New Delhi: State-sponsored cyber attacks against India increased by 278% between 2021 and September 2023, with services companies, including information technology (IT) and business process outsourcing (BPO) firms, seeing the highest share of attacks, a new report has found.
During this period, targeted cyber attacks on government agencies went up by 460%, while startups and small and medium enterprises (SMEs) saw a whopping increase by 508%.
According to the 2023 India Threat Landscape Report by Singapore-based cybersecurity firm Cyfirma, India is the most targeted country globally, facing 13.7% of all cyber attacks, the Economic Times reported.
The US is the second most targeted country, with 9.6% of all attacks. Indonesia and China follow, with 9.3% and 4.5% of all attacks, respectively.
Cyfirma founder and chief executive Kumar Ritesh told ET that India is also experiencing a higher proportion of foreign state-influenced cyber attacks compared to the global average.
He said that globally, almost 68% of cyber attacks in the last three years were state-sponsored. “If you look at the India number, this is slightly higher, at 72%,” he said.
Cyfirma found that services companies, including IT and BPO, were at the receiving end of 14.3% of cyber attacks between March 2021 and September 2023. This was followed by manufacturing at 11.6%, and healthcare and education at around 10% each. Retail, including online platforms, saw 9.8% of attacks while government agencies saw 9.6%. Banking and financial services institutions, automobiles, and airlines saw 9.5%, 8.3%, and 6.1% of attacks, respectively, the business daily reported.
In 2015-16, 58-59% of cyber attacks on India were from Pakistani threat actors or operators from the Middle East, he told the newspaper. Today, only 6.4% of threats are from Pakistani actors or their affiliates, while 79% are from China, he added.
He said India needs a better enforcement of cybersecurity policies and greater awareness, especially among SMEs and startups, of the kind of sophisticated cybercriminals they are up against, Ritesh said.
“We as brand India are elevating ourselves, but it looks like cybercriminals are also elevating themselves because they know that we are becoming quite an influential force in the world ecosystem,” Ritesh said.
India’s cybersecurity weakness
While digitisation has accelerated the need for cybersecurity, India’s cybersecurity regulations are weak and inadequate.
Last year, on November 30, the website of the Indian Council of Medical Research (ICMR) faced around 6,000 hacking attempts in 24 hours.
This happened a week after five servers of the All India Institute of Medical Sciences (AIIMS) had been hacked by ransomware. An estimated 1.3 terabytes of data was encrypted. The hackers had made it impossible for AIIMS to access its own data.
On October 31, 2023, in a massive data breach, information of over 81.5 crore Indians with the ICMR were sold on the dark web.
Separately, the Massachusetts Institute of Technology (MIT) Technology Review CyberDefense Index (CDI) 2022/23 ranked India at No. 17 out of 20.
MIT’s CDI is the ‘first-of-its-kind’ annual comparative ranking of the world’s 20 largest and most digital economies on their preparation against, and response and recovery from, cybersecurity threats, another report in the Economic Times said.
“India struggles, despite a digitally forward government and the world’s largest IT-enabled service sectors. This powerful tech force lacks critical infrastructure, has poor national digital economy adoption, and weak cybersecurity regulation. Despite cyberattacks and calls for cybersecurity laws and a dedicated ministry, India has opted out,” ET quoted the report as saying.
The increasing number of cyberattacks has called for a cybersecurity law and the establishment of a dedicated ministry.
Experts have also pointed to the need for job creation in the cybersecurity industry.
Despite having the second highest number of active internet users after China, India represents only 6% of the global cybersecurity jobs.
Rajeev Sharma, CEO and CIO, Sysquark Technologies Pvt Ltd, an IT services company told the newspaper: “You would worry about theft when you have something to protect. Now think as a country instead of as a company. Companies will always have data to protect but they will always be short of resources. For a resource, security comes last in mind because he is busy doing firefighting. For a company, hiring more resources is not cost-effective since only a handful of customers are planning to buy the services/goods you are manufacturing. To strengthen the buying power, in turn, the cost-effectiveness of the resources, the first need is to create jobs. And I am purely talking from the government’s standpoint.”
“From the company’s standpoint, if we have a bigger coffer, we will be more interested in hiring resources who are specialised in the desired jobs. Cross-skilling is only a compromise on expertise. From a resource standpoint, since I have more time, I might like to learn new skills,” he added.
No comments:
Post a Comment