Cybersecurity

1. Foundations and significance

Cybersecurity combines technical controls, organisational processes and user behaviour to protect digital systems. Information security is broader: it also protects information in non-digital forms. Privacy concerns the appropriate collection and use of personal information, whereas cybersecurity concerns protection against threats. A database may be secure against hackers yet violate privacy through excessive collection or unauthorised commercial use.

The confidentiality, integrity and availability triad provides the basic framework. Confidentiality limits access to authorised entities. Integrity ensures that information is not improperly altered. Availability ensures timely access to systems and services. Authentication establishes identity, authorisation determines permitted actions, and accountability makes actions traceable. Non-repudiation provides evidence that helps prevent an entity from denying an action or communication.

A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited. An exploit uses that weakness, while risk reflects the likelihood and consequences of an adverse event. The attack surface includes exposed interfaces, devices, applications and human interactions. Critical information infrastructure comprises computer resources whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety.

• Digitised electricity grids, hospitals, banking systems and transport networks connect cybersecurity with physical safety.
• Cybercrime commonly seeks financial gain; cyber espionage seeks sensitive information; state-linked operations may pursue strategic disruption.

2. Major threats and attack techniques

Malware is malicious software. A virus attaches itself to another file or program and spreads when executed; a worm can replicate across networks without attaching to a host file. A Trojan presents itself as legitimate software. Spyware covertly collects information, while ransomware locks systems or encrypts data and demands payment. Modern ransomware may also steal data and threaten its publication.

Social engineering manipulates people rather than relying exclusively on software flaws. Phishing uses deceptive messages or websites; spear phishing targets particular individuals or organisations. Smishing uses text messages and vishing uses voice communication. Deepfake audio and video can strengthen impersonation scams. In India’s so-called digital arrest frauds, criminals impersonate officials: digital arrest is not a lawful arrest procedure.

A denial-of-service attack exhausts resources to make a service unavailable. Distributed denial-of-service attacks use multiple sources, often compromised devices forming a botnet. Man-in-the-middle attacks intercept or alter communication. SQL injection exploits unsafe handling of database queries; cross-site scripting causes malicious scripts to execute in a user’s browser. Credential stuffing tests previously stolen username-password combinations against other services.

A zero-day vulnerability is a flaw unknown to, or not yet addressed by, the responsible vendor when exploited. Advanced persistent threats involve sustained, targeted access, often for espionage. Supply-chain attacks compromise trusted software updates, libraries or vendors to reach downstream users. Attribution is difficult because attackers can conceal their location or operate through compromised infrastructure.

• An attack need not steal data: destruction, manipulation and service disruption are also cybersecurity incidents.
• Paying ransom does not guarantee data recovery or prevent publication of stolen information.

3. Security technologies and defensive practices

Symmetric encryption uses a shared secret key and is efficient for bulk data protection. Asymmetric cryptography uses mathematically related public and private keys, supporting functions such as secure key establishment and digital signatures. Real systems commonly combine both approaches. HTTPS uses Transport Layer Security to protect communication in transit; it does not prove that a website’s business claims are trustworthy.

A cryptographic hash produces a fixed-length digest and is designed to resist reversal and undetected alteration. Hashing is not encryption because it has no decryption key. Passwords should be stored using salted, purpose-built password-hashing methods rather than plaintext. Digital signatures are generated using a private key and verified using the corresponding public key. Digital certificates bind an identity to a public key through a certification framework.

Multi-factor authentication combines different factor categories: something known, possessed or inherent to the user. Two passwords are not two different factors. Biometrics create additional privacy and revocation challenges because compromised biological characteristics cannot readily be replaced. Least privilege grants only necessary permissions; zero trust rejects automatic trust based merely on a user’s presence inside a network.

Firewalls filter network traffic, intrusion detection systems raise alerts, and intrusion prevention systems can block suspicious activity. Effective defence also requires prompt patching, endpoint protection, network segmentation, secure software development and tested backups. Offline or immutable backups limit ransomware damage. Incident response must preserve evidence while containing the threat and restoring services.

• Defence in depth uses multiple complementary controls rather than depending on one security product.
• End-to-end encryption protects message content between endpoints, but compromised devices and exposed metadata remain risks.

4. India’s institutions, laws and reporting mechanisms

The Information Technology Act, 2000, substantially amended in 2008, is the principal cyber-law framework. Section 43 addresses specified unauthorised acts involving computer resources; Section 66 criminalises such acts when committed dishonestly or fraudulently. Sections 66C and 66D concern identity theft and cheating by personation using computer resources. Section 66F addresses cyberterrorism. Section 66A was struck down by the Supreme Court in Shreya Singhal v. Union of India in 2015.

The Indian Computer Emergency Response Team, CERT-In, operates under the Ministry of Electronics and Information Technology. It issues alerts, coordinates incident response and undertakes cybersecurity-related functions under Section 70B. Its April 2022 directions require specified entities to report listed cyber incidents within six hours of noticing them or being informed of them. They also require secure retention of ICT-system logs for a rolling 180 days within India.

The National Critical Information Infrastructure Protection Centre, NCIIPC, functions under the National Technical Research Organisation and is the national nodal agency for critical information infrastructure protection. Section 70 separately enables designation of protected systems. The Indian Cyber Crime Coordination Centre, I4C, under the Ministry of Home Affairs, supports coordination against cybercrime. Police and law-enforcement agencies investigate offences; CERT-In is not a substitute for criminal investigation.

The National Cyber Security Policy, 2013, outlines objectives for a secure cyber ecosystem. The Digital Personal Data Protection Act, 2023, establishes a framework for digital personal data, including security safeguards and breach-related obligations; operational applicability depends on commencement notifications and relevant rules. Cyber Swachhta Kendra provides botnet-cleaning and malware-analysis support. Prompt reporting of financial fraud through 1930 and cybercrime.gov.in can improve prospects of intercepting funds.

5. Frontier technologies and strategic challenges

Internet of Things devices enlarge the attack surface through weak default credentials, limited update support and continuous connectivity. Operational technology controlling physical processes requires special attention to safety and availability. Cloud computing follows a shared-responsibility model: providers secure certain infrastructure layers, while customers retain responsibilities that vary by service, including identity management and configuration.

Artificial intelligence can assist threat detection but also automate phishing and malicious code generation. AI systems themselves face data poisoning, adversarial inputs and information leakage. Blockchains can make records tamper-evident under their operating assumptions, but private-key theft, vulnerable smart contracts and compromised exchanges remain possible. Decentralisation does not automatically ensure security.

Sufficiently powerful quantum computers could threaten widely used public-key systems such as RSA and elliptic-curve cryptography. Post-quantum cryptography develops algorithms intended to resist both classical and quantum attacks; it is distinct from quantum key distribution. India’s priorities include resilient public infrastructure, skilled personnel, secure procurement, international cooperation and accessible public awareness.

Previous year questions

No source-linked PYQ is available here yet. Use the practice questions below.

Practice questions