The proliferation of technology presents new cyber security challenges and leads to significant national risks. Cyber security can help prevent cyber attacks, data breaches and identity theft.
Rapid growth in Internet access, use of Internet-enabled devices, and the availability of high speed information technology systems and large data sets have facilitated productivity, efficiencies, and capabilities across all major industries. The proliferation of technology also presents new cyber security challenges and leads to significant national risks. Cyber security is the protection of internet-connected systems, including hardware, software and data, from cyber attacks. As more & more devices get connected to the Internet, the risks introduced by the growing number and variety of such devices are increasing manifold. The use of cyber security can help prevent cyber attacks data breaches and identity theft. It provides an institutional mechanism to plan, develop and execute counter measures against cyber crimes and can aid in risk management.
Cyber Security Elements
In a computing context, security comprises cyber security and physical security -- both are used by organizations/entities all over the world to protect against unauthorized access to data centres and other computerized systems. Information security, which is designed to maintain the confidentiality, integrity and availability of data, is a subset of cyber security. Ensuring cyber security requires the coordination of efforts throughout an information system, which includes:-
- Application security
- Information security
- Network security
- Disaster recovery/business continuity planning
- Operational security (OPSEC)
- End-User Education-awareness at end user level.
National Cyber Security Policy
The Government of India, Ministry of Communication & Information Technology released the National Cyber Security Policy in 2013. The policy aims to protect information and information infrastructure in cyberspace, build capabilities to prevent and respond to cyber threats, reduce vulnerabilities and minimise damage from cyber incidents through a combination of institutional structures, people, processes, technology and cooperation.
However, the government of India needs an updated policy to move beyond simply a statement of principles and outline how to operationalize cyber security, from training cyber security personnel, to establishing public-private partnerships, and to facilitating civil-military collaboration. Action Plans to achieve various objectives outlined in the National policy with suitable time frames need to be evolved and their implementation closely monitored.
One of the stated objectives of the National Cyber Security Policy was to “To create a workforce of 500,000 professionals skilled in cyber security in the next 5 years through capacity building, skill development and training” in 2013. After nearly five years, there has not been much progress made and number of such skilled personnel is just 10 to 15 percent only of the projected target according to latest reports. An updated Cyber Security Policy should outline specific guidelines for the training and recruitment of such cyber specialists in a time-bound manner.
Public-private partnerships were a central feature of India's cyber policy as well. The policy called for the “developing effective public private partnerships and collaborative engagements through technical and operational cooperation and contribution for enhancing the security of cyberspace.” However, there has been little development in this area. Industry partners such as the Information Systems Audit and Control Association (ISACA), the National Association of Software and Services Companies (NASSCOM), and the Data Security Council of India (DSCI) have collaborated to address private sector cyber security needs, but these processes have not yet aligned with government efforts. Addressing this gap must be at the heart of the government's updated policy.
Another area of priority for a new cyber security policy must be fostering greater civil-military cooperation on cyber security. There is a need for “more regular, more formalised interaction” between the civilian and military branches of government. The government's updated policy must go beyond the vision of greater collaboration outlined in the 2013 policy, and outline the frameworks for such greater collaboration, potentially under the aegis of the newly created National Cyber Coordination Centre operationalized in August 2017.
For implementation of cyber security policy as laid out by the government of India, requires a well-coordinated approach and active participation by various agencies as indicated below:
- Government Agencies like National Technical Research Organisation (NTRO) & Defence Intelligence agency (DIA).
- National Critical Information Infrastructure Protection Centre (NCIIPC)- carved out of computer emergency response team (CERT-In) to protect assets in critical sectors such as energy, transport, banking, telecom, defence and space.
- Indian computer Emergency Response Team set up in 2004 as a unit of department of IT. It protects non-critical assets. It is the nodal agency for responding to computer security incidents.
- National security advisor will oversee a public-private tie-up to set up a cyber security architecture.
These agencies need to be strengthened through technology upgradations and induction of skilled manpower to meet the emerging challenges of cyber security.
Cyber Warfare: Global Scenario
Cyber warfare involves both offensive and defensive operations pertaining to the threat of cyber attacks, espionage and sabotage. In the U.S. Cyber Command is the newest global combatant and its sole mission is cyberspace, outside the traditional battlefields of land, sea, air and space. It will attempt to find and, when necessary, neutralize cyber attacks and to defend military computer networks. The kind of targets that the Cyber Command could be ordered to attack, including "traditional battlefield prizes command-and-control systems at military headquarters, air defence networks and weapons systems that require computers to operate.”
Examples of cyber warfare driven by political motivations can be found worldwide. After reports that Russia meddled in the US elections by hacking machines and creating propaganda on the internet and the recent ransom ware and other cyber attacks being attributed to North Korea, cyber warfare is gaining importance. China has already developed strong cyber warfare capacity. Equally important is cyber propaganda. During the Doklam conflict, China tried its best to unleash cyber propaganda on India and indulged in complex psy-ops.
Cyber Security in Defence: India
The next war may well have to be fought on the internet where a country's vital networks and infrastructure would be on target that will create bigger disruption than actual wars, which are generally confined to a particular sector or theatre. Recently, Pakistani hackers compromised 10 Indian websites which included National Aeronautics, Army Institute of Management and Technology, Defence Institute of Advanced Technology, Army Institute of Management, and the Board of Research in Nuclear Sciences.
The government is finally reacting to the threat with a plan to create a new tri-service agency for cyber warfare. The Defence Cyber Agency will work in coordination with the National Cyber Security Advisor. It will have more than 1,000 experts who will be distributed into a number of formations of the Army, Navy and IAF. According to reports, the new Defence Cyber Agency will have both offensive and defensive capacity. The Defence Cyber Agency is seen as a precursor of a cyber command. The Ministry has outlined a Cyber Security Framework for the Draft Defence Production (DDP) policy.
Global Market Analysis
Cyber security comprises a host of products & services tailored to address the specific needs of various industry verticals. Further the cyber security can be split into products and services categories as Under:-
As per a report prepared by steering committee constituted by NASSCOM-DSCI, the global cyber security market is expected to reach approximately 190 billion USD by 2025 from 85 billion USD at present and will be driven primarily by increasing digitisation wave and smart phone penetration and expected to grow at a compounded annual growth rate (CAGR) of 8.2%.Enterprises and the Government constitute a major share of the market -eg., in the UK, they constitute approximately 80% of the market. While small and medium sized enterprises (SMEs) currently represent a smaller pool, they are expected to demonstrate the highest growth rates, driven by increased awareness and vulnerability to cyber attacks, adoption of platforms such as bring your own device(BYoD) and increasing affordability of MSS.
While the overall cyber security market is dominated by North America & Europe, the growth is driven primarily by Asia pacific (APAC) & Latin America (in that order). In North America, network security is the largest product segment, also registering the highest growth. On the other hand, in the APAC region, security & vulnerability management is the highest growing segment and network security represents the largest segment. The expected growth in products and service segments likely to be as under:-
- Network security will emerge as the most attractive product segment by size, while security & vulnerability management has the highest growth prospects across various geographic regions.
- Although growth of “implementation services” is low, its large market size makes it important opportunity to address. A deeper look at the industry vertical reflects a similar trend wherein BFSI, Government & manufacturing constitute 80% of the overall market.
- Messaging security & web security are product groups with low growth prospects.
- Network security, IdAM and SVM are the top product segments by size & growth prospects, and are expected to contribute around 75% of the overall product market by 2025.While SVM and IdAM are smaller in size, there potential for future growth makes them attractive.
- MSS emerges as the most attractive opportunity, with highest growth (more than 12%) and largest market size (18 billion USD).
Given the key trends through global market analysis, analysing the capabilities existing in India & the main global growth drivers identified over the next decade, MSS Implementation services, Network security and SVM emerge as opportunities that India should target on priority.
For India to become a global hub in cyber security, a radical strategy change is required. An institutional mechanism with active participation of Government agencies as well as Industry synergising their efforts needs to be put in place at the earliest. Since cyber threats adversely impact our national security, there is no doubt, that military will be an important stakeholder in efforts for achieving our national cyber security goals.
For a broad-based cyber security framework, some key thrust areas are indicated below:
- Policy & Regulations, continuous monitoring, audit & enforcement.
- Human capital development (governance, skill development).
- Research, innovation & technology development including dual use technologies, mechanism for technology transfer.
- Cyber security clusters-Infrastructure, International collaboration.
- Financing-Start-up funding, incubators & accelerators.
- National & International collaboration including research and information sharing, technology expertise exchange.
- Awareness & brand building--general public & sector specific programs and activities to foster awareness.
Some of the above initiatives are already under active consideration at various levels by the Government/industry. Since cyber security has now become a serious threat for governance, what is required is a more focused approach, strategic vision and effective road map to secure our cyberspace.