Introduction
The cyberspace, comprising ICT networks,
computer systems and mobile networks and devices connected to the Internet, is
by its very nature borderless. A country’s cyberspace is an integral part of
the global cyberspace. The increasing penetration of Internet, particularly in
developing countries, is leading to exponential growth in cyberspace. The rapid
growth in the ownership of smart mobile devices (mobile phones and tablets)
that can access the Internet has added to the increasing expansion of cyberspace
in the country.
The exponential expansion in the global
cyberspace has raised very pertinent questions about its security. The success
of the global Internet system can be chiefly attributed to its relative
openness and low entry barriers. However, these very same factors are also
partly responsible for the grave threats to the cyberspace in the forms of
cyber espionage, cyber warfare, cyber terrorism and cyber crime (IDSA, 2012).
As nations spend heavily on creating the necessary ICT infrastructure to bring
more citizens online to derive benefits from social and economic development
opportunities that the Internet provides, cyberspace is expected to face
greater threats in the future. Cyber security has consequently acquired much
greater importance today than in the recent past. Several incidents of cyber
crime across the world have led to heightened awareness about ensuring cyber
security. What are the opportunities and challenges that this scenario is
likely to throw up domestically and globally? How can countries like India
address the challenges and benefit from the opportunities in the domestic and
the global cyber security market? In
this article, I attempt to answer these central questions.
The rest of the paper proceeds as follows.
First, I discuss the main features of the global cyberspace briefly. Then I
discuss the main vulnerabilities of the global cyberspace and how they pose a
threat to its security. Next, I discuss the organizational and coordination
challenges for cyber security. Then, I discuss the opportunities and challenges
for the country in the domestic space for cyber security and then I present the
opportunities and challenges for India in the global cyber security market. Finally,
I conclude.
The Global
Cyberspace
To appreciate the opportunities and
challenges in the global cyber security market, it is necessary to understand
its size and nature in all its ramifications.
As per the latest estimates, the number of Internet users in the world
has risen to over 2.7 billion in 2013 corresponding to nearly 40% of the
world’s population (ITU (1), 2013). The active mobile broadband subscriptions
stood at 2.1 billion in 2013. Globally, 750 million households, comprising 41%
of the total, are connected to the Internet. The expansion of the Internet is
projected to be on an unprecedented scale in the future with the advent of the
Internet of Things (IoT) and the IPv6 protocol that would make possible
virtually unlimited IP addresses.
Similarly, the expansion of the Internet is
taking place at an exponential rate in India as well. The total percentage of
individuals using the Internet in India has grown from a mere 3.95% in 2007 to
12.58% in 2012 (ITU (2), 2013). The total number of Internet users in the
country is estimated at 164.8 million as on March 31, 2013 (TRAI, 2013). Out of
these, 143.2 million users accessed the Internet through mobile devices.
Vulnerabilities
of Cyberspace
As noted before, by its very nature, the
global cyberspace is borderless and cannot be isolated to national or regional
boundaries. One of the fundamental concerns on cyber security arise from the
fact that the core Internet protocols are insecure and the expansion of
Internet is taking place on the same insecure systems. The global explosion in
mobile based Internet usage is increasing the vulnerability of the cyberspace. As the Internet has become central to the
social, economic and political life of citizens and nations, countries are
investing heavily in establishing information and communications technology
(ICT) infrastructure to bring more and more citizens online. Thus, protection
of the critical ICT infrastructure has emerged as another major challenge in
addition to securing the communications and transactions conducted over the
Internet.
The vulnerability of the cyberspace is
already being exploited by both state and non-state actors (Marmon, 2011). The
attacks in the cyberspace can be mounted by potential adversaries intending to
inflict damage at social, economic or commercial interests. They can also be
targeted at achieving political or military objectives. They are often aimed at
weakening or crippling the critical ICT infrastructure of the adversary to cause
denial of access to information and networks or to render them non-functional. In
2007, there were massive cyber attacks on Estonia aimed at disabling the
websites of government ministries, political parties, newspapers, banks, and
companies. The attackers, suspected to be from a major country with involvement
of state actors, employed sophisticated cyber warfare techniques to disable
Estonia’s critical ICT networks and e-government infrastructure (Traynor, 2007).
The nature of cyberspace makes it very
difficult to identify the perpetrators of these attacks and makes it especially
attractive for enemies who do not want to be engaged in conventional conflicts.
There is no contact or physical action across the border and the attacking
party can completely deny any involvement. The attacked party may not even be
sure as to when and how to react. Both the state and non-state actors have
developed capabilities to engage in cyber attacks for prolonged periods without
being identified.
Organizational
and Coordination Challenges in Cyber Security
There are some additional features of critical
ICT infrastructure and cyberspace that merit discussion here. Cyber
infrastructure is largely owned and operated by the private sector. However,
ensuring cyber security involves a multi-agency and multi-layered effort
involving both state and private agencies. This poses a significant
organizational and coordination challenge for the agencies dealing with cyber
security.
At an organizational level, cyber security is
not merely a technological issue, but a management issue as well. This
encompasses enterprise risk management and involves human, process
reengineering, change management, legal, network and security aspects. While the private agencies are responsible
for securing their individual pieces of the infrastructure, the seamless flow
and exchange of information and inter-linkages amongst the networks make it essential
to coordinate the entire effort through an integrated command and control
entity that is accountable for cyber security. The roles and responsibilities
of all the parties need to be clearly specified. There is a need for
governments to establish the appropriate policy mechanisms and legal
structures. While security investments made by the private industry take care
of their individual corporate needs, they might fall short of the requirements
to secure a national network-wide infrastructure. Thus, a pure market-based
approach to ensure cyber security may not work. A key challenge in this regard
is to provide for the additional investments that might be required to secure
the cyberspace and the critical ICT infrastructure for the country. This might
come from incentives provided to the industry to generate collective action in a
well planned approach to secure the critical ICT infrastructure.
Lack of capacity at the executive and policy
making levels within organizations is another major challenge in ensuring cyber
security. There is a need for a focused approach to build capacities to deal
with security incidents, deploy latest technological solutions, provide
adequate training to all the relevant levels of employees and deal with process
transformation and change management required to achieve this goal.
Opportunities
and Challenges in the Domestic Market for Cyber Security
Before we discuss the opportunities and
challenges for India in the global cyber security market, it is relevant to
discuss the cyber security scenario and the emerging opportunities and
challenges within the country and how the government and the industry can meet
them and benefit from the opportunities. As India develops its ICT
infrastructure in an effort to bring more and more of its citizens online
through projects such as the National Optical Fibre Network (NOFN) and makes
greater efforts to provide public services electronically through its
e-governance projects, the risks for cyber security in the country are going to
be much higher in future. It would also make the entire ICT infrastructure and
cyber assets in the country far more vulnerable to cyber attacks from both
state and non-state actors from countries inimical to India. Are we geared to
meet these challenges?
The government has recently taken several
steps to ensure greater focus on these issues within the country. It has
recently notified the National Cyber Security Policy 2013 (DeitY, 2013) with
the goal of addressing the cyber security domain comprehensively from a
national perspective. The main goal of the policy is to make the cyberspace
secure and resilient for citizens, businesses, and the government. The policy
envisages the establishment of national and sectoral mechanisms to ensure cyber
security through the creation of a National Critical Information
Infrastructure Protection Centre (NCIIPC).
Computer Emergency Response Team (CERT-In) shall act as the nodal agency
for coordination of all cyber security and crisis management efforts. It will
also act as the nodal organization for coordination and operationalization of
sectoral CERTs in specific domains in the country.
Though efforts are being made to create an
effective policy framework to deal with cyber security in the country, there
are areas where significant challenges lie in ensuring cyber security. I would
like to mention e-governance as a specific case in point here. The country has
put in place a separate core ICT infrastructure for e-governance consisting of
state wide area networks (SWANs) and state data centres (SDCs) in each state
and union territory. Common Service Centres (CSCs), run by private village
level entrepreneurs (VLEs), act as the front end for delivery of these services
in rural areas. Currently, over 100,000 CSCs are operational across the
country. Recently, mobile governance has been implemented to bring all
government services on the mobile platform. The National e-Governance Plan is
the flagship programme in e-governance consisting of 31 Mission Mode Projects
(MMPs) spanning across a large number of government ministries and departments
both at the national and state levels. During the last seven years of its
implementation, NeGP has achieved good success with 23 out of the 31 projects
delivering services electronically to the citizens and businesses.
Though NeGP has succeeded well, ensuring
cyber security has been a big challenge as it involves protecting critical ICT
infrastructure such as SWANs, SDCs and the applications of various departments
running on them. Though scheme specific guidelines have been issued and several
states have made significant efforts to protect their cyber assets, there is a
need for a comprehensive policy on cyber security in e-governance and ensuring uniformity
in its implementation across the country. Application level security is another
important domain where greater efforts are required to ensure security.
The scenario discussed above presents big
opportunities for the government and the industry to address cyber security
comprehensively. As the government moves forward to put a policy framework in
place, the IT industry can develop appropriate technological solutions to
address the cyber security requirements of the core ICT infrastructure and
applications. Massive opportunities for the industry are also opening up in
sectors such as defence and telecom where the needs for cyber security are more
critical.
Opportunities
and Challenges in Global Cyber Security
Protecting the cyberspace and the critical
ICT infrastructure have emerged as major challenges globally due to the factors
discussed above. The Internet has emerged as the central feature affecting the lives
of billions globally through e-commerce, banking, travel, e-government, email,
etc. With the emergence of smart technologies, a host of utility services such
as water supply networks, electricity distribution, etc. are critically
dependent on ICT networks. Electronic systems and communications play a key
role in the operation of equipment in the defence sector.
What are the opportunities and challenges
that such a situation presents before nations like India? To analyse these
aspects, it is important to understand the key trends in emerging technologies
and how they impact the security scenario in cyber space. In the following paragraphs,
I discuss seven such key trends and explain how they present challenges and
opportunities for the Indian industry globally.
The most important phenomenon that is driving
the expansion in the usage of Internet worldwide is mobility. The advent of
mobile devices has brought unprecedented numbers of users online and has
consequently increased the risks associated with cyberspace as many of the
mobile and tablet users may be first time users of Internet and may not be
skilled enough to understand these risks. Expansion in the usage of smart
phones and tablets has also brought into focus the security of the operating
systems and the applications that run on them. As the usage expands, so will
the attempts by hackers to break into these devices and steal sensitive personal
and corporate information. While this poses challenges for the device manufacturers
and OS developers, it presents great opportunities for the Indian firms working
in the mobility domain. As India is known for its prowess in software
development, developing security solutions and secure applications for the
mobile world is an unprecedented opportunity globally that is just waiting to
be grabbed.
The second most important technology trend
that is driving the ICT industry is the emergence of the cloud platform. While
this phenomenon started emerging a few years ago, it is only now that it is maturing
and the cloud based solutions are being deployed across a number of domains in
business, industry and government. Ensuring proper security of applications and
data on the cloud is a major challenge and its entire implications are still
not clear. Even a few cloud failures can result in massive breaches in security
and devastating loss of data for the users. As the cloud encompasses the entire
gamut of infrastructure, platform, and software as services, developing
security solutions for this platform presents the Indian industry with an
outstanding opportunity globally. A related segment which also presents great
opportunities is data centre operations and management. Another related
phenomenon is the emergence of security as a service on the cloud. This is
another space that offers good opportunities for Indian firms.
The third important trend that has emerged
recently is that of use of multi-factor authentication to improve security.
Just a simple password is not enough to ensure access to a host of applications
and services in areas such as banking, insurance, financial transactions,
government services etc. In India, already Aadhaar based biometric
authentication has emerged as a new mechanism to authenticate the identity of
users. This presents an excellent opportunity for the Indian industry to
develop applications in this domain and address the security concerns.
The fourth trend that is causing significant
impact on cyber security globally is the continuous morphing of hacker groups
and individuals to maintain their anonymity. This poses serious challenges for
the organizations and government agencies trying to secure cyber space as the
attacks cannot be attributed to any specific entity. However, this situation
also presents very good opportunities for the Indian industry to continuously
evolve technologies that can help in unmasking the identity of these anonymous
attackers. Active cooperation amongst government agencies and organizations internationally
are required to achieve the desired objectives in this area. Efforts in this
direction by agencies such as the United Nations are already going on and the
issue of global cyber security is likely to come up at the 68th
session of the UN General Assembly in September 2013 (United Nations, 2013).
The fifth trend that is impacting the cyber
security scenario is the increasing involvement of state actors in cyber war
aimed at crippling the information and communication infrastructure of their targeted
countries and crippling their social, economic, government and military
activities. There is enough evidence of involvement of state actors in several
recent incidents of cyber attacks (Marmon, 2011). Stuxnet is a case in point
(Vijayan, 2012). This situation has emerged as a serious challenge for
countries like India which are surrounded by several inimical neighbours. However,
this also presents the country with a big opportunity to develop solutions to
secure its ICT infrastructure and cyber assets.
The sixth emerging trend that will have a
significant bearing on cyber security is the related issue of ensuring privacy and
confidentiality of information pertaining to individuals and businesses. One of
the motivations for cyber attacks is to gain access to or steal information
that has commercial value or that helps the attackers to commit fraud with that
information. To ensure privacy, effective laws and regulations need to be put
in place to ensure what data can be used and shared and for what purpose. It
also has bearings on where the data can be stored in servers. This is already a
major concern in some domains such as healthcare, where privacy and security concerns
about hosting and sharing health data are very significant. As India is the
world leader in IT services outsourcing business, this offers a big opportunity
for the Indian government to put in place effective policies to assure the
international community that the country respects the concerns on privacy and
confidentiality of data. The Indian industry should exploit this opportunity in
a big way to get a bigger share of the worldwide market in IT and IT enabled
services.
Lastly, there are greater efforts being made now
internationally at multilateral level to address the global concerns on cyber
security. Recently, the international Group of Governmental Experts,
representing 15 countries including India, has submitted a report to the United
Nations secretary general on enhancing cyber security globally (United Nations,
2013). International cooperation in cyber security presents great opportunities
for India to spearhead and lead the efforts to build global consensus around
the approaches to address the issues. It would also open up tremendous
opportunities for the Indian industry to develop and showcase its capabilities
to offer technical solutions to deal with the threats.
Conclusion
Cyber security has emerged as one of the most
important concerns internationally due to the enormous damage that cyber
attacks can cause to the core ICT infrastructure and information assets that
are central to the social, economic and political life of nations, citizens,
and businesses. As the attackers can disguise themselves easily and their real
identities are very difficult to ascertain, it is even more incumbent upon the
stakeholders involved to take urgent measures to ensure cyber security. While
India has recently taken a number of steps to enhance the security of its vital
ICT infrastructure and cyber assets at the national level, specific domains
such as e-governance, telecom, defence, etc. need specific strategies to deal
with cyber security more comprehensively. Globally, a number of countries are
grappling with similar issues and are stepping up efforts to enhance cyber
security within their territories. Efforts are also on at multilateral level,
such as the UN, to deal with the issue comprehensively and formulate strategies
that can succeed in addressing the concerns globally. As India is known
worldwide for its IT prowess, this scenario presents great opportunities for
the country to lead the efforts internationally to build consensus around
approaches to address cyber security globally. It also presents tremendous
opportunities for the Indian IT industry to develop technical solutions to deal
with the threats and secure the ICT infrastructure and the cyber assets both in
the domestic space as well as internationally.
References
- DeitY. (2013). National Cyber Security Policy. Department of
Electronics and Information Technology (DeitY). Accessed August 25, 2013 from: http://deity.gov.in/sites/upload_files/dit/files/National%20Cyber%20Security%20Policy%20%281%29.pdf
- IDSA. (2012). India’s Cyber Security
Challenge. IDSA Task Force Report. Institute
for Defence Studies and Analysis (IDSA). March 2012. Accessed August 9 from: http://idsa.in/system/files/book_indiacybersecurity.pdf.
- ITU (1). (2013). The World in 2013. ICT Facts
and Figures. International
Telecommunications Union. Accessed September 18 from: http://www.itu.int/en/ITU-D/Statistics/Documents/facts/ICTFactsFigures2013.pdf.
- ITU (2). (2013). Statistics. Time Series by
Country. Percentage of individuals using the Internet. International Telecommunications Union. Accessed September 18 from:
http://www.itu.int/en/ITU-D/Statistics/Pages/stat/default.aspx.
- Marmon, W. (2011). Main Cyber Threats Now
Coming From Governments as “State Actors”. European
Affairs. November 2011. Accessed September 15, 2013 from: http://www.europeaninstitute.org/EA-November-2011/main-cyber-threats-now-coming-from-governments-as-state-actors.html.
- TRAI. (2013). The Indian Telecom Services
Performance Indicators, January – March 2013. Telecom Regulatory Authority of
India (TRAI). Accessed August 25 from: : http://www.trai.gov.in/WriteReadData/WhatsNew/Documents/Indicator%20Reports%20-01082013.pdf.
- Traynor, I. (2007). Russia accused of
unleashing cyber war to disable Estonia. The Guardian. 17 May 2007. Accessed
September 17 from: http://www.theguardian.com/world/2007/may/17/topstories3.russia.
- United Nations. (2013). Developments in the
Field of Information and Telecommunications in the Context of International
Security. Accessed September 16, 2013 from: http://www.un.org/disarmament/topics/informationsecurity/.
Vijayan, J. (2012).
Government role in Stuxnet could increase attcks against US firms.
Computerworld. June 2012. Accessed September 19, 2013 from: http://www.computerworld.com/s/article/9227696/Government_role_in_Stuxnet_could_increase_attacks_against_U.S._firms?pageNumber=1.
(The above article was published in Seminar, October 2013. It is available at: http://www.india-seminar.com/2013/650/650_rajendra_kumar.htm).
Ideas That Make You Think And Do 