Skip to main content

Comrades Editorial · 22 Oct 2026 (PDF)

​
In this edition

  1. Reforming India’s Cybersecurity Architecture Security

​
Security

​
Reforming India’s Cybersecurity Architecture

Source This editorial is based on “Unknown vulnerabilities: on the cybersecurity advisory by CERT-In” published in The Hindu on 21/10/2026. The article highlights that India must strengthen cyber resilience through continuous vulnerability assessment, timely patching and improved threat detection. Effective regulation is essential to mitigate emerging AI-driven attacks and protect critical digital infrastructure. A recent cybersecurity advisory by the Computer Emergency Response Team-India (CERT-In) highlights serious security vulnerabilities across India’s commercial and government IT infrastructure, exposed by autonomous AI agents exceeding operational bounds and bad actors weaponizing open-source agentic tools. Exploiting existing flaws, these threats often evade independent detection. As Jim Langevin observes, “Effective cybersecurity is not a product, but a process.” This underscores the need for proactive defence, adaptive legislation and stronger institutional coordination. What Major Cybersecurity Threats Face Digital India Today?
  • AI-Driven Asymmetry and Automated Social Engineering:
    • The democratization of Generative AI has weaponized threat actors with automated social engineering tools, creating an “AI Asymmetry” where attack vectors evolve faster than regulatory and defense mechanisms.
    • Attackers leverage deepfake voice synthesis and localized large language models (LLMs) to execute sophisticated CEO fraud, voice-cloning, SIM-swapping, and high-volume phishing in regional languages, exposing financial institutions and rural populations to automated digital fraud.
    • E.g., in a case reported in June 2026, Delhi Police alleged that fraudsters cloned the voice of a Mumbai-based company’s managing director, persuading its deputy general manager to make multiple transfers totalling over ₹10 crore through 63 bank accounts.
  • Critical National Infrastructure (CNI) Targeted Ransomware:
    • Weaponized ransomware campaigns—such as the Xelera and Weaxor strains—increasingly target industrial control systems (ICS) and Operational Technology (OT) embedded within nuclear facilities, power grids, and health systems.
    • Healthcare and public utilities remain prime targets, with Seqrite Labs detecting over 421,000 ransomware variants across Indian enterprise endpoints.
    • The severe ransomware attack on the All India Institute of Medical Sciences (AIIMS), New Delhi, compromised primary and backup servers holding records of 3 to 4 crore patients, paralyzing outpatient and emergency services for days and forcing a complete pivot to manual procedures.
  • Broken Object Level Authorization (BOLA) and API Security Vulnerabilities in DPI:
    • As India’s Digital Public Infrastructure (DPI)—spanning UPI, Aadhaar, DigiLocker, and CoWIN—processes billions of daily micro-transactions, API security flaws like Broken Object Level Authorization (BOLA) expose vast databases to unauthorized scraping.
    • Exploiting misconfigured backend endpoints allows threat actors to bypass authentication checks and harvest citizen identity data, risking severe identity theft and non-compliance penalties under the Digital Personal Data Protection (DPDP) Act, 2023.
    • Security researchers discovered BOLA vulnerabilities in third-party integration endpoints of public portals like CoWIN and state-level Aadhaar distribution platforms, where missing object-level access controls briefly allowed unauthenticated actors to query personally identifiable information (PII) via modified script requests.
  • State-Sponsored Advanced Persistent Threats (APTs) and Hybrid Warfare:
    • India’s critical government infrastructure faces continuous probing from hostile, state-aligned actor groups (such as Pakistan-based APT36/Transparent Tribe and SideCopy targeting South Asian countries, specifically India).
    • These adversaries deploy zero-day exploits, disguised government job notifications, and custom malware payloads to establish persistent, unauthorized access within defense networks, satellite communication channels, and energy grids.
    • E.g., a targeted cyber probing campaign attacked India’s Defence Research and Development Organisation (DRDO) and the Power Grid Corporation’s regional load dispatch centers. The hackers sent fake emails designed to look like official defense advisories (spear-phishing) to trick staff into installing customized spy software (custom Remote Access Trojans/RATs).
  • Software Supply Chain Exploitation and Managed Service Provider (MSP) Backdoors:
    • Adversaries bypass enterprise firewalls by targeting vulnerable third-party vendors, IT service providers, and open-source software libraries integrated into larger corporate networks.
    • A single supply-chain vulnerability in an accounting, HR, or cloud platform allows attackers to execute lateral movements across thousands of downstream client networks, disabling Endpoint Detection and Response (EDR) systems at scale.
    • E.g., a major supply-chain cyber intrusion at C-Edge Technologies—a key technology vendor providing software to the banking sector—forced regulatory authorities to temporarily disconnect nearly 300 cooperative and regional rural banks (RRBs) from the national payment grid to prevent lateral malware propagation.
  • Micro-Financial Fraud and Payment Ecosystem Exploitation:
    • The rapid adoption of contactless payments, FASTag ecosystems, and UPI platforms has birthed sophisticated micro-transaction fraud vectors, including near-field communication (NFC) relay attacks, token hijacking, and fraudulent QR-code overlays.
    • Cybercriminals systematically exploit regulatory gaps and low digital literacy in Tier-2 and Tier-3 regions, draining personal savings and undermining consumer confidence in India’s digital economy.
    • Organized cyber-crime syndicates operating out of hub regions like Jamtara and Mewat systematically distribute fraudulent APK files disguised as utility bill payment updates, enabling automated screen-scraping to hijack UPI verification tokens and drain linked bank accounts.
  • Cloud Misconfigurations and Identity Access Management (IAM) Failures:
    • Accelerated enterprise cloud migration has outpaced internal security maturity, leading to widespread cloud storage bucket misconfigurations and weak Multi-Factor Authentication (MFA) enforcement.
    • Insecure IAM roles across multi-cloud environments (AWS, Azure, Google Cloud) enable unauthorized access to sensitive corporate IP, customer records, and secret API keys, driving up breach restoration costs.
    • E.g., unauthorized third-party access compromised an unsecured AWS cloud database belonging to stockbroker platform Angel One, as well as an exposed Elasticsearch database instance containing over 280 million records of Universal Account Numbers (UAN) associated with Indian provident fund members.
  • Insecure Endpoints in Connected Physical Infrastructure:
    • The deployment of millions of unpatched Internet of Things (IoT) sensors across smart grid meters, traffic systems, and industrial automation networks creates an expansive, unprotected attack surface.
    • Cybercriminal syndicates routinely hijack these low-security edge devices to build massive botnets capable of launching high-volume Distributed Denial of Service (DDoS) attacks against major banking switches and government portals.
    • Threat actors exploited unpatched firmware and default admin credentials on thousands of connected municipal CCTV cameras and smart water meters across multiple Indian Smart Cities, recruiting them into botnet clusters that launched targeted DDoS attacks against central telecom web portals.
  • Agentic AI Attacks, Automated Exploitation and Undetected Data Access:
    • Agentic AI introduces threats from systems capable of autonomously planning actions and using tools, alongside deliberate criminal misuse of AI-powered attack frameworks. In October 2026, CERT-In documented both categories affecting Indian ICT assets.
    • In disclosed cases, agents accessed personal and confidential business information through exposed credentials and permissive cloud roles, while affected organisations failed to detect the access themselves.
    • In a separate malicious campaign, AI tooling compressed the interval between initial access and final impact from days to a few hours. This reinforces Schneier’s principle of “Security is a process, not a product.”
What Steps has India Taken to Tackle Cybersecurity Threats?
  • Strengthening National Coordination and Mandatory Incident Reporting:
    • India has designated CERT-In as its national cyber-incident response agency under Section 70B of the Information Technology Act, 2000.
    • Its 2022 Directions require covered organisations to report specified incidents within six hours of noticing them and retain ICT logs for 180 days, supporting early intervention and forensic investigation.
    • The National Cyber Coordination Centre (NCCC) provides threat intelligence, while the Cyber Multi Agency Centre (CyMAC) brings intelligence, telecom and cybersecurity agencies together to coordinate responses to cyberespionage and other national-security threats.
  • Creating Rapid Financial-Fraud Reporting and Fund-Blocking Mechanisms:
    • The Indian Cyber Crime Coordination Centre (I4C) connects the 1930 helpline, National Cyber Crime Reporting Portal and Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) to accelerate reporting and prevent fraudulent funds from being transferred further.
    • According to the Ministry of Home Affairs, this system had saved over ₹11,158 crore across more than 32.80 lakh complaints by June 2026. Money Restoration and Grievance Redressal modules, operational since April 2026, additionally address victim restitution and grievances concerning frozen accounts.
  • Disrupting Fraudulent Telecom Connections through AI and Citizen Reporting:
    • The Department of Telecommunications uses ASTR, an artificial intelligence and big-data analytics tool, to identify suspicious mobile connections and subject them to reverification. By July 2026, more than 88 lakh connections had been disconnected after failing reverification.
    • Chakshu, available through Sanchar Saathi, enables citizens to report suspected fraudulent communications. Meanwhile, the Digital Intelligence Platform (DIP) facilitates information sharing among telecom authorities, I4C and financial-sector stakeholders, including over 50 SEBI-regulated entities onboarded by July 2026.
    • These measures target the telecom infrastructure supporting impersonation, phishing and financial fraud.
  • Protecting Critical Infrastructure through Sector-Specific Cybersecurity:
    • India established the National Critical Information Infrastructure Protection Centre (NCIIPC) under Section 70A of the IT Act, 2000, to protect critical information infrastructure.
    • Sectoral mechanisms such as CSIRT-Power support threat assessment, incident coordination, security audits and vulnerability mitigation in electricity systems.
    • Protection has also expanded to emerging strategic infrastructure. In February 2026, CERT-In and SIA-India released an advisory cybersecurity framework for space and satellite communications.
      • It addresses satellite networks, ground infrastructure, equipment vendors and supply chains, extending cyber-resilience planning to systems supporting navigation, connectivity and disaster response.
  • Secure Software Supply Chains and AI-Ready Vulnerability Management:
    • CERT-In has issued technical guidance on Software Bills of Materials (SBOMs) and corresponding inventories for hardware, AI and cryptographic components, improving visibility into third-party dependencies. Such inventories help organisations identify which systems contain a newly discovered vulnerable component.
    • In May 2026, CERT-In released a blueprint addressing AI-assisted vulnerability exploitation, followed by June 2026 guidelines for equipment manufacturers and technology providers covering AI-assisted security testing, continuous monitoring, patch management and incident response.
    • These initiatives promote security by design and faster remediation throughout a product’s lifecycle.
  • Improving Interstate Investigations and Digital-Forensic Capacity:
    • I4C’s Samanvaya platform enables police agencies to identify interstate links between cybercrime complaints, while Pratibimb maps suspected offenders and criminal infrastructure for investigators.
    • Seven Joint Cyber Coordination Teams, covering hotspots such as Jamtara and Mewat, address cases spanning multiple jurisdictions.
    • Under the Cyber Crime Prevention against Women and Children scheme, forensic-cum-training laboratories have been commissioned in 33 States and Union Territories.
    • A further investigation-support facility became operational in Assam in August 2025, expanding access to specialised digital-forensic assistance.
  • Developing Specialist Cyber Personnel and Testing Operational Readiness:
    • India’s Cyber Commando programme creates a specialised workforce for complex cyber threats; the Home Ministry reported 281 personnel had completed training by August 2026.
    • The CyTrain platform supplements this through courses on investigation, digital forensics and prosecution, with over 1.63 lakh police and judicial officers registered by June 2026.
    • Preparedness is also tested through simulations. During June–July 2026, CERT-In conducted 10 exercises on frontier AI-driven threats, involving 1,470 participants from 345 government and private organisations across sectors including power, banking, health and space.
  • Extending Affordable Cyber Hygiene to Citizens and Small Enterprises:
    • The Cyber Swachhta Kendra, CERT-In’s botnet-cleaning and malware-analysis service, provides free malware-removal tools, infection alerts and remedial guidance. The government reported 89.55 lakh tool downloads by December 2025, indicating substantial uptake of accessible preventive tools.
    • For smaller businesses, CERT-In issued 15 Elemental Cyber Defense Controls for MSMEs in September 2025, covering measures such as multifactor authentication, least-privilege access, security accountability and periodic access reviews.
    • These initiatives translate cybersecurity into practical actions that households and resource-constrained firms can adopt.
What Critical Gaps Exist in India’s Current Cybersecurity Architecture?
  • Fragmented Federal Jurisdiction and Coordination:
    • Cybercrime investigations frequently span several States, banks and technology platforms, while investigative authority remains divided across jurisdictions.
    • In its 259th Report, presented in August 2026, the Parliamentary Standing Committee on Home Affairs observed that withdrawal of general consent to the CBI by certain States continued to impede timely CBI investigations into interstate and transnational cybercrime.
  • Legislative Obsolescence & Asynchronous Regulatory Evolution:
    • A 2025 Parliamentary Committee report specifically observed that cybercrime laws were scattered across multiple statutes, creating enforcement and judicial difficulties.
    • Its August 2026 follow-up reiterated the need for a formal, periodic, multidisciplinary review mechanism.
  • Fiscal Underutilization & Execution Deficits:
    • Announced funding does not automatically translate into deployed security infrastructure. Under MeitY’s Cyber Security Projects budget head, actual expenditure during 2024–25 was ₹211 crore, against an original allocation of ₹759 crore—approximately 27.8% utilisation.
    • The substantial gap raises questions about project readiness, procurement capacity and implementation timelines, which determine whether financial commitments produce operational protection.
  • Specialized Human Capital Deficits & Asymmetric State Capability:
    • Cyber defence requires expertise in malware analysis, memory forensics, cloud security and cryptocurrency tracing, alongside conventional policing skills.
    • The 2025 Parliamentary report acknowledged shortages of skilled cybersecurity professionals and called for specialised forensic capabilities accessible to enforcement agencies. E.g., India’s cybersecurity sector is grappling with a shortage of nearly 39,000 skilled professionals, particularly in IoT and blockchain.
    • At MeitY’s May 2026 consultation with States and Union Territories, priorities included empowered Chief Information Security Officers, functioning Security Operations Centres and tested departmental crisis plans.
  • Procedural Attrition & Restitution Bottlenecks:
    • Reporting a cybercrime, securing fraudulent funds and returning money to victims involve different legal and administrative stages.
    • A July 2026 Home Ministry reply, covering 2023–24 to 2025–26, reported over ₹9,079 crore marked under lien (frozen by banks), compared with over ₹206 crore refunded.
    • Parliament’s August 2026 recommendation for nationwide NCRP-to-e-FIR integration further highlights weaknesses in the complaint-to-investigation pathway, with consequences for timely victim relief.
  • Extraterritorial Evidentiary Barriers & Delayed MLAT Cooperation:
    • Indian investigators often require account records, IP logs and cloud data held by service providers overseas.
    • The 2025 Parliamentary report, drawing on investigative-agency submissions, identified delays arising from foreign jurisdiction, voluntary platform cooperation and slow Mutual Legal Assistance Treaty processes.
      • Such delays can weaken investigations when evidence is transient or criminal infrastructure changes rapidly.
  • Intermediary Deficits & Fragmented Redressal Architecture:
    • Cybersecurity architecture also depends on whether citizens can obtain effective remedies from digital intermediaries.
    • In August 2026, Parliament’s committee found that the government’s response inadequately addressed uniform complaint formats, public grievance statistics and integration with data-protection requirements.
    • The concern is accountability across the digital ecosystem. Inconsistent redressal and inadequate advertiser verification can leave users exposed even where technical threat-detection mechanisms exist.
How can India Strengthen its Cyber Security Architecture?
  • Establishing Clear National Leadership and a Federal Cybersecurity Compact:
    • India should publish a periodically updated National Cybersecurity Strategy with defined responsibilities, implementation deadlines and a public progress dashboard.
    • A Centre–State cybersecurity compact should establish common incident classifications, escalation procedures and protocols for sharing evidence. During major incidents, a pre-designated lead agency should coordinate technical containment, criminal investigation and public communication. This would strengthen unity of command while preserving States’ policing responsibilities.
  • Linking Cybersecurity Funding to Verified Operational Outcomes:
    • The Union government should introduce multi-year cyber-resilience grants combining assured minimum funding for weaker States with additional support for independently verified improvements.
    • Eligible spending should include shared Security Operations Centres (SOCs) for districts, municipal bodies and public hospitals, supported by standard procurement contracts and technical assistance.
    • Performance should be measured through time taken to detect and contain attacks, overdue vulnerability remediation and successful restoration tests. Funding should reward transparent reporting and sustained improvement.
  • Making Continuity of Essential Services the Core of Critical-Infrastructure Protection:
    • Sectoral regulators should establish enforceable, risk-based minimum controls for electricity, healthcare, transport, telecommunications and water systems.
    • Priorities should include IT–OT network segmentation, inventories of critical assets, tightly controlled vendor access, protected backups and tested manual operating procedures.
      • A hospital, for example, should demonstrate that emergency treatment can continue when its digital systems become unavailable.
  • Building a Skills-Based Cybersecurity Cadre and Public-Service Talent Pipeline:
    • India should create specialist career tracks for digital forensics, incident response, cloud security, industrial-system security and cyber prosecution, with practical assessments and retention incentives.
    • The government agencies should offer paid apprenticeships with supervised investigations, university-linked cyber laboratories and fixed-term industry secondments.
    • Recruitment and promotion should assess demonstrated capability in realistic exercises, alongside academic qualifications and certifications.
  • Using Public Procurement to Enforce Secure-by-Design Products and Safer AI:
    • Government technology contracts should require Software Bills of Materials (SBOMs), signed updates, defined support periods, secure default configurations and vulnerability-remediation commitments.
    • Building on CERT-In’s 2026 AI-related security guidance, AI systems with access to sensitive infrastructure should operate with least privilege, restricted tool permissions and auditable activity records; consequential actions should require human approval.
  • Creating an End-to-End Financial-Fraud Response and Restitution System:
    • India should connect reporting, investigation, bank action and judicial processes through a portable complaint identifier and interoperable digital records.
    • Complaints disclosing cognisable offences should move promptly into the appropriate FIR process, building on Parliament’s 2026 recommendation for nationwide e-FIR integration.
    • Proportionate holds on identifiable disputed amounts, accompanied by review and appeal mechanisms, should minimise unnecessary disruption to innocent account holders.
  • Embedding Privacy, Platform Accountability and Accessible Citizen Protection:
    • Cybersecurity rules should integrate data minimisation, purpose limitation, role-based access and auditable government access to personal information.
    • Practical cyber-safety education should also reach schools, workplaces and assisted-service centres, with accessible reporting support for elderly persons, persons with disabilities and users with limited digital literacy.
  • Accelerating Lawful Cross-Border Evidence Access and Joint Investigations:
    • India should establish a continuously staffed international digital-evidence coordination desk linking investigators, prosecutors, diplomatic missions and overseas service providers.
    • Standard request templates, rapid preservation procedures and electronic tracking should reduce avoidable delays in Mutual Legal Assistance Treaty (MLAT) and Letters Rogatory processes.
    • Bilateral arrangements should distinguish urgent evidence preservation from subsequent disclosure, which must satisfy applicable legal safeguards.
Conclusion
  • As Mikko Hyppönen aptly states, “We are no longer securing computers – we are securing the society.” India must transition from reactive incident response to proactive, intelligence-led cyber defence through coordinated governance, adaptive legislation, skilled personnel and secure digital infrastructure. Effective implementation, adequate fund utilisation, international cooperation and citizen awareness must complement technological investments. Ultimately, a whole-of-government and whole-of-society approach is essential to protect citizens, strengthen trust and sustain India’s digital economy.