Showing posts with label Cyber Security Policy Of India. Show all posts
Showing posts with label Cyber Security Policy Of India. Show all posts

Thursday, February 2, 2012

New National Telecom Network Security Policy Of India

Recently a body named National Telecom Network Security Coordination Board (NTNSCB) of India has been proposed to be constituted by Indian government. The aim of establishment of NTNSCB is to ensure cyber security and telecom network security in India in a centralised manner.

The establishment of proposed NTNSCB would require formulation of telecom security policy in India and telecom equipments security framework in India at the first instance. There is no local or indigenous mechanism in India through which telecom hardware and software can be analysed for backdoors and malware.

However, Indian government has declared in the past that telecom equipments must be certified by TEC before use in India. A proposal to store call data records has also been given. The norms for import of telecom equipments in India would also be formulated very soon. Similarly, a telecom security policy of India may also be drafted.

Now as per recent media reports, telecom operators, equipment vendors, enterprise communication network users will all be made responsible for securing telecom networks under a new telecom network security policy of India. It has been reported that the policy would be drafted by the Department of Telecom (DoT) and it also intends to make network robust so that they can deal with disasters and crisis situations.

Under the proposed telecom network security policy, all telecom network equipments will have to get a “safe to connect certification” before they can be used in India. The certification will have to be done through a testing laboratory. Periodic test of the telecom networks will be carried out to ensure that no threat has crept into the network.

The proposed telecom network security also wants corporates using global enterprise communication networks to ensure that the network within the country complies with the security requirements. It is possible that network of these enterprises are subjected to laws of different countries, which may not be the same. Therefore, enterprises would have to adopt a little flexible approach in building their network security policies in such a way that part of the network in the geographical boundary of the country follows the security requirements mandated by this policy.

The policy also suggests setting up a centralised institution to address network and cyber security issues. Presently, the central monitoring system (CMS) project of India is one such centralised mechanism that DoT is planning to launch. A national cyber security policy of India may strengthen this initiative of DoT.

Friday, January 6, 2012

Critical Infrastructure Protection (CIP) And Homeland Security (HS) In India

World over critical infrastructure protection (CIP) and homeland security (HS) are considered as top priority areas. This is logical as well since both CIP and HS are important parts of national security of any nation.

With the growing use and dependence upon information and communication technology (ICT), nations are focusing upon ensuring robust cyber security. The international cyber security policy framework and Indian response to the same are proof of the same. In fact, India is considering use of public private partnership (PPP) for internal security of India. Although India is also considering working in the direction of cyber security yet its speed and efforts in this direction are slower as compared to international cyber security standards and efforts.

Cyber security in India is not what is required. As per the cyber security trends in India 2011 by Perry4Law Techno Legal Base (PTLB), cyber security expertise and practices adopted in India are neither adequate nor qualitative. There is an urgent need to strengthen the cyber security mechanisms of various stakeholders in India.

Homeland security in India needs to be strengthened. In fact, India US homeland security dialogue has already been initiated. Homeland security and cyber security market in India is growing. In fact, Microsoft and Symantec are exploring the cyber security market of India. European Union (EU) has also invited India to participate in a mega cyber security and cyber crime project.

Critical national infrastructure security in India needs to be strengthened. Highly sophisticated malware like Duqu, Stuxnet, etc targeted India in the year 2011 and India is still investigating the Duqu malware. Indian nuclear facilities, automated power grids, satellites, defense networks, governmental informatics infrastructures, etc are vulnerable to sophisticated cyber attacks. It is still not clear whether Indian satellites are safe from cyber attacks.

Supervisory control and data acquisition (SCADA) is another area of concern. Cyber protection of SCADA systems in India must also be ensured. Similarly, Indian defense and security against cyber warfare needs to be developed so that cyber attacks against India can be thwarted. A good cyber security policy in India must be formulated that must include a critical ICT infrastructure protection policy of India as well. Similarly, effective legal and policy framework for cyber security must also be created in India.

Although there are numerous aspects of Cyber Security Policy of India yet Critical Infrastructure Protection in India and Critical ICT Infrastructure Protection in India are the most important aspects of the same. Similarly, cyber law of India must also be strengthened to effectuate cyber security in India. Hopefully Indian government would consider these aspects this year.

Friday, November 18, 2011

National Cyber Security Policy of India Is Needed

Cyber security policy and strategy is an important aspect of national security. Till now we have no national security policy of India. There is no second opinion about the fact that national security policy of India is required and the sooner it is drafted and implemented the better it would be for India.

In fact, national security of India is affected by turf war that is putting the entire national security at risk. For instance, Indian nuclear facilities may not be cyber secure. Indian websites are occasionally defaced.

Crucial computers at strategic government departments and defense forces are frequently compromised. The servers of national informatics centre (NIC) of India were recently hacked. This puts the entire governmental web infrastructure at risk.

A sound national security policy must have many essential and important aspects incorporated into it. One such essential component is cyber security policy and strategy of India. Till now we have no implementable national cyber security policy of India.

India’s national cyber security policy must be suitable formulated and immediately implemented. Further, Indian counter terrorism capabilities needs rejuvenation to deal with traditional terrorism and cyber terrorism. Indian banks are also not very good at cyber security and they are not willing to upgrade their cyber security despite the mandatory recommendations by Reserve Bank of India (RBI).

At the international level efforts have been streamlined to strengthen cyber security and global cyber security cooperation. Recently NATO requested cyber security cooperation from India.

Even at the individual level countries are strengthening their offensive and defensive cyber capabilities. In United States, the DARPA is developing offensive and preventive cyber capabilities. Indian defense and security against cyber warfare must also be developed.

It is high time for India to develop cyber offensive and defensive capabilities so that it can manage cyber threats like cyber terrorism, cyber warfare, cyber espionage, etc in a timely and effective manner.

Monday, September 26, 2011

Cyber Attacks Are Affecting Indian Critical Infrastructure

These days information and communication technology (ICT) has become an indispensable part of our day to day life. Many critical infrastructures have now been connected with ICT in one form or another.

This is the reason why we need to ensure critical infrastructure protection in India and critical ICT infrastructure protection in India. We also need to strengthen the cyber security of India and the best way to do so is to formulate the national cyber security policy of India.

Cyber attacks and cyber threat are increasing against India. However, cyber security in India is not up to the mark and is ailing badly. There are many factors for the poor performance of Indian cyber security and lack of adequate expertise is one of them.

Whether it is strategic government department’s computers or critical infrastructure, all of them are under constant cyber attack risks. Take the example of the recent cyber security incidence that has affected the Indira Gandhi International Airport (IGIA) security systems.

Three months ago, a ‘technical snag’ had hit operations at the state-of-the-art T3 terminal at IGIA. It now turns out it was caused by a “malicious code” sent from a remote location to breach the security at the airport.

A hunt has been launched to nab the perpetrator with the CBI registering a case under the IT Act and IPC. Investigators say that the “malicious code” was in the form of “attack scripts”, which means a programme was written by an expert to exploit the system’s security weakness.

While the efforts of CBI is praiseworthy yet when it comes to timely and appropriate actions, CBI does not score well. For instance, the case of CBI’s website defacement has not been investigated in the manner it was required. Cyber crimes investigations in India need to be improved to make effective investigation and get desired results.

In the present case of IGIA as well the news of the cyber attack has come after three months and this has weakened the case to a great extent. We need timely detection and effective cyber crime investigation capabilities in India to deal with cyber attacks and cyber crimes. Indian government must conduct effective trainings and courses for cyber crimes investigations in India.

Coming to the present case, the check-in counters, transfers counters and boarding gates at the IGI are operated using the Common Use Passengers Processing System (CUPPS), maintained by Aeronautical Radio Incorporated (ARINC). The CUPPS operates on a common software-and-hardware platform that integrates all information such as an airline’s reservation system, the expected time of departure and the capacity at waiting lounges. The problem in CUPPS started at 2.30 am on June 29 due to which check-in counters of all airlines at T3 became non-operational.

“This forced the airlines to opt for manual check-in and as a result passengers had to wait. There are around 172 CUPPS counters and only a third were functioning online,” said an official. The investigation revealed that someone had hacked into the main server of the CUPPS and introduced a virus.

It took nearly 12 hours to restore the system. The CBI was also called in as officials suspected it was a security breach. “We found that there were serious security lapses,” said a CBI official.

The agency had also asked for details of records of CUPPS and staff handling the system. “Once we receive the details, it will be analysed to see if any official is involved. It appears that someone sitting at a remote location had operated the system. We have registered a case under the IT Act and other relevant section of the IPC,” added the CBI official.

Indian critical infrastructures are under strong cyber attacks and we need to take this seriously. In cyber crimes and cyber attacks cases taking months to investigate them means loosing the case. We have to develop real time cyber security capabilities in India to avoid such failures.

Thursday, June 9, 2011

Cyber Crisis Management Plan Of India

Crisis Management is an important aspect of planning and management of any project or eventuality. If we have a proper Crisis Management Plan, losses of lives and property is minimised to a great extent. We have Crisis Management Plans in India against floods, earthquakes and other natural calamities. However, are we prepared for Cyber Crises in Indian Cyberspace?

India has formulated a Crisis Management Plan for its Cyberspace. However, like other Policies and Strategies in India, it has not been implemented in true letter and spirit. Even the basic level Cyber Security Preparedness in India is not up to the mark.

There are many aspects of a Cyber Crisis Management Plan. For instance, Cyber Security, Cyber Law, Cyber Forensics, Anti Cyber Terrorism Plans, Anti Cyber Espionage Plans, Anti Cyber Warfare Plans, Human Rights Protection in Cyberspace, Critical ICT Infrastructure Protection, etc are some of the “Components” of a Cyber Crisis Management Plan.

Theoretically, India has a Cyber Law in the form of Information Technology Act 2000 (IT Act 2000), Cyber Security in the form of Government Guidelines, Cyber Forensics Practices in Governmental Laboratories alone and so on.

However, practically we have no Cyber Crimes Laws in India as the Cyber Law of India has made almost all the Cyber Crimes “Bailable”. We may have a Cyber Law but India has no Cyber Crimes Law. So Legal Framework for preventing Cyber Crimes is “practically missing” in India.

As far as Cyber Security is concerned, we have no Cyber Security Laws in India and no Cyber Security Policy in India. The Governmental Guidelines are meant for Government Departments alone and even these Government Departments do not follow the same. Government Websites are the most frequently defaced websites in India. Similarly, Government Computers are the “most successfully breached” Computers in India. Computers of Defense Forces, Prime Minister’s Office (PMO), Ministry of External Affairs (MEA), Ministry of Home affairs, etc have been successfully breached without even notice by these Ministries/Offices.

As far as other components of Cyber Crisis Management Plan of India are concerned, even they do not exist in India. We have no Cyber Forensics Laws in India, no Cyber Terrorism Policy in India, no Cyber Warfare Policy in India, no Critical ICT Infrastructure Protection Policy in India and no Human Rights Protection in Cyberspace in India.

In fact, Projects like Aadhar, NATGRID, CCTNS, Central Monitoring System (CMS) of India, etc are openly violating the Human Rights of Indians. These Projects are operating without any Legal Framework, Parliamentary Oversight and Judicial Scrutiny.

Even the basic Privacy Rights in India are missing. It is only now the Law Ministry of India has proposed the Right to Privacy Bill 2011 of India. Further, Data Protection Law in India is urgently required. We also need a Data Security Policy of India so that sensitive information and data of projects like Aadhar, NATGRID, CMS, etc is not “misused” once it falls in the wrong hands.

India cannot have a robust and effective Cyber Crisis Management Plan till it considers these aspects and actually starts working in the direction of achieving these components.