UPSC Civil Services Main Examination – General Studies Paper III
Topic: Cybersecurity and Critical Information Infrastructure
Marks: 15
Word Limit: 250 words
Suggested Time: 10–12 minutes
This is an original practice question prepared by Samata IAS Academy. It is not an official UPSC question.
Section I: Mains Practice Question
Q. The increasing digitisation of essential services has made cybersecurity an important component of India’s national security. Examine the major threats to India’s Critical Information Infrastructure and suggest measures to strengthen its protection.
(15 Marks, 250 Words)
Section II: Understanding the Question
1. Syllabus Mapping
GS Paper III – Internal Security
- Basics of cyber security.
- Challenges to internal security through communication networks.
- Role of external state and non-state actors in creating challenges to internal security.
- Cyber warfare and its implications for national security.
- Security challenges and their management in border areas and linkages of organised crime with terrorism.
2. What does the question demand?
The question requires an examination of the relationship between cybersecurity and national security, with particular emphasis on Critical Information Infrastructure (CII).
The answer should cover:
- Meaning and significance of Critical Information Infrastructure.
- Major cyber threats faced by essential sectors.
- Vulnerabilities arising from increased digital dependence.
- India’s institutional and legal framework.
- Measures required to strengthen cyber resilience.
The answer should go beyond ordinary cybercrime and explain how attacks on essential digital systems can disrupt economic activity, public services and national security.
3. Suggested Answer Structure
- Introduction: Explain the growing importance of cybersecurity in a digitally connected economy.
- Part I: Define Critical Information Infrastructure and identify important sectors.
- Part II: Examine major cyber threats and vulnerabilities.
- Part III: Explain India’s institutional framework and identify gaps.
- Part IV: Suggest technological, institutional and strategic measures.
- Conclusion: Emphasise cyber resilience as an essential component of national security.
Section III: Model Answer
Introduction
India’s growing dependence on digital networks for banking, energy, telecommunications, transport and governance has expanded its cyber threat exposure. Critical Information Infrastructure (CII) refers to computer resources whose incapacitation or destruction can have a debilitating impact on national security, economy, public health or safety.
Major threats
- Ransomware and malware: Disrupt essential services and compromise sensitive information.
- State-sponsored cyberattacks: Target strategic networks for espionage, disruption or sabotage.
- Supply-chain vulnerabilities: Compromise systems through insecure third-party software and service providers.
- Data breaches: Expose sensitive personal, financial and strategic information.
- Operational technology attacks: Threaten power grids, industrial control systems and other physical infrastructure.
India’s institutional framework
The Information Technology Act, 2000 provides the legal foundation. Section 70A provides for a national nodal agency for CII protection, while Section 70B provides for CERT-In as the national agency for responding to cybersecurity incidents. NCIIPC is the designated nodal agency for CII protection, while CERT-In coordinates incident response and issues cybersecurity advisories.
Way forward
India must strengthen continuous threat monitoring, security audits, encryption, multi-factor authentication and secure software procurement. Regular cyber drills, public-private information sharing, indigenous security capabilities, skilled personnel and resilient backup systems are equally important.
Conclusion
Cybersecurity is no longer merely a technical concern but a strategic necessity. Protecting CII requires a whole-of-government and whole-of-society approach, combining technological resilience, institutional coordination and international cooperation.
Section IV: Value Addition
1. Important Legal Provisions
| Provision | Significance |
|---|---|
| Section 43, IT Act, 2000 | Provides for compensation in respect of specified unauthorised acts involving computer systems |
| Section 66, IT Act, 2000 | Deals with computer-related offences when specified acts under Section 43 are committed dishonestly or fraudulently |
| Section 66F, IT Act, 2000 | Deals with cyberterrorism |
| Section 70, IT Act, 2000 | Provides for declaration of specified computer resources as protected systems |
| Section 70A, IT Act, 2000 | Provides for a national nodal agency for CII protection |
| Section 70B, IT Act, 2000 | Provides for CERT-In and its cybersecurity functions |
Important distinction: Section 70 deals with protected systems; Section 70A concerns the national nodal agency for CII protection; and Section 70B concerns CERT-In.
2. Important Institutions
National Critical Information Infrastructure Protection Centre (NCIIPC)
- Functions as the national nodal agency for CII protection.
- Identifies critical information infrastructure elements for government notification.
- Provides strategic guidance and advice to reduce vulnerabilities.
- Coordinates measures to protect critical sectors from cyber threats.
Indian Computer Emergency Response Team (CERT-In)
- National agency for responding to cybersecurity incidents.
- Collects, analyses and disseminates information on cyber incidents.
- Issues alerts, advisories and guidelines.
- Coordinates responses to cybersecurity incidents.
National Cyber Coordination Centre (NCCC)
- Supports situational awareness and coordination for detecting cybersecurity threats in cyberspace.
National Cyber Security Coordinator (NCSC)
- Facilitates coordination among government agencies and stakeholders on cybersecurity policy and strategy.
3. Important Government Measures
- CERT-In Directions, 2022: Require specified entities to report listed cybersecurity incidents to CERT-In within six hours of noticing them or being informed of them. They also address system-log maintenance and other security practices. <Link ref=”turn732823search25″ title=”Read CERT-In Directions”/>. <Cite refs={[“turn732823search25″,”turn732823search9”]}/>
- National Cyber Security Policy, 2013: Provides a policy framework for securing cyberspace, building capabilities and developing skilled cybersecurity professionals.
- Information Technology Act, 2000: Provides the statutory foundation for cybersecurity institutions and specified cyber offences.
- Cyber Swachhta Kendra: A government initiative to help detect and remove malicious software and botnet infections.
4. Critical Information Infrastructure: Important Sectors
| Sector | Possible consequences of cyber disruption |
|---|---|
| Power and energy | Grid disruption and interruption of electricity supply |
| Banking and finance | Payment-system failures and financial instability |
| Telecommunications | Communication disruption |
| Transport | Disruption of air, rail and traffic management systems |
| Healthcare | Interruption of hospital systems and access to medical records |
| Government networks | Disruption of essential public services and compromise of sensitive information |
5. A Diagram for Answer Enrichment
Cybersecurity and National Security
<escape>Cyber Threats
↓
Vulnerable Digital Infrastructure
↓
Disruption of Essential Services
↓
Economic, Social and Strategic Consequences
↓
National Security Risk</escape>
Resilience framework:
Prevention → Detection → Response → Recovery → Continuous Improvement
Section V: Mains Enrichment – Points to Remember
- Critical Information Infrastructure is defined under the Information Technology Act, 2000.
- Section 70A provides for a national nodal agency for CII protection; NCIIPC performs this role.
- CERT-In functions under Section 70B as the national agency for responding to cybersecurity incidents.
- Cybersecurity threats can originate from state and non-state actors.
- Supply-chain vulnerabilities and attacks on operational technology can have consequences beyond the digital domain.
- Effective protection requires coordination between government agencies, private infrastructure operators, regulators and technology providers.
- Cyber resilience should include prevention, early detection, incident response and recovery.
Section VI: Self-Evaluation Checklist
After writing your answer, assess whether you have:
- Defined Critical Information Infrastructure.
- Explained the link between cybersecurity and national security.
- Identified at least four major cyber threats.
- Mentioned the IT Act and relevant sections.
- Distinguished between NCIIPC and CERT-In.
- Suggested technological and institutional measures.
- Written a balanced conclusion within the word limit.
Samata IAS Academy – Mains Answer Writing Practice
Developing analytical ability, internal security awareness and structured answer-writing skills for the UPSC Civil Services Examination.