India not ready for cyberwar

Once confined to secret chambers, hackers now operate even at the behest of nations - all with the stealth shown by the Greeks to destroy Troy with the Trojan horse.

Last week, official internet sites of 50 members of the US House of Representatives were hacked. The attacks, according to researchers at security consultant Praetorian Security Group, were carried out by a Brazil-based hacker group - the Red Eye Crew - which is believed to be responsible for thousands of attacks on websites in recent years.

Hackers attack with bots, viruses and trojans instead of planes or armoured vehicles and missiles, and systematically create online "trapdoors" to invade servers and computers and steal banking passwords and money besides disabling telecommunications links.

Even countries are known to have hackers invade their rivals. For instance, in March 2009, a cyber spy network dubbed GhostNet allegedly used servers mainly based in China to tap into classified documents from government and private organisations in 103 countries, including computers of Tibetan exiles. China denied the claim.

Such things might appear a remote possibility in India which does not have much of its data online. But consider this. In 2009 alone, over 6,000 websites were defaced in the country.

And a new report from McAfee reveals that India has the lowest rate of security measure adoption, and it tops the charts for malicious traffic in Asia. If attacked, the average estimated cost of downtime associated with any major incident is $6.3 million (around Rs 30 crore) per day.

Experts are unanimous in their view that India is totally unprepared for a cyberwar. "But then when it comes to cyberwar, no country in the world is prepared to tackle this. If a country plans to attack another country, then it will choose to attack certain important online sites that will impact the economy of that country.

"A case in point would be deleting the database of a bank. But banks would have replicated the data and will manage to work around the situation. But if hackers start withdrawing small amounts of money from accounts and transfer them to other banks, we have a huge problem," says Vikas Desai, lead technology consultant (India and SAARC) of online security firm RSA.

Online security expert Vijay Mukhi concurs that India is not prepared to fight a cyberwar despite the fact that most banks have their data online. "Cybercrime is very sophisticated and orchestrated in a manner that can cripple our financial backbone in a day's time. But we aren't doing much to address the situation," he rues.

In India, reason online security experts, the apathy towards strengthening online security stems from the fact that the maximum attacks we have seen are defacing a site or largely sending denial of services (DoS).

But that may not be the case for long with India deciding to digitise its data and make them available to all citizens online. Setting up of State Wide Area Network connections and important e-governance programmes - including that of MCA 21, e-Passport and e-Office - are cases in point. Even Nandan Nilekani says he wants the Unique Identity Number accessible online too. A person could lose his/her identity if a hacker gets this number.

"Cyber attacks have changed over the period of years. Earlier attacks were much simpler," cautions Kartik Shahani, regional director- India-SAARC McAfee. His firm's global threat intelligence data suggest that India has recently replaced China (and Russia and Romania) as the richest hunting ground for hackers.

Moreover, cybercrime companies, note security experts, work much like real-world companies. There are hierarchical cybercrime organisations where each cybercriminal has his or her own role and reward system, according to security firm Finjan. The employee structure is similar to the Mafia with a "boss" who does not commit the (cyber) crimes himself, and a "deputy" who manages the operation, sometimes providing the tools needed for attacks.

In the Mafia, several "capos" operate beneath the deputy as lieutenants. They act as "campaign managers" and lead their own attacks to steal data with their "affiliation networks". The stolen data are sold by 'resellers' similar to the Mafia's "associates".

Shivarama Krishnan, executive director and partner, PwC concurs that India need to be well prepared for an eventuality such as this. "If someone wants to paralyse American banks or the retail sector, India is the best target as most of the maintenance and operational processes are managed out of India. So India's preparedness will have to be higher.

We also cannot ignore the aspect as more and more applications are coming online. Most of the projects that the government has undertaken are on outsourcing basis. But many times the outsourcing firm gives work to other third party members, where a background check on their employees should be made compulsory but is not adhered to," he cautions.