Cybersecurity — Revision Notes

⚡ 30-Second Revision

IT Act 2000: Primary cyber law in India.
IT Act 2008: Major amendments, introduced cyber terrorism (Sec 66F).
CERT-In: National nodal agency for cyber incidents (Sec 70B IT Act).
NCIIPC: Protects Critical Information Infrastructure (Sec 70A IT Act).
DPDP Act 2023: India's data protection law, mandates security safeguards.
Article 21: Right to Privacy (Puttaswamy judgment) linked to digital privacy.
CIA Triad: Confidentiality, Integrity, Availability – core cybersecurity principles.
Malware: Malicious software (viruses, worms, ransomware).
Phishing: Social engineering via deceptive communication.
Ransomware: Encrypts data, demands payment.
APT: Advanced Persistent Threat, sophisticated, long-term attack.
NIST CSF: Identify, Protect, Detect, Respond, Recover (5 functions).
ISO 27001: International standard for Information Security Management System (ISMS).
Symmetric Cryptography: Single key (e.g., AES).
Asymmetric Cryptography: Public/private key pair (e.g., RSA, ECC).
Hashing: One-way function for data integrity (e.g., SHA-256).
PKI: Public Key Infrastructure, manages digital certificates.
TLS/SSL: Secures web communication (HTTPS).
SSH: Secure remote access protocol.
IPSec: Secures IP communications.
SOC: Security Operations Center, monitors and responds to incidents.
Cyber Warfare: State-sponsored attacks (espionage, sabotage).
Cyber Surakshit Bharat: Capacity building initiative.
RBI Cyber Guidelines: For banks and financial institutions.
SEBI Cyber Resilience: For market intermediaries.
TRAI Security Guidelines: For telecom service providers.
Budapest Convention: International treaty on cybercrime (India not ratified).
UN GGE: Discusses norms of state behavior in cyberspace.
AIIMS Cyberattack (2022): Major incident on healthcare CII.
Zero Trust: 'Never trust, always verify' security model.
Supply Chain Attack: Targeting third-party vendors.
Deepfakes: AI-generated fake media, used in fraud.
Quantum Computing: Future threat to current encryption.
Section 66A IT Act: Struck down by Shreya Singhal judgment (freedom of speech).
Data Fiduciary: Entity processing personal data (DPDP Act).
Data Principal: Individual whose data is processed (DPDP Act).
Cyber Espionage: Stealing state/corporate secrets.
Cyber Sabotage: Disrupting critical systems.
Attribution: Identifying cyberattack perpetrators, often difficult.
Digital India: Initiatives requiring robust cybersecurity.
ICET: India-US Initiative on Critical and Emerging Technologies.
G20: Forum for international cyber cooperation.
MeitY: Ministry of Electronics and Information Technology, nodal ministry for cyber policy.
Cyber Deterrence: Preventing attacks through threat of retaliation.

2-Minute Revision

Cybersecurity is the defense of digital assets (systems, networks, data) from threats, ensuring Confidentiality, Integrity, and Availability (CIA). India's legal backbone is the IT Act 2000 (amended 2008), defining cybercrimes and establishing CERT-In (incident response) and NCIIPC (Critical Information Infrastructure protection).

The new Digital Personal Data Protection Act, 2023, significantly strengthens data privacy, mandating security safeguards and breach notifications, aligning with the constitutional Right to Privacy (Article 21, Puttaswamy judgment).

The threat landscape is dynamic, encompassing malware (ransomware, APTs), phishing, and emerging challenges from AI-powered attacks, supply chain vulnerabilities, IoT, and quantum computing. India's strategy involves institutional strengthening, capacity building (Cyber Surakshit Bharat), and international cooperation (e.

g., with the US through ICET). Frameworks like NIST CSF guide risk management. Understanding these technical, legal, and policy dimensions, along with recent incidents like the AIIMS cyberattack, is crucial for UPSC, emphasizing cybersecurity's role in national security, governance, and digital development.

5-Minute Revision

Cybersecurity is the comprehensive discipline of protecting digital systems, networks, and data from malicious attacks, ensuring the CIA triad: Confidentiality, Integrity, and Availability. This involves a multi-layered defense-in-depth approach, encompassing network security (firewalls, IDS/IPS), endpoint security, application security, and data security (encryption, DLP).

The threat landscape is constantly evolving, featuring traditional threats like malware (viruses, worms, ransomware) and phishing, alongside sophisticated Advanced Persistent Threats (APTs) and emerging challenges from AI-powered attacks (deepfakes, automated phishing), supply chain vulnerabilities, IoT device insecurities, and the long-term threat of quantum computing to current cryptography.

India's cybersecurity architecture is built upon the Information Technology Act, 2000 (amended 2008), which defines various cybercrimes (e.g., hacking, cyber terrorism under Section 66F) and establishes key institutions.

CERT-In (Indian Computer Emergency Response Team) is the national nodal agency for incident response, issuing advisories and coordinating responses. NCIIPC (National Critical Information Infrastructure Protection Centre) is mandated to protect vital national assets across sectors like power, banking, and telecom.

The National Cyber Security Strategy (draft 2020) aims for a secure cyberspace, complemented by initiatives like Cyber Surakshit Bharat for capacity building and sectoral guidelines from RBI, SEBI, and TRAI.

A pivotal development is the Digital Personal Data Protection Act, 2023, which operationalizes the constitutional Right to Privacy (Article 21, Puttaswamy judgment) by mandating robust security safeguards for personal data, breach notification, and establishing a Data Protection Board.

Internationally, India engages in bilateral dialogues (e.g., ICET with the US) and multilateral forums (G20, UN GGE) to foster cooperation, despite not ratifying the Budapest Convention. Recent incidents like the AIIMS cyberattack (2022) underscore the persistent threats to critical infrastructure.

For UPSC, it's essential to analyze the interplay between technology, law, policy, and international relations, understanding how cybersecurity underpins national security, governance, and the success of Digital India initiatives, while critically assessing implementation gaps and suggesting forward-looking measures.

Prelims Revision Notes

1
IT Act 2000 & Amendments — Foundational law. 2008 amendments introduced Sec 66F (cyber terrorism), Sec 43A (data protection). Sec 66A struck down (Shreya Singhal case). Sec 79 (intermediary liability). Sec 70A (NCIIPC), Sec 70B (CERT-In).
2
DPDP Act 2023 — Replaced PDP Bill. Defines Data Fiduciary, Data Principal. Mandates 'reasonable security safeguards', breach notification to Data Protection Board & Data Principals. Penalties for non-compliance.
3
Constitutional Link — Article 21 (Right to Privacy) affirmed in K.S. Puttaswamy vs Union of India (2017) is the basis for data protection.
4
Key Institutions

* CERT-In: Nodal agency for cyber incidents, advisories, alerts. * NCIIPC: Protects Critical Information Infrastructure (CII) – power, banking, telecom, transport, govt, strategic. * MeitY: Nodal ministry for cyber policy. * Cyber Surakshit Bharat: Capacity building for CISOs.

1
Threats

* Malware: Viruses, Worms, Trojans, Ransomware (encrypts data), Spyware, Rootkits. * Phishing: Social engineering via fake emails/messages. * APTs: Advanced Persistent Threats (state-sponsored, long-term). * Emerging: AI-powered attacks (deepfakes), Supply Chain attacks (SolarWinds), IoT/5G vulnerabilities, Quantum threats.

1
Concepts

* CIA Triad: Confidentiality, Integrity, Availability. * Cryptography: Symmetric (AES), Asymmetric (RSA, PKI), Hashing (SHA-256). * Network Security: Firewalls, IDS/IPS, VPN, TLS/SSL, SSH, IPSec. * Zero Trust: 'Never trust, always verify' model.

1
Frameworks

* NIST CSF: Identify, Protect, Detect, Respond, Recover. * ISO 27001: ISMS standard.

1
International

* Budapest Convention: India not ratified. * UN GGE: Norms of state behavior. * ICET: India-US tech cooperation.

1
Recent Incidents — AIIMS Delhi cyberattack (Nov 2022) on healthcare CII. CERT-In advisories on ransomware (LockBit, BlackCat) and AI threats (2023-24).

Mains Revision Notes

1
Cybersecurity as a Governance Challenge

* Legal Framework: IT Act (evolution, sections, amendments), DPDP Act (rights, obligations, enforcement), Constitutional Right to Privacy (Puttaswamy). * Institutional Framework: Roles of CERT-In, NCIIPC, MeitY, Defence Cyber Agency. Effectiveness, coordination challenges. * Policy Gaps: Need for unified National Cyber Security Strategy (final version), dedicated CII law, clarity on cyber warfare doctrine.

1
Evolving Threat Landscape & Impact

* Threats: APTs (state-sponsored), Ransomware (double extortion), Supply Chain attacks, AI-powered attacks (deepfakes, automated phishing), IoT/5G vulnerabilities, Quantum cryptography threats. * Impact: National security (cyber warfare, espionage), economic stability (financial fraud, IP theft), critical infrastructure disruption, data breaches, privacy violations.

1
India's Preparedness & Challenges

* Strengths: Statutory bodies, policy initiatives (Cyber Surakshit Bharat), growing awareness, international dialogues. * Weaknesses: Skill gap, technological asymmetry, dependence on foreign tech, attribution challenges, implementation gaps, lack of robust cyber deterrence.

1
Solutions & Way Forward

* Capacity Building: Skill development, public awareness, ethical hacking. * Public-Private Partnership: Collaborative threat intelligence sharing, incident response. * R&D: Indigenous technology development, post-quantum cryptography.

* International Cooperation: Bilateral agreements, multilateral forums for norms and law enforcement. * Legal Reforms: Continuous review of IT Act, clear regulatory frameworks. * Cyber Diplomacy: Proactive engagement in global cyber governance.

1
Inter-linkages — Connect cybersecurity to Digital India, National Security, Fundamental Rights, Emerging Technologies (AI, Quantum), and Economic Development. Emphasize a holistic, multi-stakeholder approach.

Vyyuha Quick Recall

Vyyuha Quick Recall: CYBER-SHIELD Framework

C - Confidentiality, Integrity, Availability (CIA Triad) Y - Yearning for Data Protection (DPDP Act, Article 21) B - Borderless Threats (Cyber warfare, International Cooperation) E - Emerging Technologies (AI, Quantum, IoT risks) R - Regulatory Framework (IT Act, CERT-In, NCIIPC)

S - Supply Chain Security (Vulnerabilities, Mitigation) H - Human Element (Awareness, Training, Phishing) I - Incident Response (SOC, Detection, Recovery) E - Endpoint & Network Security (Firewalls, Encryption, Protocols) L - Legal & Policy Gaps (Implementation, New Laws) D - Defense-in-Depth (Layered Security Approach)