Cyber Security Questions for UPSC CSE

India's Cybersecurity Policy Framework

India adopted the National Cybersecurity Strategy (NCS) 2020 to protect critical information infrastructure and promote digital trust. The strategy operates on three pillars: secure cyberspace, build cyber resilience, and enable cyber capacity. The National Critical Information Infrastructure Protection Centre (NCIIPC) under NSA oversees protection of critical sectors like power, banking, telecom, and water. India also established the Indian Computer Emergency Response Team (CERT-In) under MeitY to detect, prevent, and respond to cyber incidents. The Information Technology Act 2000 (amended 2008) forms the legal backbone, with Section 66 covering hacking, Section 67 for obscene content, and Section 72 for data breach.

• NCS 2020 aims to create secure, resilient, and trustworthy cyberspace by 2025
• NCIIPC protects 11 critical sectors: power, telecom, banking, defense, space, nuclear, water, gas, health, transport, and government
• CERT-In is nodal agency for cyber incident response and vulnerability management
• IT Act 2000 Section 66 (hacking), 67 (obscene content), 72 (data breach) are key penal provisions
• Data Protection Bill 2023 (now Digital Personal Data Protection Act 2023) regulates personal data processing
• Cyber Surakshita Bharat initiative focuses on awareness and capacity building

Major Cyber Threats & Attack Vectors

India faces diverse cyber threats ranging from state-sponsored attacks to cybercriminals and hacktivists. Ransomware attacks on hospitals, banks, and government offices have increased sharply post-2020. Phishing, malware, DDoS attacks, and supply chain compromises are common. Recent incidents include attacks on All India Institute of Medical Sciences (AIIMS), Indian Railways, and stock exchanges. Advanced Persistent Threats (APTs) from neighboring countries and non-state actors target defense and critical infrastructure. Social engineering exploits human psychology, making employee training crucial. Zero-day vulnerabilities in software create windows of exposure before patches are available.

• Ransomware: encrypts data and demands payment; AIIMS Delhi (2021), AIIMS Rajendra Nagar (2022) were major incidents
• Phishing: fraudulent emails/SMS impersonating trusted entities to steal credentials
• DDoS (Distributed Denial of Service): floods servers with traffic to disable services
• APTs: sophisticated, long-term campaigns by state or organized groups targeting specific sectors
• Supply chain attacks: compromising software/hardware before delivery to end users
• Social engineering: manipulating humans to divulge sensitive information or bypass security

Cybersecurity in Critical Infrastructure & Digital India

Critical infrastructure sectors (power grids, banking, telecom, railways) are prime targets because disruption affects millions. India's Digital India mission accelerates digitalization, expanding the attack surface. The government mandates cybersecurity audits, incident reporting to CERT-In, and adoption of international standards like ISO 27001. The National e-Governance Plan (NeGP) requires secure digital service delivery. Banks follow RBI guidelines on cybersecurity, including multi-factor authentication and encryption. Railways, airports, and power utilities implement Operational Technology (OT) security alongside IT security. However, legacy systems, skill gaps, and budget constraints hamper implementation in many agencies.

• Critical Infrastructure Protection: NCIIPC coordinates defense of 11 vital sectors
• Mandatory incident reporting: all agencies must report cyber incidents to CERT-In within 6 hours
• RBI cybersecurity framework: covers banks, payment systems, and financial infrastructure
• ISO 27001 compliance: information security management standard adopted by government agencies
• OT security: operational technology in power plants, dams, railways requires air-gapped or isolated networks
• Digital India challenges: rapid digitalization without commensurate security investment creates vulnerabilities

India's Cyber Diplomacy & International Cooperation

India participates in multilateral cybersecurity forums like UN Group of Governmental Experts (GGE), Shanghai Cooperation Organization (SCO), and BRICS. India advocates for international norms on cyber warfare, attribution standards, and protection of civilians in cyberspace. Bilateral cooperation with countries like USA, Israel, and Japan includes intelligence sharing and joint exercises. India signed the Budapest Convention on Cybercrime (2023), aligning with global standards on cross-border cyber crime investigation. However, India maintains strategic autonomy and opposes unilateral sanctions based on unproven cyber attribution. The government also promotes indigenous cybersecurity products and startups to reduce dependency on foreign solutions.

• UN GGE: India supports international norms on responsible state behavior in cyberspace
• SCO & BRICS: regional cooperation on cybersecurity capacity building and threat intelligence
• Budapest Convention: India's accession improves cross-border investigation of cybercriminals
• Bilateral partnerships: USA (CISA), Israel (cyber intelligence), Japan (capacity building)
• Attribution challenges: India emphasizes need for transparent, evidence-based attribution before sanctions
• Make in India for cybersecurity: government promotes domestic startups and products to reduce foreign dependency

Emerging Threats: AI, IoT, Cloud & Quantum Computing

As India adopts AI, IoT, and cloud technologies, new vulnerabilities emerge. AI systems can be poisoned with malicious training data or used to automate attacks. IoT devices (smart meters, cameras, sensors) often lack security updates, creating botnets. Cloud migration concentrates data, making it an attractive target. Quantum computing threatens current encryption standards, necessitating quantum-resistant cryptography. India's National AI Strategy and cloud adoption roadmap must integrate cybersecurity from design phase. The government is exploring quantum-safe cryptography and post-quantum standards. Blockchain is being explored for secure digital identity (e-KYC) and supply chain transparency.

• AI threats: adversarial attacks, model poisoning, automated large-scale attacks
• IoT security: billions of connected devices with weak authentication and unpatched vulnerabilities
• Cloud risks: data concentration, insider threats, misconfiguration, multi-tenancy issues
• Quantum computing: will break RSA and ECC encryption; India exploring quantum-resistant algorithms
• Blockchain: potential for secure identity, smart contracts, but immutability creates challenges for data deletion
• 5G security: new attack surface with network slicing and edge computing

• Confusing CERT-In (incident response) with NCIIPC (critical infrastructure protection) — they have different mandates
• Assuming IT Act 2000 Section 66 covers all cyber crimes — it specifically targets hacking/unauthorized access, not all offenses
• Thinking cybersecurity is only IT department's job — it requires organizational culture, training, and executive commitment
• Overlooking human/social engineering as a vector — most breaches start with phishing or insider threats, not technical exploits
• Believing India's accession to Budapest Convention means full harmonization with Western cyber norms — India maintains strategic autonomy on attribution and sanctions

• NCS 2020 = 3 Pillars: Secure, Resilient, Enable (SRE) — think of building a fortress: walls (secure), repair capacity (resilient), trained guards (enable)
• CERT-In vs NCIIPC: CERT = Emergency Response Team (like ambulance), NCIIPC = Critical Infrastructure Protection (like fort guards)
• IT Act Sections: 66 (hacking), 67 (obscene), 72 (data breach) — remember as 66-67-72 ascending severity
• Critical Sectors = 11: Power, Telecom, Banking, Defense, Space, Nuclear, Water, Gas, Health, Transport, Government — mnemonic PTBDSNWGHTS (Power-Telecom-Banking-Defense-Space-Nuclear-Water-Gas-Health-Transport-State)
• Cyber Threats = PRAMS: Phishing, Ransomware, APTs, Malware, Social engineering — covers 80% of real incidents

• Prelims: Expect 1-2 MCQs on NCS 2020 pillars, CERT-In's role, or recent ransomware incidents (AIIMS, Railways). Factual recall questions.
• Mains GS-III: 10-15 mark questions on 'India's cybersecurity challenges and policy response' or 'critical infrastructure protection.' Requires analysis of gaps between policy and implementation.
• Current affairs angle: Recent AIIMS ransomware attacks, RBI guidelines on digital payments security, India's stance on cyber attribution at UN GGE — these are hot topics.
• Data Protection Act 2023: New topic gaining weight; expect questions on consent, data principal rights, and data fiduciary obligations.
• Case study approach: Be ready to discuss real incidents (AIIMS, stock exchange attacks, telecom breaches) to illustrate policy failures and lessons learned.
• Avoid generic answers: Don't just list threats; connect to India's specific context (legacy systems, skill gaps, geopolitical tensions with Pakistan/China).