Cyber warfare is the use of computer technology to disrupt the activities of a state or organisation. The chapter describes it as the deliberate attacking of information systems for strategic or military purposes, including disruption or destruction of an adversary’s information and communication systems.
The chapter explains that cyber warfare has developed with information technology and the increased use of cyberspace. Its purpose is not only to disturb systems, but also to obtain information about an adversary while limiting what the adversary knows. Cyber warfare can involve both offensive and defensive operations connected with cyber attacks, espionage and sabotage.
It is defined as actions by a nation-state to penetrate another nation’s computers or networks for causing damage or disruption. The chapter also notes that definitions may include non-state actors such as terrorist groups, companies, political or ideological extremist groups, hacktivists and transnational criminal organisations.
- Strategic or military purpose: Information systems may be attacked to achieve a strategic aim.
- Offensive and defensive capability: Nations develop capabilities both to conduct operations and to defend themselves.
- Formalised capability: The chapter calls cyber warfare a formalised version of penetration testing when a government establishes it as a warfighting capability.
- National objectives: Prevent attacks on critical infrastructure, reduce national vulnerability, and minimise damage and recovery time.
- Use computer technology against information systems.
- Penetrate or disrupt the adversary’s computers or networks.
- Seek information, cause disruption or carry out sabotage according to the strategic purpose.
- Use defensive measures to reduce vulnerability and limit damage and recovery time.
Textbook point: The chapter notes that there is controversy over whether such activities should be called “war”, but nations have nevertheless developed cyber warfare capabilities and may engage as aggressors, defenders or both.
The lesson begins with cyber warfare because increased dependence on cyberspace creates a new form of warfare that adversaries can use for strategic and military purposes.
Cyber Crime is a crime in which the use or knowledge of a computer is required to cause damage. Cyber Security is the evolution of policies and procedures to protect one’s information and information system.
| Threat | Basic Meaning from the Chapter |
|---|
| Cyber Attack | Intrusion in which immediate damage or disruption is the main concern. |
| Cyber Espionage | Intrusion intended to provide needed information. The chapter treats cyber espionage as generally ongoing between major powers, though incidents may create serious tensions. |
| Cyber Sabotage | Disruption of systems or equipment through compromised computers, satellites or other vulnerable components. |
| Cyber Propaganda | Control of information and influence over public opinion through social media, fake-news websites and other digital means. |
For cyber espionage, the chapter gives examples including the spying revelations associated with Edward Snowden, the NSA’s spying on Germany’s Chancellor Angela Merkel, recording of cell-phone conversations in the Bahamas, the “Titan Rain” probes of American defence contractors’ computer systems, and the US Office of Personnel Management data breach that the text says was widely attributed to China.
For cyber sabotage, the chapter identifies military command-and-control systems, power, water, fuel, communications and transportation infrastructure as potentially vulnerable. It also mentions civilian targets such as the electric power grid, trains and stock exchanges.
Cyber propaganda is described as a form of psychological warfare using digital means. The internet can carry a message to a very large audience, and the chapter states that terrorist organisations use this medium to brainwash people and recruit potential members.
The four threat types form the main classification stated in the lesson and are directly linked to the chapter’s objective of recognising cyber threats.
- Growth of internet use: The network-centric environment has seen phenomenal growth of internet usage, making cyberspace vulnerable to various crimes.
- Technology advancement: Sophisticated computer tools are now common to users as well as adversaries.
- Under-reporting: Victims may hesitate to admit attacks to avoid rumours or damage to reputation, such as in banks.
- Growing dependence: Increasing dependence on e-commerce and networked solutions to optimise resources has also increased vulnerability.
| Category | Chapter Description | Example / Area |
|---|
| Fraud and Forgery | Cyber crime primarily evident in commerce and economy. | Commerce and economy |
| Damage / Modification | Damage to or modification of computer data or programme. | Private, public or defence establishments such as ATC and radar systems |
| Unauthorised Access / Surveillance | Unauthorised access to computer systems and surveillance. | Phishing, spyware and data spoofing |
| Unauthorised Reproduction | Unauthorised reproduction of computer programmes. | Piracy |
- Hacker: A computer user who intends to gain unauthorised access to a computer system.
- Cracker: A hacker with criminal intent who maliciously sabotages computers, steals information and disrupts networks for personal or political motives.
- Insider: A disgruntled current or former employee who may use knowledge of an organisation’s network to gain unrestricted access, cause damage or steal sensitive data.
- Terrorist: Uses IT and the internet to plan and execute activities, raise funds, spread propaganda or shut down critical national infrastructure to force or intimidate a government or civil population.
- Foreign Intelligence Services: Use cyber tools as part of espionage to acquire sensitive information about an adversary.
- Viruses and Worms: Viruses execute within a host program; worms are more complex programs that execute independently.
- Trojan Horses: Programs that work in disguise; an unauthenticated program may be contained within a legitimate program and perform functions unknown to the user.
- Logic / Knowledge Bombs: Hidden functions that become active when triggered.
- Knobots: Also called Knowledge Robots; they keep processed data and continue storing knowledge.
- Adware: A program that can be embedded in useful programs and produces pop-ups while in use, creating nuisance.
- Spyware: A program embedded with a useful program and generally designed to collect information such as web-surfing habits, preferences and e-mail without the user’s consent.
This section connects the growth of cyber crime with its categories, the people or groups who may carry it out, and the types of programmes used to commit it.
The chapter says adversaries may send numerous e-mails to internet users for cyber hacking. Such mails generally contain spyware that can harm host computers, share or retrieve data stored on the hard disk, and sometimes crash the computer. Spyware can also facilitate remote administration of the host computer.
After penetration, a hacker may install spyware to regain access at will, or install a malicious programme that collects information and downloads files through the internet. The chapter stresses that antivirus alone is not enough for all rogue programmes because viruses are designed to propagate openly while spyware is designed to propagate by stealth.
- Poor system performance.
- Abnormal system behaviour, such as frequent restarts or hangs.
- Unknown services running.
- Crashing of applications.
- Changes in file extensions or contents.
- Hard disk busy or its light glowing continuously.
| Measure | Textbook Guidance |
|---|
| Latest OS / Application Patches | Install the latest patches from a trusted website only. |
| Good Firewall | Acts as the first line of defence by alerting the user when an application or programme tries to connect to the PC over the internet. |
| Internet Security Suite | Combines antivirus, antispyware, firewall, parental controls and related functions; alternatively use antivirus plus antispyware and update virus signatures periodically, preferably daily. |
- It cannot protect against malicious insiders, including spoofing attacks.
- It cannot protect against connections that do not go through the operating system, such as backdoors.
- It cannot protect against e-mail-borne viruses.
The chapter uses penetration, infection indications and remedial measures to show how cyber attacks may affect systems and what precautions users can take to keep systems safe.
The chapter states that the Department of Information Technology created the Indian Computer Emergency Response Team (CERT-In) in 2004 to thwart cyber attacks in India. It later describes NCIIPC, the National Critical Information Infrastructure Protection Centre, as a new subdivision created to thwart attacks against critical and sensitive areas.
- 2004: CERT-In was created; the chapter reports 23 cyber security breaches that year.
- 2011: The chapter reports 13,301 cyber security breaches.
- Critical infrastructure protection: NCIIPC was created to address threats to energy, transport, banking, telecom, defence, space and other sensitive areas.
- 2 July 2013: The government unveiled the National Cyber Security Policy 2013.
- Protect information infrastructure in cyberspace.
- Reduce vulnerabilities.
- Build capabilities to prevent and respond to cyber threats.
- Minimise damage from cyber incidents.
- Create a secure cyberspace ecosystem.
- Strengthen the regulatory framework.
The chapter states that these aims are achieved through a combination of institutional structures, people, process, technology and cooperation.
CERT-In is designated as a nodal agency for coordination of crisis-management efforts. It also acts as an umbrella organisation for coordination actions and the operationalisation of sectoral CERTs.
Textbook recall: CERT = Computer Emergency Response Team; ICT = Information and Communication Technology; NCIIPC = National Critical Information Infrastructure Protection Centre.
The final part of the chapter connects national institutions and the National Cyber Security Policy with protection, response capability, reduction of vulnerabilities and coordination during cyber incidents.
Cyber warfare uses computer technology to disrupt a state or organisation for strategic or military purposes. Remember: the chapter connects it with deliberate attacks on information and communication systems and with both offensive and defensive operations.
Learn the four types exactly: cyber attack—immediate damage/disruption; cyber espionage—information gathering; cyber sabotage—system disruption; cyber propaganda—control of information and influence of public opinion.
A hacker intends to gain unauthorised access. A cracker is a hacker with criminal intent who may sabotage computers, steal information and disrupt networks. The chapter separately identifies insiders, terrorists and foreign intelligence services as attackers.
The chapter says viruses are designed to propagate openly, while spyware is designed to propagate by stealth. Therefore antivirus alone is not enough to detect all rogue programmes; spyware needs different detection technology.
CERT-In coordinates crisis-management efforts; NCIIPC addresses critical infrastructure protection. The National Cyber Security Policy 2013 aims to protect information infrastructure, reduce vulnerabilities, build response capability and minimise cyber-incident damage.