Cyber Security Threats, Elements and Cyber Warfare: The Basics

Meaning and Elements of Cyber Security

Confidentiality, Integrity and Availability

Every cyber security measure protects one or more of three properties of information, known together as the CIA triad. The idea was first set out in the Anderson Report of 1972, and the abbreviation came into use around 1986.

• Confidentiality: Information is seen only by those allowed to see it. It means preserving authorised restrictions on access and disclosure, including the protection of personal privacy and proprietary information. Stolen passwords, leaked medical records and espionage break confidentiality.
• Integrity: Information is not improperly modified or destroyed, and its origin can be trusted. A changed bank balance, a forged order or a corrupted reading in a power station breaks integrity.
• Availability: Authorised users get timely and reliable access to information and services. A website knocked offline or a hospital whose records are locked by ransomware has lost availability.

Many organisations add further goals, such as authenticity, accountability and non-repudiation, which means that the sender of a message cannot later deny having sent it. The triad still gives the simplest test of any attack, which is to ask which of the three properties it breaks. Ransomware attacks availability, spyware attacks confidentiality, and an intruder who alters data attacks integrity.

Elements: Network, Application, Data, Endpoint, Cloud and Critical Infrastructure Security

The elements of cyber security are the layers of a digital system, each with its own defences. The guidelines on information security practices for government entities issued in June 2023 by the Indian Computer Emergency Response Team (CERT-In) cover data security, network security, identity and access management, application security, third-party outsourcing, hardening procedures, security monitoring, incident management and security auditing. By the part of a system they protect, the elements form six layers; the processes in the CERT-In list run across all of them.

• Network security: It guards the links between computers through firewalls, segmentation of networks and encrypted tunnels. A virtual private network (VPN) extends a private network across a public network such as the Internet through encryption and tunnelling, so that staff working off-site reach the office network securely.
• Application security: It removes weaknesses from software before and after release. CERT-In issued guidelines for secure application design, development, implementation and operations in September 2023.
• Data security: It protects information at rest and in transit, mainly through encryption and backups. In end-to-end encryption, only the sender and the intended recipients can read a message; not even the service provider holds the keys.
• Endpoint security: It protects the devices people use, such as computers, phones and servers. The National Informatics Centre has deployed Unified Endpoint Management and Endpoint Detection and Response tools across central ministries and departments.
• Cloud security: It protects data and applications held on servers run by a cloud provider, under a model in which the provider and the user each answer for part of the security.
• Critical infrastructure security: It protects the computer systems whose failure would cripple the country, such as power grids, banking and telecom networks.

These layers work only with the people and processes around them. Identity and access management decides who may enter which system. Security monitoring and incident management detect an attack and contain it. Audits test the defences, and CERT-In's Comprehensive Cyber Security Audit Policy Guidelines of July 2025 require a cyber security audit at least once a year. Awareness of users matters because many attacks begin with a person opening a message or a link.

Types of Cyber Security Threats

Malware, Ransomware and Phishing

Malware, short for malicious software, is any software intentionally designed to disrupt or damage a computer, server or network, leak private information, gain unauthorised access to systems or deny users access to their information. It comes in several forms:

• Virus: It attaches itself to a legitimate program or file and spreads when that file is shared.
• Worm: It is a standalone program that copies itself to spread from one computer to others without any action by the user.
• Trojan horse: It disguises itself as a normal program so that the user installs it; many Trojans then open a backdoor for a remote controller.
• Spyware: It gathers information about a person or organisation and sends it to another party, often through keyloggers that record every key pressed.

Ransomware is malware that holds a victim's data hostage until a ransom is paid. It usually encrypts the files, and newer variants also steal the data and threaten to publish it. Payment is demanded in cryptocurrency because it is harder to trace. A victim that keeps offline backups can restore its files without paying. India reported 147 ransomware incidents in 2024.

The WannaCry attack of 12 May 2017 showed how fast ransomware can travel. A worm spread it to more than 3,00,000 computers across 150 countries using EternalBlue, an exploit that the United States National Security Agency developed for a weakness in Microsoft Windows and that a group called the Shadow Brokers leaked. Microsoft had already issued a patch, so the computers hit were mostly those that had not applied it. In December 2017, the United States and the United Kingdom formally stated that North Korea was behind the attack; North Korea denied any involvement.

A variant of the Petya ransomware, called NotPetya, used the same exploit in June 2017. It carried no working way to unlock the files, so it acted as a wiper that simply destroyed data. In India, all operations at the Jawaharlal Nehru Port Trust (JNPT), then India's largest container port, were reported to have come to a standstill on 28 June 2017.

Phishing is a form of social engineering in which attackers pose as a trusted bank, company or person to trick people into revealing passwords or bank details, or into installing malware. Its forms include bulk email phishing, spear phishing aimed at a chosen person or group, whaling aimed at senior executives, voice phishing (vishing) and SMS phishing (smishing). Phishing is a common first step in larger attacks, since a single opened attachment can deliver ransomware into a whole network.

Denial of Service and Botnets

A denial-of-service (DoS) attack prevents authorised users from reaching a service, or delays operations that depend on time. The simplest form floods the target with more traffic than its connection or servers can handle. In a distributed denial-of-service (DDoS) attack, the flood comes from many sources at once, often thousands of computers infected with malware, so blocking a single source does not stop it. Banks, payment gateways and government portals are common targets, and the motive may be extortion, revenge or protest.

The machines that send such floods usually form a botnet, a word made from "robot" and "network". A botnet is a group of Internet-connected devices, such as computers, smartphones or Internet of Things devices like cameras and routers, whose security has been breached and whose control has passed to an attacker. The controller, called a bot herder, directs them through command-and-control software. The Mirai botnet of 2016 used a worm to take over hundreds of thousands of poorly protected Internet of Things devices. A botnet can also send spam, steal data and spread further malware, and its owners often rent it out to others.

The 2007 attacks on Estonia showed how DDoS can be used against a whole country. From 27 April 2007, websites of Estonia's parliament, banks, ministries, newspapers and broadcasters were hit during a dispute with Russia over the relocation of the Bronze Soldier, a Soviet-era grave marker in Tallinn. Estonia's government blamed the Kremlin but later admitted that it had no evidence of direct involvement; Russia called the accusations unfounded. The attacks led to the creation of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn.

India's main answer to botnets is the Cyber Swachhta Kendra, CERT-In's Botnet Cleaning and Malware Analysis Centre. It sends daily alerts on infected devices to organisations and offers free removal tools, which had been downloaded 89.55 lakh times by December 2025.

Advanced Persistent Threats and Supply-Chain Attacks

An advanced persistent threat (APT) is a skilled, well-resourced attacker, typically a state or a state-sponsored group, that enters a network and stays there undetected for a long time. The three words describe it exactly:

• Advanced: It combines many tools and methods, including intelligence gathering and social engineering, and develops new tools when needed.
• Persistent: It pursues a fixed objective, such as stealing defence plans or preparing to disrupt a grid, and returns if it loses access.
• Threat: It is run by organised, funded people with both the capability and the intent to cause harm.

APTs often rely on a zero-day vulnerability, a flaw in software or hardware that is unknown to its developers and for which no fix exists. Stuxnet, uncovered in June 2010, exploited four zero-day flaws to reach the controllers of the centrifuges of Iran's nuclear programme at Natanz and make them tear themselves apart. It also showed that equipment run by computers not connected to the Internet can still be attacked. Neither the United States nor Israel has admitted building Stuxnet, though several news organisations attribute it to the two.

A supply-chain attack reaches a well-defended target through a less secure supplier, most often by planting malicious code in software or hardware that the target trusts. The SolarWinds attack, acknowledged in December 2020, planted a Trojan in software supplied by the firm SolarWinds and through it reportedly reached several United States federal departments. In India, one of the regional update servers of eScan, an Indian antivirus, was breached on 20 January 2026 and pushed malware to users, mainly in South Asia, for about an hour; it was the second breach of eScan's update system, after one in 2024. Supply-chain attacks are hard to stop because the malicious code arrives through a channel the victim has every reason to trust.

Cyber Warfare and Cyber Terrorism

Cyber Warfare Versus Conventional Terrorism

Cyber warfare is the use of cyber attacks by one state against another, causing harm comparable to traditional warfare. Its aims can be espionage, sabotage, propaganda, manipulation or economic damage. An attack may support a military operation, for example by blinding air defences before an air strike, or it may stand alone, as when a grid or a banking system is shut down. Militaries now treat cyberspace as a domain of conflict alongside land, sea, air and space.

Cyber terrorism is the use of computer networks to carry out or threaten acts that cause loss of life or serious harm, in order to intimidate people for political or ideological ends. Indian law defines it in Section 66F of the IT Act.

Under Section 66F, an act is cyber terrorism when three elements come together:

1. Intent: The act is done to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people.
2. Means: It denies access to a computer resource, enters one without authorisation, or introduces a computer contaminant.
3. Effect: It causes or is likely to cause death or injury, damage to property, disruption of essential supplies and services, or harm to critical information infrastructure.

Unauthorised access to information restricted for reasons of the security of the State also falls within Section 66F. The punishment may extend to imprisonment for life. Ordinary offences such as hacking and fraud are covered by other sections of the IT Act and the Bharatiya Nyaya Sanhita, 2023.

Some defence analysts rank cyber warfare as a larger threat than terrorist groups such as Al Qaeda, because cyber attacks are cheap, reach across borders and are hard to trace to their source.

The case is not one-sided. Cyber attacks have so far rarely caused deaths directly, and the most damaging ones, such as Stuxnet, needed the resources only a state commands. The real danger lies in combination. A terrorist group or a hostile state that pairs a physical attack with a cyber attack on emergency services, power or communications could multiply the harm. Attribution is the hardest problem of all, because without knowing who attacked, a state cannot respond lawfully or deter the next attack.

Cyber Attacks on Energy Networks, Hospitals and During Armed Conflict

Power grids are the most studied target of cyber warfare because every other service depends on electricity. On 23 December 2015, attackers using the BlackEnergy 3 malware took remote control of the systems of three electricity distribution companies in Ukraine and switched off substations, leaving about 2,30,000 people without power for one to six hours. It was the first publicly acknowledged successful cyber attack on a power grid, and it is attributed to an APT group known as Sandworm. Other energy networks are exposed too. In May 2021, a ransomware attack by DarkSide, a criminal hacking group, forced Colonial Pipeline, which carries petrol and jet fuel to the south-east of the United States, to halt all its operations.

Hospitals are targeted because they cannot wait. During WannaCry, up to 70,000 devices of the National Health Service in England and Scotland, including computers, MRI scanners and blood-storage refrigerators, may have been affected. In India, servers of AIIMS, New Delhi, were hit by ransomware on 23 November 2022, reportedly after an employee opened a phishing email. Patient care in emergency, outpatient, inpatient and laboratory wings had to be run by hand, the Delhi Police registered a case of extortion and cyber terrorism on 25 November, and online registration of new outpatients resumed only on 6 December 2022.

Cyber attacks now accompany military conflict. During the India-Pakistan conflict of May 2025, which began with Operation Sindoor, Pakistan's military said it had launched a cyber operation against Indian military satellites, government websites and critical digital infrastructure, and Indian authorities recorded over 15 lakh attempted cyber intrusions. Pakistani media also carried claims of data erased from Indian websites and leaked from Indian institutions, which shows that attacks and unverified claims about attacks travel together in such a conflict.

India's Cyber Vulnerabilities

Critical Information Infrastructure at Risk

Critical Information Infrastructure (CII) is the computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety. Under Section 70 of the IT Act, the appropriate Government may declare any computer resource that affects CII to be a protected system, and anyone who secures or attempts to secure access to it without authorisation can be imprisoned for up to ten years and fined. The National Critical Information Infrastructure Protection Centre (NCIIPC), notified on 16 January 2014 under Section 70A and placed under the National Technical Research Organisation, protects these systems in six critical sectors:

• Power and energy
• Banking, financial services and insurance
• Telecom
• Transport
• Government
• Strategic and public enterprises

Power stations, grids, pipelines and ports in these sectors run on industrial control systems, such as the supervisory control and data acquisition (SCADA) systems that Stuxnet was built to attack. Malware that enters an office network can look for a path to these control systems, which is why the critical network of a plant is kept isolated from the Internet. In 2019, the Nuclear Power Corporation of India Limited (NPCIL) confirmed that malware had been found in the Internet-connected administrative network of the Kudankulam nuclear power plant, while stating that the critical internal network was isolated.

Sector teams add a layer of defence. The power sector now has its own Computer Security Incident Response Team, CSIRT-Power, operational since September 2024, and the financial sector has had CSIRT-Fin since May 2022.

The volume of attacks is rising with India's digital life. Internet subscribers rose from 25.15 crore in March 2014 to 109.27 crore in March 2026, and CERT-In tracked 14,02,809 cyber security incidents in 2021 and 29,44,248 in 2025, more than double in four years. NCIIPC does not publish details of breaches of critical infrastructure on the ground that this would not be in the interest of national security, so the public figures do not show how many incidents touched CII.

Dependence on Imported Hardware and Software

India relies on foreign products for much of its digital equipment and security software, and every imported component is a possible point of entry. A router, a telecom switch or a surveillance camera can carry hidden spying components or malware, or a weakness its maker never discloses. Checking what the country buys needs testing laboratories and skilled people, and the National Cyber Security Policy, 2013, therefore aimed to build infrastructure for testing and validating the security of information and communication technology (ICT) products and a workforce of five lakh cyber security professionals.

The Government's response has been to control the source of equipment. Telecom licences were amended on 10 March 2021 to implement the National Security Directive on Telecommunication Sector, and from 15 June 2021 operators may connect only trusted products to their networks. The Central Electricity Authority's guideline on cyber security in the power sector, released on 7 October 2021, requires power utilities to buy from trusted sources or to test equipment for malware and hardware Trojans before use.

CERT-In's Technical Guidelines on Bills of Materials (Version 2, July 2025) ask organisations to keep a bill of materials, an itemised list of components, for their software, hardware and artificial intelligence systems so that a flawed part can be traced. The Centre for Development of Advanced Computing (C‑DAC) is developing indigenous cyber security tools to reduce dependence on foreign products.

India's Preparedness and Defensive Measures

India's defence against cyber attacks rests on several agencies with distinct roles. The National Cyber Security Coordinator, under the National Security Council Secretariat, coordinates the agencies. CERT-In, the national agency for cyber security incidents under Section 70B of the IT Act, collects and analyses information on incidents, issues alerts and coordinates the response. NCIIPC protects critical information infrastructure. The National Cyber Coordination Centre, run by CERT-In, scans Indian cyberspace for threats.

The Cyber Multi Agency Centre (CyMAC) of the Ministry of Home Affairs links the Intelligence Bureau, CERT-In, NCIIPC and other agencies on cyber terrorism and espionage. The armed forces have the Defence Cyber Agency, a tri-service agency activated in November 2019 and fully functional since August 2021.

In August 2021, the Ministry of Defence told Parliament that a National Cyber Security Strategy was being formulated and was in the final stages of approval. In March 2025, the Government's replies in Parliament still named the National Cyber Security Policy, 2013, as the policy framework for this system. Cyber law itself is not named in any of the three lists of the Seventh Schedule, so it falls under the residuary powers, on which only Parliament can legislate.

Defensive measures against cross-border attacks work at three levels:

• Prevention: Security audits by 237 empanelled auditing organisations, secure-design guidelines, trusted-source rules for equipment, and the Cyber Swachhta Kendra's cleaning of infected devices.
• Detection and response: Threat intelligence shared through CERT-In's automated exchange platform, sector teams for finance and power, and a Cyber Crisis Management Plan that every ministry and State must implement.
• Readiness: Drills and exercises (CERT-In conducted 122 with about 1,570 organisations in 2025), training of officials, and ₹782 crore for cyber security in the 2025‑26 budget.

Gaps remain. Cyber security responsibilities are spread over many ministries and agencies, the public does not see how often critical systems are breached, and attribution of foreign attacks is rarely made official. Most attacks are thought to use known weaknesses rather than zero-day flaws, and phishing is a common way in, so unpatched systems and careless clicks in ordinary offices remain the weakest point.

Cloud Hosting and Government Data

Cloud Versus In-House Hosting: Advantages

Cloud computing is a model that gives on-demand network access to a shared pool of computing resources, such as networks, servers, storage and applications, that can be provided and released quickly with little management effort. Its five essential characteristics are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. The user can rent infrastructure (Infrastructure as a Service, IaaS), a platform for building applications (Platform as a Service, PaaS) or ready applications such as web-based email (Software as a Service, SaaS). A cloud can be private, community, public or hybrid. In-house hosting, by contrast, means a department buys, houses and runs its own servers.

Cloud hosting offers government departments several advantages over in-house servers:

• Elasticity: Computing, memory and storage can be raised or lowered with demand, which avoids both under-sizing and over-sizing of capacity.
• Lower cost: Departments pay per use instead of buying servers in advance.
• Speed: New applications can be deployed rapidly without waiting to procure hardware.
• Professional security: A provider's data centres are built and audited to international security standards that a small department could not easily maintain alone.
• Disaster recovery: Providers offer backup and recovery at another site, so a fire or flood at one data centre need not destroy the data.

In-house hosting keeps one advantage of its own. The department holds the servers physically and controls every layer, which some sensitive systems still require.

Security Implications and MeghRaj Empanelment

Moving government data to the cloud also brings risks:

• Shared infrastructure: Resource pooling serves many customers on the same hardware, so a flaw in the provider's systems can expose several departments at once.
• Location and control: The customer generally has no knowledge of, or control over, the exact place where its data sits, which matters for sovereign and personal data.
• Shared responsibility: Security is split between the department and the provider, and gaps open where neither side assumes a task.
• Dependence on one provider: A department that cannot easily move its data elsewhere is exposed to vendor lock-in; the procurement guidelines of the Ministry of Electronics and Information Technology (MeitY) keep cloud contracts to two years, with an option to extend by one year, because cloud prices may fall and a short contract limits that dependence.
• Concentration: A large cloud becomes a single target, and one successful attack or outage can halt many services together.

India's answer is a government cloud with its own rules. Under the Digital India initiative, the Government of India's national cloud, GI Cloud, named MeghRaj, provides secure, scalable and elastic cloud services for e-governance, with pay-per-use metering and self-service provisioning. The National Informatics Centre offers these services, and by December 2025, 2,170 ministries and departments of the Central and State governments had hosted their cloud-based applications on MeghRaj.

MeitY has also empanelled the cloud services of 26 providers after audit by the Standardisation Testing and Quality Certification (STQC) Directorate against the international standards ISO 27001, ISO 27017, ISO 27018 and ISO 20000. Its procurement guidelines require the network and security operations centres of a cloud environment to be within India, and the National Data Centres protect government clouds through a layered security framework.

Sources

• MeitY: Information Technology Act, 2000
• PIB, Ministry of Home Affairs: Assistance to States to Tackle Cyber Incidents (24 March 2026)
• PIB, Ministry of Electronics and IT: Government Strengthens Cyber Security Preparedness of Central Government Digital Platforms and Citizen Services (14 August 2026)
• PIB, Ministry of Electronics and IT: Government of India Taking Measures to Protect Critical Infrastructure and Private Data Against Cyber Attacks (28 March 2025)
• PIB, Ministry of Electronics and IT: Government Taking Measures to Strengthen National Preparedness Against Cybersecurity Threats (26 March 2025)
• PIB, Ministry of Electronics and IT: Government's Initiatives to Strengthen Security of Cyber Ecosystem, Including Against Ransomware and Cross-Border Cybercrime (17 December 2025)
• PIB Backgrounder: CERT-In, India's Frontline Defender against Cyber Threats (23 January 2026)
• PIB, Ministry of Electronics and IT: India's Cybersecurity Ecosystem Scales New Heights (29 October 2025)
• PIB, Ministry of Home Affairs: Cyber Security Infrastructure (2 December 2025)
• PIB, Ministry of Electronics and IT: Government Has Strengthened the Legal Framework Pertaining to Network Security and Data Protection (25 March 2026)
• PIB, Ministry of Electronics and IT: Government Highlights Digital India Initiatives for Strengthening Digital Infrastructure, Cyber Security and Data Protection (5 August 2026)
• PIB, Ministry of Communications: Rolling Out of 5G Network (14 December 2022)
• PIB, Ministry of Power: Government Releases Guideline for the Cyber Security in Power Sector (7 October 2021)
• PIB, Ministry of Defence: Cyber Warfare (4 August 2021)
• PIB, Ministry of Electronics and IT: India Building Secure, Scalable and AI-Ready Cloud Infrastructure to Support Digital Governance (12 December 2025)
• MeitY: Guidelines for Procurement of Cloud Services
• NIST: Special Publication 800‑145, The NIST Definition of Cloud Computing
• NIST CSRC Glossary: Confidentiality
• NIST CSRC Glossary: Integrity
• NIST CSRC Glossary: Availability
• NIST CSRC Glossary: Denial of Service
• NIST CSRC Glossary: Phishing
• Wikipedia: Information Technology Act, 2000
• Wikipedia: Information security
• Wikipedia: Malware
• Wikipedia: Computer worm
• Wikipedia: Trojan horse (computing)
• Wikipedia: Spyware
• Wikipedia: Ransomware
• Wikipedia: WannaCry ransomware attack
• Wikipedia: Petya (malware family)
• Wikipedia: Phishing
• Wikipedia: Denial-of-service attack
• Wikipedia: Botnet
• Wikipedia: 2007 cyberattacks on Estonia
• Wikipedia: Advanced persistent threat
• Wikipedia: Zero-day vulnerability
• Wikipedia: Stuxnet
• Wikipedia: Supply chain attack
• Wikipedia: 2020 United States federal government data breach
• Wikipedia: Virtual private network
• Wikipedia: End-to-end encryption
• Wikipedia: Cyberwarfare
• Wikipedia: Cyberterrorism
• Wikipedia: Tallinn Manual
• Wikipedia: 2015 Ukraine power grid hack
• Wikipedia: Colonial Pipeline ransomware attack
• Wikipedia: All India Institute of Medical Sciences, New Delhi
• Wikipedia: Operation Sindoor
• Wikipedia: Kudankulam Nuclear Power Plant
• Wikipedia: National Critical Information Infrastructure Protection Centre
• Wikipedia: National Cyber Security Policy 2013
• Wikipedia: Defence Cyber Agency
• Wikipedia: Computer security
• NCERT: Class 11 Political Science: Indian Constitution at Work, Chapter 7
• UPSC: Civil Services Examination question papers