National Cyber Security Policy 2013

National Cyber Security Policy is a policy framework by Department of Electronics and Information Technology (DeitY), Ministry of Communication and Information Technology, Government of India.^[1] It aims at protecting the public and private infrastructure from cyber attacks.^[2] The policy also intends to safeguard "information, such as personal information (of web users), financial and banking information and sovereign data". This was particularly relevant in the wake of US National Security Agency (NSA) leaks that suggested the US government agencies are spying on Indian users, who have no legal or technical safeguards against it. Ministry of Communications and Information Technology (India) defines Cyberspace is a complex environment consisting of interactions between people, software services supported by worldwide distribution of information and communication technology.^[2][3][4]

The National Cyber Security Policy of India 2013 is suffering from various shortcomings and limitations as per various studies and researches.^{[5][6][7][8][9]} Despite the declaration of the policy, India is still not cyber prepared.^[10] The policy has also not been implemented till the month of November 2014 (till 21 November 2014). The cyber security challenges in India would increase further and immediate action is required in this regard.^[11] The proposed initiatives like National Cyber Coordination Centre ^[12] and National Critical Information Infrastructure Protection Centre (NCIIPC) of India could prove useful in strengthening Indian cyber security and critical infrastructure protection in India.^[13][14]

Reason for Cyber Security

India had no Cyber security policy before 2013. In 2013, The Hindu newspaper, citing documents leaked by NSA whistleblower Edward Snowden, has alleged that much of the NSA surveillance was focused on India's domestic politics and its strategic and commercial interests. This leads to spark furor among people. Under pressure, Government unveiled a National Cyber Security Policy 2013 on 2 July 2013.

Vision

To build a secure and resilient cyberspace for citizens, business and government.

Mission

To protect information and information infrastructure in cyberspace, build capabilities to prevent and respond to cyber threat, reduce vulnerabilities and minimize damage from cyber incidents through a combination of institutional structures, people, processes, technology and cooperation.

Objective

Ministry of Communications and Information Technology (India) define objectives as follows:

• To create a secure cyber ecosystem in the country, generate adequate trust and confidence in IT system and transactions in cyberspace and thereby enhance adoption of IT in all sectors of the economy.

• To create an assurance framework for design of security policies and promotion and enabling actions for compliance to global security standards and best practices by way of conformity assessment (Product, process, technology & people).

• To strengthen the Regulatory Framework for ensuring a SECURE CYBERSPACE ECOSYSTEM.

• To enhance and create National and Sectoral level 24X7 mechanism for obtaining strategic information regarding threats to ICT infrastructure, creating scenarios for response, resolution and crisis management through effective predictive, preventive, protective response and recovery actions.

• To improve visibility of integrity of ICT products and services by establishing infrastructure for testing & validation of security of such product.

• To create workforce for 5,00,000 professionals skilled in next 5 years through capacity building skill development and training.

• To provide fiscal benefit to businesses for adoption of standard security practices and processes.

• To enable Protection of information while in process, handling, storage & transit so as to safeguard privacy of citizen's data and reducing economic losses due to cyber crime or data theft.

• To enable effective prevention, investigation and prosecution of cybercrime and enhancement of law enforcement capabilities through appropriate legislative intervention.

Strategies

• Creating a secure Ecosystem.
• Creating an assurance framework.
• Encouraging Open Standards.
• Strengthening The regulatory Framework.
• Creating mechanism for Security Threats Early Warning, Vulnerability management and response to security threat.
• Securing E-Governance services.
• Protection and resilience of Critical Information Infrastructure.
• Promotion of Research and Development in cyber security.
• Reducing supply chain risks
• Human Resource Development (fostering education and training programs both in formal and informal sectors to support Nation's cyber security needs and build capacity.
• Creating cyber security awareness.
• Developing effective Public Private Partnership.
• To develop bilateral and multilateral relationship in the area of cyber security with other country. (Information sharing and cooperation)
• Prioritized approach for implementation.
• Operationalisation of Policy

Shortcomings

The National Cyber Security Policy 2013 has failed to address numerous issues as per various research and analysis.^[5][6][7] Some of these issues are:

(1) The declared cyber security policy has proved to be a paper work alone with no actual implementation till date.^[15]

(2) The cyber security trends and developments in India 2013 (Pdf) provided by Perry4Law’s Techno Legal Base (PTLB) has listed the shortcomings of Indian cyber security policy in general and Indian cyber security initiatives in particular.^[16]

(3) Indian cyber security policy has failed to protect civil liberties of Indians including privacy rights.^[17]

(4) Civil liberties protection in cyberspace has been blatantly ignored by Indian government and e-surveillance projects have been kept intact by the Narendra Modi government.^[18]

(5) The offensive and defensive cyber security capabilities of India are still missing.^[19]

(6) India is considered to be a sitting duck in cyberspace and cyber security field and the proposed cyber security policy has failed to change this position.^[20]

(7) Over regulation, ICT Supply Chain risks, absence of adequate testing facilities of electronic equipments, lack of stress upon international cooperation, etc are some other concerns that have been raised by the Data Security Council of India.^[8]

(8) The NCSP's poor drafting and meaningless provisions do not advance the field.^[9]

In short, India is not at all cyber prepared ^[10] despite the contrary claims and declared achievements and the cyber security policy is just another policy document with no actual implementation and impact.The cyber security challenges in India would increase further and immediate action is required in this regard.^[11]

References

External links

• "National Cyber Security Policy 2013". Department of Information Technology, Ministry of Communications and Information Technology. 

• "National Cyber Security Policy Of India 2013 (NCSP 2013)". Perry4Law Organisation.