VAR Panchayat

Creating One Mn Cyber Security Experts

by VARINDIA 2017-04-11

India needs to jointly create an India-Cyber Security Industry Framework (I-CSIF), defining the operating rules/defining design principles to cover all 50 cybersecurity control points to achieve one million cybersecurity experts

The NASSCOM–DSCI report has put forward an ambitious target to achieve close-to 1 million cybersecurity professionals in India and around 1,000 cybersecurity product-based start-ups in the next eight years. Industry estimates indicate that there are about 62,000 cybersecurity professionals in India and, going by simple mathematics, there is a need to add almost 1.2 lakh cybersecurity professionals every year. So, the big question is where do we get started?

When one talks about cybersecurity professionals, it includes everyone from a fresher with an M.Tech in cybersecurity degree to a seasoned professional with over 20 years of experience. The estimate of one million professionals does not specify the demand of various skill levels of IT professionals. The industry requires professionals of different competency levels. There is a need for entry-level IT security professionals as much as risk assessment officers and CISOs. There is a need to divide the multitude of one million into various categories and tweak skill development programs accordingly, to meet the existing workforce shortage. Since the responsibilities of a network administrator are different from those of a CISO, so should be their skillsets and hence their training.

Various technical institutes have been running legacy courses on cybersecurity for a long time and playing their part. Despite this, there is a lack of cybersecurity awareness in the country, even amongst the technocrats and policymakers of the country. There is a need to start considering “Basic Cyber Security Awareness” as mandatory exposure, rather than a course curriculum for only those with the need for technical jobs. Over 462 million, i.e. over 35 per cent people of our country use internet and internet-based services. It is essential that they should be educated too on “Basic Cyber Security Awareness” so that they do not lose their hard-earned money to frauds, in the best case scenario and do not fall victim to data theft and identity frauds at worse.

Coming back to the initial point of discussion, the huge requirement of cybersecurity professionals cannot be met unless the industry and academic stakeholders make active and coordinated efforts towards an India-specific model for the same, particularly so because the scale and magnitude of the numbers of people to be touched is more than the rest of the world have ever seen, barring China.

As has been our experience during the history of technology adoption particularly in national security aspects, indigenous solutions are our best hope. Hence, there is a need for creating a customized version of cybersecurity training module catering to the Indian scenario. The place to start is a national public-private initiative on basic cybersecurity awareness and let the commercial industry deal with the higher level needs.

What Next?

The rate of cybercrime has risen more 300 per cent during the past five years. CERT-In itself has registered about 50,000 cybercrime incidents in the past year. Cybercrime is a problem which will increase manifold, unless acted upon. There is also an urgent need to protect ourselves against espionage launched by state-sponsored intruders and cybercriminals. Reports state that, till March 2016, about 8,000 websites were hacked in India.

Currently, there is a need for increased participation of stakeholders in developing standards, norms and regulations that are our own and thereby ensure a free and fair market to domestic players. Over the past few months, there have been several allegations regarding backdoors and malwares present in various foreign IT products. We need to reduce sensitive data flow outside the country.

The fact that India is the biggest contributor to the bug bounty program of Bugcrowd shows the potential India has. Indians have dominated the IT market and we can dominate the cybersecurity domain. We just need to provide more focus on the same. Even the government has launched projects in the form of CERT-In and ISEA to promote skill development in this sector. As was mentioned earlier, it is imperative that the industry and academia work in sync with government and DSCI to achieve the target. India needs to jointly create an India-Cyber Security Industry Framework (I-CSIF) defining the operating rules/ defining design principles to cover all 50 cybersecurity control points that cover a generic cybersecurity model.

We need focus on basic cybersecurity awareness in hyper scaled industry initiative on PPP mode as a national mission and we need to immediately enshrine the cybersecurity control framework (Indian standards) as a national policy and both must harness the large technical and deep cybersecurity skills base in India’s young start-up and technical ecosystem and not be solely determined by the commercial interests of global tech companies only.