How safe is India’s critical national infrastructure?, Pg9

Key Highlights:

• India's critical infrastructure, including power plants, refineries, and transport networks, is increasingly reliant on digital technologies like IoT and AI, enhancing efficiency but also expanding vulnerability to cyber threats.
• The integration of IT, OT, and IoT creates a complex digital landscape where compromised IoT devices can manipulate data or misuse control over physical processes.
• Concerns arise from the deployment of imported devices in sensitive installations without rigorous scrutiny, potentially containing hidden vulnerabilities or malicious pathways.
• Stricter policy enforcement, rigorous certification, preference for trusted indigenous technologies, and continuous vigilance are essential to safeguard India's critical infrastructure.

Detailed Insights:

• Digital transformation has scaled up critical services, improving monitoring and service delivery through the internet, automation, and AI, but has also introduced new cyber risks.
• Cyber-security measures, including laws and agencies like CERT-In, have improved security but do not completely eliminate risks to critical infrastructure.
• The expansion of the internet to include billions of connected devices, such as sensors and industrial controllers, creates opportunities for remote disruption.
• SCADA systems, previously used for local process control, are now increasingly connected to the internet for centralized monitoring, creating a potential weak link if the IoT layer is compromised.
• Atmanirbhar Bharat and Made in India initiatives have not always translated into procurement practices, with tender conditions often lacking stringent requirements for trusted Indian-made products.
• Fuel transportation systems, now using IoT-based e-locking and GPS tracking, can become vulnerable if unverified or dubiously certified devices are used.
• The certification of devices, such as cameras, is essential to ensure they do not perform unintended functions, but the process is onerous and not consistently enforced across all IoT devices.
• Attacks targeting industrial bases, supply chains, and automated infrastructure pose a significant threat to India's economic security.
• Protecting critical infrastructure is a matter of sovereignty, resilience, and economic security, requiring trust, transparency, and strong safeguards in the adoption of connected technologies.

Key Concepts Involved:

• IoT (Internet of Things): A network of interconnected devices that collect and exchange data.
• OT (Operational Technology): Systems that manage physical processes and equipment.
• SCADA (Supervisory Control and Data Acquisition): A system for controlling and monitoring industrial processes.
• CERT-In (Indian Computer Emergency Response Team): A government agency responsible for handling cyber security incidents.