of malware that affect a computer, ranging from those that steal your information to those that just delete everything on the device. Ransomware, as the name suggests, prevents users from accessing their devices and data until a certain ransom is paid to its creator. Ransomware usually locks computers, encrypts the data on it and prevents software and apps from running.

Is this the first attack?

Big no. previously there are so many cyber attacks some of the famous ones includes.

1. In 2014, Sony Pictures Entertainment became the target of the biggest cyberattack in US corporate history, linked to its release of North Korea satire "The Interview", hated by Pyongyang.

2. The past year witnessed a devastating attack on Ukraine’s critical infrastructure.

Known Cases of cyber attacks and cyber warfare:

Year Case
2010 Iran was attacked by the Stuxnet worm, thought to specifically target its Natanz nuclear enrichment facility. The worm is said to be the most advanced piece of malware ever discovered and significantly increases the profile of cyber warfare.

2009 Operation Aurora is a cyber attack which began in mid-2009 and continued through December 2009. The attack was first publicly disclosed by Google in January 2010, and was believed to be originated from China. The attack has been aimed at dozens of other organizations, of which Adobe Systems, Juniper Networks and Rack space have publicly confirmed that they were targeted.

2009 A series of coordinated cyber attacks against major government, news media, and financial websites in South Korea and the United States. While many thought the attack was directed by North Korea, one researcher traced the attacks to the United Kingdom.

2008 A cyber spy network, dubbed Ghost Net, using servers mainly based in China has tapped into classified documents from government and private organizations in 103 countries, including the computers of Tibetan exiles, but China denies the claim.

2007 United States government suffered an “an espionage Pearl Harbor” in which an “unknown foreign power…broke into all of the high tech agencies, all of the military agencies, and downloaded terabytes of information.

What is Cyber Space ?

Cyberspace comprises IT networks, computer resources, and all the fixed and mobile devices connected to the global Internet. A nation’s cyberspace is part of the global cyberspace; it cannot be isolated to define its boundaries since cyberspace is borderless. This is what makes cyberspace unique.

Unlike the physical world that is limited by geographical boundaries in space—land, sea, river waters, and air—cyberspace can and is continuing to expand. Increased Internet penetration is leading to growth of cyberspace, since its size is proportional to the activities that are carried through it.

What do we mean by Cyber security?

Cyber security is concerned with making cyberspace safe from threats, namely cyber-threats. The notion of “cyber-threats” is rather vague and implies the malicious use of information and communication technologies (ICT) either as a target or as a tool by a wide range of malevolent actors.

As commonly used, the term “cybersecurity” refers to three things:

1. A set of activities and other measures, technical and non-technical, intended to protect computers, computer networks, related hardware and devices software, and the information they contain and communicate, including software and data, as well as other elements of cyberspace, from all threats, including threats to the national security;

2. The degree of protection resulting from the application of these activities and measures;

3. The associated field of professional endeavour, including research and analysis, aimed at implementing and those activities and improving their quality.

Cyber security is thus more than just information security or data security, but is nevertheless closely related to those two fields, because information security lies at the heart of the matter.

Need For Cyber security:

1. To ensure critical infrastructure system do not collapse under any situation.

2. To ensure Business continuity.

3. To ensure disaster recovery plans are tested regularly and upgraded.

4. For the success of government initiatives like Digital India, Make in India and Smart Cities.

Cyber attack Vs Terrorism:

The architecture of the Internet was designed to promote connectivity, not security. Cyber experts warn that the more technologically advanced and wired a nation is, the more vulnerable it is to a cyber-attack. Cyber attack has an interesting parallel to terrorism.

• Both are asymmetric.

• Ensuring security of data, information, and communication is considerably harder than hacking into a system.

• The attacker has an inherent advantage in both conventional terrorism and cyber attacks.

• In the case of state-sponsored attacks, the challenges are of a much higher magnitude.

India’s Vulnerability on cyber space

• India remains vulnerable to digital intrusions such as cyber-espionage, cybercrime, digital disruption and Distributed Denial of Service (DoS).

• The crimes related to cyber world can be multi-layered, multi-location, multilingual, multicultural and multi-legal, that’s why it is difficult to investigate and reach to the criminal.

• The cases related to cyber crime have increased by 70% in the year 2014 as compared to the year 2013.

• There is growing threat from online radicalization.

• The number of cybercrime cases registered in India has risen by 350 per cent in the three-year period from 2011 to 2014, according to a joint study by PwC and Assocham.

• With the growing adoption of the Internet and smart-phones, India has emerged “as one of the favourite countries among cyber criminals.”

• Major security threat: Critical infrastructure: Attackers can gain control of vital systems such as nuclear plants, railways, transportation or hospitals that can subsequently lead to dire consequences.

• Despite having a National Cyber Security Policy (2013), risks to our critical infrastructure remain.

• In spite of instituting a National Cyber Security Coordinator (2014), the rivalries between the National Technical Research Organisation (the nodal agency for cybersecurity) and the Ministry of Communications and Information Technology impede cooperation.

• Lack of coordination among different government agencies.

• China’s emphasis on ‘cloud computing techniques’, and the involvement of its Ministry of State Security in this endeavour, suggests that it is preparing for allout offensive cyber operations. India would be a prime target.

India Needs

1. Bleeding edge technology: Bleeding edge refers to technology that has been released but is still not ready for the general public due to the fact that it has not been reliably tested. The term bleeding edge was formed as an allusion to the similar terms "leading edge" and "cutting edge".

2. Big data analytics: it is the process of collecting, organizing and analyzing large sets of data (big data) to discover useful information.

3. Air gapping: Air gapping is a security measure that involves isolating a computer or network and preventing it from establishing an external connection. An air gapped computer is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices.

4. Emphasis on cloud computing techniques.

5. Offensive cyber operations and strengthened cyber security.

Cert-in:

• The Indian Computer Emergency Response Team (CERT-IN) is the national nodal agency since 2004 for responding to cyber security incidents as and when they occur.

• It operates under Ministry of Communication and Information Technology.

• Its major work includes collection, analysis and dissemination of information on cyber incidents, forecasting alerts and taking emergency measures to handle a cyber-situation. It also coordinates the cyber incidents response activities and issues guidelines and advisories on best practices for prevention, reporting and response.

• It has signed cooperation pacts with its counterparts in Malaysia, Singapore and Japan for cyber security.

• This will also facilitate regular dialogues pertaining to prevalent policies and best practices and mutual response to cyber-security incidents.

National and International summits related to Cyber security:

1. Ground Zero Summit (2015):
• Ground Zero Summit is the largest collaborative platform in Asia for Cyber security experts and researchers to address emerging cyber security challenges and demonstrate cutting-edge technologies. It is the exclusive platform in the region providing opportunities to establish and strengthen relationships between corporate, public sector undertakings (PSUs), government departments, security and defense establishments.

• The Summit gets its name from a piece of ancient Indian history. India is the ground where zero was discovered and zero is integral part of digital systems.

• It is being organized by the Indian Infosec Consortium (IIC), which is an independent not-for-profit organization formed by leading cyber experts.

• Aim of the summit: The summit was organized to deliberate upon various issues related to cyber security challenges emerging due to the latest technological developments.

• The theme for the Summit - Digital India – ‘Securing Digital India

Outcomes:

I. Indian Cyber Crime Coordination Centre (I-4C)
a) The government has initiated efforts to set up “Indian Cyber Crime Coordination Centre” (I-4C) on the basis of the recommendations of the Gulshan Rai committee.

b) I-4C will help in monitoring and capacity building of cyber-crimes, and will help law enforcement agencies in curtailing these crimes.

II. Repository of IT professionals

The idea of a National Cyber Registry “as a repository of IT professionals” was mooted. The repository envisions identification of a talent pool and through sustained efforts could assist professionals to enhance respective domain knowledge.

2. 8th International India Security Summit 8th International INDIA SECURITY SUMMIT: Securing the Nation was organized by ASSOCHAM, India’s Apex Chamber for Commerce and Industry.

3. International Convention on Cyber crime:

Convention on Cybercrime, also known as the Budapest Convention.

• The Budapest Convention is the first international treaty that addresses Internet and computer crime by harmonizing national laws, improving legal authorities for investigative techniques, and increasing cooperation among nations.

• The Budapest convention is the only multilateral convention on cyber security – considered critical to economic and national security of a country.

• Developing countries including India have not signed it stating that the developed countries lead by the US drafted it without consulting them.

Cyber Security in Space:

Need

• The Promising $330-billion space economy presents opportunities as well as threat due to increasing commercial interaction between different stakeholders including private commercial sector.

• Space presents a double opportunity for hackers as Satellites are becoming trophy attacks for the hackers.
Threat from hacking

• The amount of data being beamed between satellites supporting commercial networks on earth is growing rapidly, thus making them a ripe target for cyberattacks. Satellite makers have reported attempts to add a virus to software, as well as multiple attempts to intercept data being sent back to earth.

• Space is primarily about intellectual property. Research and Development on this state-of-art extreme technology takes a long gestation time and causes huge financial liability – a cyber-attack to steal from an industry rival in terms of technology can be a huge time- and money saver.

• Companies and even countries have been known to exploit manufacturing strengths to gain access to satellites.

For example - Recently, an agency received microcircuits made of material whose composition, under the microscope, was found to have been tampered with at a fundamental level. Had the attack not been detected, it would have interfered with a random number generator in a way that would have helped hackers to access the satellite, with worrying repercussions.

Impacts

• It may result into pushing up the cost of commercial ventures and could be a potential brake on future investment.

• Intellectual property, even military and strategic information loss to a rival country can be potentially devastating.

Indian Perspective

• This is new, emerging theatre of war and it is easy to paralyze satellite systems leading to repercussions on security and economy of our country.

• There were reports to suggest that Stuxnet was responsible for the power glitch leading to the failure of India’s INSAT-4B communications satellite. However, ISRO has flatly denied this possibility.

Way Forward

The success in the futuristic space endeavour will depend upon setting up a welltuned, cyber secure and tamper proof cyber security system, which can provide surge capabilities to bolster India’s Space programme during critical period or in hostilities.

Related Terminologies and basics:

Cyber warfare has been defined as “actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption.”

Cyber attacks are defined as “deliberate actions to alter, disrupt, deceive, degrade, or destroy computer systems or networks or the information and/or programs resident in or transiting these systems or networks.

Cyber exploitation or cyber espionage, on the other hand, refers to the penetration of adversary computers and networks to obtain information for intelligence purposes; this is espionage, not a destructive activity.

Cyber attack weapons are easy to use and they can generate outcomes that range from the simple defacing of a web site to the stealing of data and intellectual property, espionage on target systems and even disruption of critical services.

Cyber attack as a mode of conflict raises many operational issues — for example, how will a country know whether it is the subject of a deliberate cyber attack launched by an enemy government? How will it prove this? Proving attribution in cyberspace is a great challenge.

It is extremely difficult to attribute cyber attacks to a nation-state, since collecting irrefutable evidence has proved elusive in almost all cases of this nature in recent years. The very nature of botnets and zombies makes it difficult to do so. This has led many analysts to conclude that the Internet is the perfect platform for plausible deniability.

Cyber attackers can support military operations. They can disrupt the target’s command, control, and communications. They can support covert actions to influence governments, events, organizations, or persons, often disguising whoever is launching those actions. Valuable information and state secrets can be obtained through cyber espionage.

Questions:

1. Discuss the necessity of and measures being taken to introduce strong cyber security framework for banking sector in India.

2. It is said that despite having a national cybersecurity policy, risks to our critical infrastructure remain. What are the main cyber threats that India is likely to face? What are the weaknesses of cybersecurity policy? Discuss.

3. Cyber security, in the near future, will be the main component of the state’s overall national security and economic security strategies. Are citizens, organizations and public institutions ready to face challenges of cybersecurity? Critically analyse

By Vittal Reddy ( The writer is an IAS faculty )