Relevance: GS-3: Challenges to internal security through communication networks, basics of cyber security.

Key Phrases: Ransomware Attacks, Cyber Security, Social Engineering Techniques, Hackers, Critical Data, Malware, Phishing, Ransomware, Denial Of Service, Strict Regulation, Security Loopholes, Exploitable Layers of security, National Cyber Security Strategy 2020, Cyber Swachhta Kendra, Cyber Surakshit Bharat Programme.

Why in News?

• According to Sophos study, the average ransom payouts by Indian organisations to hackers at $1.19 m.

Context:

• The number of ransomware attacks has gone up to 78 per cent in India in 2021, from 68 per cent in the previous year. This is the highest rate of ransom payment reported across all 31 countries surveyed by cyber security solutions firm Sophos for the State of Ransomware 2022 report.
• The average ransom paid by Indian organisations stood at $1.19 million, with 10 per cent of the victims ending up paying ransom of $1 million or more. About 78 per cent of the organisations had paid the ransom to get their data back, according to the report.
• After gaining access to the computer networks in an organisation using social engineering techniques, hackers steal critical data and block access to it. They demand ransom from the victims to unblock access. They also threaten to publish the data on online platforms if ransom is not paid.

Why India Turns Happy Hunting Ground For Hackers?

• Indian digital space not driven by strict regulation as compared to other foreign countries like USA, Europe and Canada. It becomes comparatively an easier task for attackers to exploit security loopholes against exposed network devices and addresses.
• India’s cyber footprint is huge, to say the least. This adds to the probability of getting hacked too. And when it comes to phishing attacks, cyber awareness and cyber hygiene are indispensable in maintaining a strong defensive posture against attacks of this kind.
• There are several reasons why companies often find themselves in troubled waters like when they keep their databases behind single, exploitable layers of security, and do not have enough measures in place to prevent a breach.
• When customers/employees start accessing enterprise resources from unsecured networks or personal devices, it puts the entire network at risk. In most cases, the point of entry / access is the target and once credentials are stolen, the chances of protecting the data is very low as the intent of cyber-attack may vary from espionage, stealing IP or just ransomware.
• Since the pandemic has driven institutions and individuals to expose their applications, devices and data over the internet to collaborate, this has resulted in an opportunity for cyber threats.

Cyber Insurance Solutions:

• There are cyber insurance solutions available in the market to protect against losses caused by cyber attacks, including first-party and third-party losses, and cyber extortion.
• First-party insurance covers loss caused due to electronic theft, loss of electronic communication, e-vandalism, business interruption (income loss due to fraudulent access causing impairment of operations), and the like.
• Third-party loss covers disclosure liability (any customer claim due to system security failures resulting in unauthorised access), content liability (for alleged copyright infringement), reputational liability, and conduit liability. An expenses cover includes privacy notification expenses, crisis expenses and reward expenses.
• A few insurers even provide cover for proactive forensic services in a possible threat situation. Companies should first understand the need for cyber insurance solutions, rather than just getting a cyber-insurance cover.
• Interestingly, cyber insurance had come to the rescue of some organisations that are well covered. About 89 per cent of the mid-sized organisations had cyber insurance. And, in 100 per cent of incidents, the insurer paid some or all the costs incurred.

Way Forward:

• Nations and institutions, instead of waiting for the ‘Big Bang cyber-attack’, should actively prepare for a rash of cyber-attacks , essentially ransomware. The emphasis should be on prioritising the defence of data above everything else.
• Consequently, law enforcement agencies would need to play a vital role in providing effective defence against cyber-attacks.

Source: The Hindu BL

Mains Question:

Q. What are social engineering techniques? Why has India turned into a happy hunting ground for hackers? What measures are needed to build an effective defence against cyber-attacks? Examine. (250 words).