Deccan Despatch (January - April 2010) - CII

Banking, Military, Telecom, Transport,Nuclear Fuel, Health etc. The IT Actwhere cyber terrorism is explained in Sec66 F (1) of IT Act 2009 which mentionsabout the punishment for cyber terrorismis life imprisonment under Section 66 F(2) of the same Act.The tools of the cyber terrorism are:Hacking; War Dialing; IP spoofing;Viruses; Worms; DOS; DDOS; Trojans;Phreaking; Phishing. China based cyberterrorists have recently attacked Indiandefence and security establishments;Indian diplomatic missions; railwaynetwork, media houses, Times of India &commercial organisations.Individuals and firms MUST adopt safecyber practices – education & awareness.Greater co-operation and Intelligencesharing amongst nations are needed.Greater Govt-Private Sector co-operation,deterrent laws, cyber security audit ofcritical Infrastructure, creation of nodalagency in each country for monitoringand responding to cyber terrorism, R & Din technology to prevent anonymity andincrease Security, co-ordination betweenhardware & software firms should betaken into consideration.Top management of industries mustconsider cyber security as an integraland critical part of their job profile. Theyhave to develop, deploy and enforcecyber security policy to prevent damageto its critical systems. Managementshould conduct periodic cyber securityrisk evaluation. Management shouldacquire and deploy enterprise widesecurity architecture. They should investin acquiring, training and retaining inhouse talent for safe guarding criticalsystems. Management should establishenterprise wide access control systemswith varying user privileges and logs.Management should also developand deploy contingency planning anddisaster recovery.The future of cyber security is in termsof future hackers will be specialized,smart, intelligent and above all wellfunded.The hacking is provided asservice - money will be the motive forcyber attacks, future cyber attacks willbe highly targeted, well planned andfocused and people element will beexploited more and more. There must bea mechanism of monitoring hackers. Theindustries must follow the principles likeSecurity as a ‘forethought out’ process.Cyber War : The EmergingSecurity Challengesin the 21st CenturyIntelligence agencies must share dataand processed information with otheragencies. Regular Cyber Warfarecovers low intensity attacks on keyinstallations; virus & worm attacks needto be monitored.Guerilla warfare covers using specificvulnerability on target to cause damageto target. Use of attack from one countryto hit at another country, the result istraced back not to the actual attacker butto the country specific.The cyber crime threats, particularlyin phishing and identity online fraudsare increasing. Cyber challenges arecommon to all countries in the world butit is the readiness to protect and preventthat makes the difference.The stakes in security are reputation -negative public attention; loss of futurebusiness, intellectual property - exposureof company secrets, loss of productivity;decrease in stock value, customers’ andpartners’ privacy.CYBER SECURITY - RECOMMENDATIONSThis Article on cyber security seeks to crystallize the essence of discussions recorded duringthe Conference on Cyber Security to develop a set of recommendations that would need to beimplemented among industry, government, other agencies & citizens.I. RECOMMENDATIONSTO THEGOVERNMENTGovernment levelinitiatives / policy changes• The government has to take initiativesto create awareness about cybercrimes through policy initiatives.• The government should direct theprivate sector companies to undertakepublic awareness programs as a partof the CSR initiatives.• Companies should be mandatedto undertake employee training oncyber law awareness.• The coverage and definitions ofcyber law are barely in tune with thepresent day scenario - they should bebrought up to the current situationon a war footing.• The Ministry of InformationTechnology, through CERT-INshould send an advisory to all ISPsto undertake mandatory publicCSR initiatives towards buildingawareness of cyber crimes in thecommunity.• Schools and colleges should beadvised to include some aspectof cyber crime awareness in thecurriculum.• ISPs must be mandated to ensurethat every internet account holdertakes up a cyber law awareness quiz37