Declare a cyber security emergency
December 21, 2020, 11:13 PM IST
Quick takes, analyses and macro-level views on all contemporary economic, financial and political events.
Around 50 organisations, including important departments of the US government, such as Treasury, State and Homeland Security, have been hacked, and for nearly nine months, without these departments or their cyber guardians being aware of the transgress. What does this mean for India and its defences against foreign attackers? Cybersecurity must go right up to the top of national security, and shoring it up taken up on an emergency basis.
The sophisticated attack that has allowed large-scale data transfer from American government agencies, including the one that manages its nuclear arsenal, possibly to a foreign government, was managed through third-party software. Orion is a network management tool, developed and supplied by the software company SolarWinds, and the hackers embedded their piece of malware in an upgrade to Orion, which its users accepted and ran on their systems, with nary a suspicion of foul play. What this means is that software from well-trusted sources can be the medium for implanting Trojans in the target system. Our cybersecurity managers can take no piece of software from any company for granted. Everything is suspect, until tested and verified to be kosher. As India increasingly goes digital, our financial systems, the tax database, the dematerialised accounts in which shares are held, just about everything becomes vulnerable to cyberattacks. The enemy need not confront us with their troops or missiles or submarines: just some hanky-panky that wipes out records of share ownership or destroys the Goods and Services Tax Network and its database would.