Context: The government has warned against a large-scale cyber-attack against individuals and businesses, where attackers may use Covid-19 as bait to steal personal and financial information. India’s cyber security nodal agency, CERT-In has issued an advisory warning that the potential phishing attacks could impersonate government agencies, departments and trade bodies that have been tasked to oversee the disbursement of government fiscal aid. The attackers are expected to send malicious emails under the pretext of local authorities that are in charge of dispensing government-funded Covid-19 support initiatives. The advisory noted that the "malicious actors" are claiming to have 2 million email IDs and are planning to send emails with the subject line: free Covid-19 testing for all residents of Delhi, Mumbai, Hyderabad, Chennai and Ahmedabad in a bid to coax users to disclose personal information. 
About Phishing

• It is a kind of fraudulent attempt that is made through email, to capture personal and financial information.
• Perpetrator sends e-mail that seems to come from well known and trustworthy address ask for your financial information such as bank name, credit card number, social security number, account number or password.
• It is common for phishing attempts that e-mails appear to come from sites and companies that do not even have a bank account.

Issue

• Millions of Indians could be targeted by fake emails, social media posts or texts messages related to Covid-19 in order to steal their credentials or compromise their computers.
• "Such emails are designed to drive recipients towards fake websites where they are deceived into downloading malicious files or entering personal and financial information,
• "It has been reported that these malicious actors are planning to spoof or create fake email IDs impersonating various authorities.

Current Scenario

• Recently, India’s official cybersecurity agency Cert-IN citing a report from independent researchers who said the attack is being planned by North Korea-based cyber criminals.
• India's cybersecurity nodal agency, CERT-In has issued an advisory warning that the potential phishing attacks could impersonate government agencies, departments, and trade bodies that have been tasked to oversee the disbursement of government fiscal aid.
• The mails could be sent through spoofed addresses – one of the addresses it could be from is ncov@gov.in – and could include links or files that can deliver malicious code.
• Such campaigns usually have a financial motive since access to a person’s email account or their computers in entirety could allow the cybercriminals to break into people’s bank accounts.
• The campaign was also planning to target people in US, UK, Japan, Singapore and South Korea.

Components of Cyber Security

• Application Security: It encompasses measures or counter-measures that are taken during an application’s development process to protect it from threats that can come through flaws in the app design, development, deployment, upgrade or maintenance.
• Information security: It is related to the protection of information from an unauthorized access to avoid identity theft and to protect privacy.
• Network Security: It includes activities to protect the usability, reliability, integrity and safety of the network.
• Disaster Recovery Planning: It is a process that includes performing risk assessment, establishing priorities, developing recovery strategies in case of an attack.

Need for Cyber Security

• For Individuals: Photos, videos and other personal information shared by an individual on social networking sites can be inappropriately used by others, leading to serious and even life-threatening incidents.
• For Business Organizations: Companies have a lot of data and information on their systems. A cyber attack may lead to loss of competitive information (such as patents or original work), loss of employees/customers private data resulting into complete loss of public trust on the integrity of the organization.
• For Government: A local, state or central government maintains huge amount of confidential data related to country (geographical, military strategic assets etc.) and citizens. Unauthorized access to the data can lead to serious threats on a country.

International Mechanisms:

• The International Telecommunication Union (ITU) is a specialized agency within the United Nations which plays a leading role in the standardization and development of telecommunications and cyber security issues.
• Budapest Convention on Cybercrime: It is an international treaty that seeks to address Internet and computer crime (cybercrime) by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. It came into force on 1 July 2004. India is not a signatory to this convention.
• Internet Governance Forum (IGF): It brings together all stakeholders i.e. government, private sector and civil society on the Internet governance debate. It was first convened in October–November 2006.
• Internet Corporation for Assigned Names and Numbers (ICANN): It is a non-profit organization responsible for coordinating the maintenance and procedures of several databases related to the namespaces and numerical spaces of the Internet, ensuring the network's stable and secure operation. It has its headquarters in Los Angeles, U.S.A.

Laws related to Cyber Security in India

Information Technology Act, 2000
The act regulates use of computers, computer systems, computer networks and also data and information in electronic format. The act lists down among other things, following as offences:

• Tampering with computer source documents.
• Hacking with computer system
• Act of cyber terrorism i.e. accessing a protected system with the intention of threatening the unity, integrity, sovereignty or security of country.
• Cheating using computer resource etc.

Strategies under National Cyber Policy, 2013

• Creating a secure cyber ecosystem.
• Creating mechanisms for security threats and responses to the same through national systems and processes.
• National Computer Emergency Response Team (CERT-in) functions as the nodal agency for coordination of all cyber security efforts, emergency responses, and crisis management.
• Securing e-governance by implementing global best practices, and wider use of Public Key Infrastructure.
• Protection and resilience of critical information infrastructure with the National Critical Information Infrastructure Protection Centre (NCIIPC) operating as the nodal agency.
• NCIIPC has been created under Information Technology Act, 2000 to secure India’s critical information infrastructure. It is based in New Delhi.
• Promoting cutting edge research and development of cyber security technology.
• Human Resource Development through education and training programs to build capacity.

Challenges

• Increased use of mobile technology and internet by people.
• Proliferation of Internet of Things (IoT) and lack of proper security infrastructure in some devices.
• Cyberspace has inherent vulnerabilities that cannot be removed.
• Internet technology makes it relatively easy to misdirect attribution to other parties.
• It is generally seen that attack technology outpaces defence technology.
• Lack of awareness on Cyber security.
• Lack of Cyber security specialists.
• Increased use of cyberspace by terrorists.

Recent Steps taken by Government

• Cyber Surakshit Bharat Initiative: It was launched in 2018 with an aim to spread awareness about cybercrime and building capacity for safety measures for Chief Information Security Officers (CISOs) and frontline IT staff across all government departments.
• National Cyber security Coordination Centre (NCCC): In 2017, the NCCC was developed. Its mandate is to scan internet traffic and communication metadata (which are little snippets of information hidden inside each communication) coming into the country to detect real-time cyber threats.
• Cyber Swachhta Kendra: In 2017, this platform was introduced for internet users to clean their computers and devices by wiping out viruses and malware.
• Training of 1.14 Lakh persons through 52 institutions under the Information Security Education and Awareness Project (ISEA) – a project to raise awareness and to provide research, education and training in the field of Information Security.
• International cooperation: Looking forward to becoming a secure cyber ecosystem, India has joined hands with several developed countries like the United States, Singapore, Japan, etc. These agreements will help India to challenge even more sophisticated cyber threats.

Road Ahead

• Although, we are actively fighting and presenting various frameworks or technologies to protect our network and information but all of these providing protection for short term only. 
• However, better security understanding and appropriate strategies can help us to protect intellectual property and trade secrets and reduce financial and reputation loss. Central, state and local governments hold large amount of data and confidential records online in digital form that becomes primary target for a cyber-attack. 
• Most of time governments face difficulties due to inappropriate infrastructure, lack of awareness and sufficient funding. It is important for the government bodies to provide reliable services to society, maintain healthy citizen-to-government communications and protection of confidential information.
• The need of the hour for Indian government is to develop core skills in cyber security, data integrity and data security fields while also setting stringent cyber security standards to protect banks and financial institutions.