Firewalling The Grid

The Indian Express     10th March 2021     Save    
QEP Pocket Notes

Context: According to the Massachusetts-based Recorded Future, the recent Mumbai power outage could have been a cyber-attack aimed at critical infrastructure.

Recent cyber-attacks on critical infrastructure in India

  • Red Echo: which has close ties to the People’s Liberation Army (PLA), is reported by the National Critical Information Infrastructure Protection Centre (NCIIPC) to have attacked the Mumbai grid recently.
  • Supply chain attacks by ShadowPad malware: Reported by Indian Computer Emergency Response Team (CERT-In)

Steps taken for Critical Information Infrastructure Protection (CIIP): from cyber attacks

  • Creation of NCIIPC: to act as the nodal agency for CIIP and to work closely with other agencies.
  • Announced National Mission on Interdisciplinary Cyber-Physical Systems (NM-ICPS).
  • So far, India successfully protected critical networks like the sensitive Aadhaar ecosystem, the income tax department and the core banking systems.

Way forward: for enhanced CIIP

  • Provide better budget allocations for cybersecurity.
  • Create robust infrastructure, processes and audit system:
    • Adopt Industrial Cybersecurity Standards (IEC62443) of Bureau of Indian Standards (BIS): to address and mitigate current and future security in industrial automation and control systems.
    • Create strong regulations in the power sector: To enable public and private sector utility companies in India harden and secure their operational technology (OT) networks.
      • For e.g. North American Electric Reliability Critical Infrastructure Protection (NERC) policy.
QEP Pocket Notes