By Lt Gen Prakash Katoch
29 Jun , 2016
There is little doubt that the recent China generated cyber attack on Indian governmental and commercial establishments primarily targeting India military and the well coordinated incursion involving some 215 PLA troops from four different border points in Arunachal Pradesh and engaging in a scuffle with soldiers of the Indian Army at ‘Shankar Tikri’ in Aunachal Pradesh was to show the discomfiture over the India-US-Japan joint naval exercise Malabar 2016 being conducted in Western Pacific. The transgression of course was part of periodic PLA frolics; behaving like Chipmunks that look benign but are highly destructive.
China knows this is no 1962 and a bloody nose at the tactical level can blow the cover of self aggrandizement that she has so carefully orchestrated. What needs to be taken seriously is the cyber attack, of which China has advanced capabilities…
However, the fact remains that wherever they have been confronted, they have tucked in their tails and scrammed back. Unfortunately, bulk responses by previous governments in such cases were predictable and gutless resulting in Beijing enjoying these psychological ploys – as any bully would. Interestingly, YouTube clips of similar scuffles with Indian soldiers available on the net are good exposure for the Chinese public of PLA’s so called peaceful behavior. Hopefully the scuffle that took place this month at Shankar Tekri has been filmed by the Indian Army and put on the web.
China knows this is no 1962 and a bloody nose at the tactical level can blow the cover of self aggrandizement that she has so carefully orchestrated. What needs to be taken seriously is the cyber attack, of which China has advanced capabilities, by the Chinese organ Suckfly.
The magnitude of cybercrime can be gauged from the 2016 Symantec report covering 157 countries that discovered more than 430 million new unique pieces of malware in 2015; 36% higher than 2014. Six key findings of the report are: one, new zero-day vulnerability discovery averaged one per week during 2015 – 125% increase over 2014; two, over half a billion personal records were stolen or lost in 2015 – nine-mega breaches (each over 10 million records) reported; three, over one million daily web attacks in 2015 – more than 75% of legitimate websites have unpatched vulnerabilities; four, spear-phishing campaigns targeting employees Increased 55% in 2015, large businesses that experienced a cyber attack saw an average of 3.6 attacks; five, ransomware increased 35% in 2015 with cyber criminals using encryption as a weapon to hold companies’ and individuals’ critical data hostage, and; six, Symantec blocked 100 Million fake technical support scams in 2015 – attackers tricking people with pop-ups alerting them to serious error or problem, and “technical support representative” sell victims worthless services.
US DoD has released its new Network Strategy (2025-2040), titled ‘Shaping the Army Network: 2025-2040’, focusing on key areas affecting networks and systems to meet operational information requirements…
China has been going full hog developing capacity to capture networks of perceived enemies like India, Japan, South Korea, besides stealing data from global defence and business enterprise. China has been cyber attacking India regularly, including targeting defence establishments and even the National Security Council.
In last week of September 2015t, Chinese hackers, managed to break into two Bengaluru based Indian IT companies, possibly chasing information on US technology and pharma companies. The data stolen is not known but it could be financial information, technical knowhow or trademark related information. These attacks were possibly connected attacks by Chinese hackers in US during same period. Interestingly, the US and China signed an agreement on 25 September 2015 not to steal corporate data for economic benefit but within two days there were two attacks on US technology companies, followed by more hacking attempts later weeks. Crowd Strike identified these attacks were carried out by Chinese state-sponsored actors to a “high degree of confidence”, one of hacking groups being Deep Panda, which the firm had been tracking past several years.
The US National Security Agency released a map last year showing Chinese Government’s cyber attacks on the US; almost in every sector of US economy -Google and Northrop Grumman to government bodies and US military. Little wonder then that US DoD’s fiscal 2017 budget request includes $7 billion for cyber-security.
According to Defence Secretary Ashton Carter, “Among other things, this will help to further DoD’s network defenses, which is critical; build more training ranges for our cyber warriors; and also develop cyber tools and infrastructure needed to provide offensive cyber options.” Carter identified five military challenges for the US – Russia, China, North Korea, Iran and terrorism, specifically the Islamic State. Simultaneously, US DoD has released its new Network Strategy (2025-2040), titled ‘Shaping the Army Network: 2025-2040’, focusing on key areas affecting networks and systems to meet operational information requirements and sustaining technological asperity by 2040; areas include dynamic transport, data to decisive action, robotics and autonomous operations, computing and edge sensors, cyber-security and resiliency, and human cognitive enhancement.
China is adopting an all round aggressive stance at the global level supported by her nuclear protégés Pakistan and North Korea and those who would prefer to be fence sitters weighed down with China’s economic largess.
US Defence Secretary Ashton Carter visited US Air Force Academy in December 2015 to witness a group of cadets reverse hack a radar tower until they could turn it on and off at will. The CyberCity simulator allows cadets to take turns hacking the town and defending against attacks. They learn how to issue kill orders and cancel kill processes, implement and then take down new firewalls, and set up scheduled operations that can be hard for network operators to detect. USA has developed rules of engagement for pre-emptive cyber attacks, giving them same strategic importance as nuclear strikes. USA acknowledges it hacked Chinese company Huwei for reasons of national security. In India, the NSCS had issued advisory against buying Huwei and ZTE products for valid reasons, but the UPA government allowed these firms in India within three months of issue of the NSCS advisory.
In the case of India, obviously the Modi government is ceased with: requirement of the organizational structure to cope with cyber warfare including a National Cyber Command and a Joint Services Cyber Command; continuous review of protecting data centres and networks; financial support to private sector including banks, stock exchanges etc for installing adequate cyber security measures; graduating from cyber security to holistic information assurance tailored to specific organizational missions, goals and objectives, and; fundamental shift from individual entity to central overview, control and assessment of security measures. With reference to the latter and cases like hacking of two IT firms discussed above, perhaps there is need for the government to know what data was lost and how, while maintaining confidentiality.
Fortunately, China is adopting an all round aggressive stance at the global level supported by her nuclear protégés Pakistan and North Korea and those who would prefer to be fence sitters weighed down with China’s economic largess.
With India’s opening up, we have the chance of building effective cyber capabilities in concert our strategic and defence partnerships. In line with the Chinese way, we should keep up the propaganda of China’s cyber prowess simultaneously building own capacity in order to strike when needed, the bottom-line being that focus on cyber-security can never be enough.
© Copyright 2016 Indian Defence Review
No comments:
Post a Comment