VAR Panchayat

Digital India, Resilient India

by VARINDIA 2017-03-28

we need to consider security and privacy at the time of designing system architecture

Rapid adoption and diffusion of Information and Communication Technology (ICT) can play a significant role in India’s quest for inclusive and equitable development as envisaged under the government’s ambitious Digital India program. However, with increasing use of technology in almost all aspects of human endeavor and the hyper-connectivity also exposes the devices, networks and the information to malicious actions resulting in denial, diversion, disruption and even destruction of vital services. This can even impede day-to-day lives and well-being, considering that the Internet of Things (IoT) is now a reality whether it is a power grid or autonomous cars or the underlying sensor networks for a Smart City.

Just like the physical world, the cyber security has to be continuously evaluated with respect to the risk assessment and planned and executed in a holistic manner. Ever since the Prime Minister’s clarion call to focus on cyber security on the occasion of silver jubilee of NASSCOM on March 1, 2015 he has been reiterating the crucial role of cyber security both within the country and abroad.

Ground Realities

According to Symantec’s 2016 Internet Security Threat Report (ISTR) , despite extremely low level of ICT penetration India was the third largest source of malicious activity globally and accounted for every sixth social media scam besides seeing an incidence of a ransomware every four minutes! At the same time, 2016 Norton Cyber Security Insights Report showed that while 40% Indian parents allowed their children to access the Internet before age 11, 54% also felt feel that the children were more likely to be bullied online than on a playground.

Post-demonetization, there is an accelerated growth in digital payments especially through mobile devices. Unsurprisingly, the Union Budget for 2017-18presented on February 1, 2017 proposes to set up a dedicated Computer Emergency Response Team (CERT) for financial services in response to the recommendation in the Economic Survey for 2016-17 presented on the preceding day that cyber- security must be strengthened considerably to increase trust in digital payments.

Resilience – The Holy Grail

It is a Utopian thought that risks due to cyber security threats can be totally eliminated; their impact can definitely be mitigated or softened if we focus on resilience. This is very well brought out in the cybersecurity framework developed by the National Institute of Standards and Technology through the five step process, viz. Identify, Protect, Detect, Respond and Recover.

Comprehensive And Consistent Policy Framework

National Cyber Security Policy 2013 lays out the key priorities and the Information Technology Act is the principal legislation for cyber security. These are not sufficient by themselves; India also needs specific legislation on privacy and data protection as well as for critical infrastructure protection.

Security By Design

First and foremost, we need to consider security and privacy at the time of designing system architecture as well as developing and deploying products and services. Since cyber security is contextual and one-size-doesn’t-fit-all, the legislation should mandate a risk-based approach and define specific outcomes (such as the ability to detect and contain a breach) without mandating or prescribing how to go about it.

Let’s Put Our Money Where Our Mouth Is

Cyber security needs continuous and massive investment in terms of technology deployment, people training and process improvement. However, due to none or nominal allocations several projects remain extremely vulnerable. Hence, we should set aside 8 percent of the every digitalization project of the government exclusively for cyber security like Singapore.

Public Private Partnership

As the majority of technical development and deployment is in the private sector, public private partnership is a sine qua non for effectively dealing with the cyber security threats. While the private sector can share best practices, public sector can provide the overarching policy framework. It is crucial to design these partnerships on voluntary basis where both parties find mutual benefit in collaboration and cooperation. The US-India framework for cyber security cooperation , the first of its kind for both the countries, also stresses this point.

World-Class Cyber Security Workforce

The roadmap for cyber security released recently by NASSCOM projects the need for one million cyber security professionals by 2025 doubling the even as the National cyber security policy 2013 projection of half a million by 2018. As the cyber security leader, Symantec has partnered with NASSCOM in this direction and supported development of courseware for five job roles besides instituting scholarship for 1,000 women who get certified as cyber security professionals by NASSCOM.

Cyber Literacy

We should inculcate cyber literacy and hygiene to one and all, going beyond the functional, digital and financial literacy. After all, empowered users are and should be the first level of defense. Protection is Better Than Cure, Indeed!