India conducts national cyber defence exercise to safeguard critical infrastructure amid escalating threats

India's national security agencies, in collaboration with the tri-services, are presently engaged in a weeklong cyber defense exercise to assess the durability of India's essential civilian and military infrastructure, as stated by knowledgeable officials. With the threat of cyberattacks from China and other adversaries intensifying daily, the exercise is aimed at testing the resilience of India's critical infrastructure. 

Led by the Defence Cyber Agency (DCyA), the cybersecurity drills involve the participation of various branches of national security, all focused on evaluating the effectiveness of the protective firewalls that safeguard India's vital infrastructure. While the government maintains a discreet stance on the matter, these efforts underscore the significance placed on fortifying India's critical assets against potential cyber threats.

Following collaborative cybersecurity efforts within the Quad framework, a recent cyber defense exercise has been initiated in response to the discovery of Chinese sleeper malware in Australian and Japanese networks, as revealed by US cyber experts. The identified malware is typically implanted within critical networks, remaining dormant for extended periods. 

Activation of the bug by China allows for potential disruption of critical infrastructure or extraction of confidential data, as explained by an official familiar with the matter.

China-based hackers were responsible for the cyberattack on five servers of AIIMS in Delhi on November 23, 2022. The subsequent cyber post-mortem revealed that the malware designed to steal medical records had been implanted in the servers as far back as 2014. On the military front, during the Pakistani retaliation to the 2019 Operation Bander, the adversary targeted the 25-infantry division of the Indian Army stationed in Poonch. Operation Bander was initiated by the Indian Air Force (IAF) on February 26, 2019, to eliminate a Jaish-e-Mohammed terrorist training camp in Balakot, Khyber-Pakhtunkhwa. The IAF conducted this operation in response to the killing of 40 CRPF troopers in Pulwama on February 14, 2019, by a Jaish suicide bomber. As part of their retaliation, Pakistan launched missiles at the Indian Army's brigade in Poonch on February 27, 2019.

Quad countries are increasingly recognizing the significance of cybersecurity collaboration, as demonstrated by the recent agreement among the four leaders during their meeting in Hiroshima. They have pledged to work together to strengthen regional capabilities and resilience in response to cyber incidents and threats. As part of these efforts, the Quad cyber challenge was organized this year, aiming to raise cyber awareness and empower participants across the Indo-Pacific region to effectively safeguard themselves in the online realm.

The Quad nations have collaboratively established the Quad joint principles for secure software and Quad joint principles for cybersecurity of critical infrastructure. Furthermore, efforts are underway to formulate a framework aimed at ensuring the cybersecurity and resilience of supply chains. These principles are specifically designed to enhance regional defenses against cyber threats targeting software supply chains, the digital economy, critical infrastructure, and services.

Although the Indian national security agencies and tri-services network are safeguarded through air gap measures and standalone servers, the Union government servers managed by the National Informatics Centre (NIC) frequently face cyber attacks and compromises from adversaries seeking to obtain confidential information and intelligence using implanted malware. In response to the expanding digital landscape of the Indian economy, security strategists are evaluating the national networks to enhance their resilience by implementing more robust firewall architecture.