What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.
Subtopic: Internal Security · cyber security governance
How to structure your answer
Written within the word limit
219 words · target 250 words · 14 min
Cyber security is the protection of information systems, networks, data and users from unauthorised access, disruption or damage. As critical infrastructure, finance, governance and defence digitise, it has become a core dimension of national security.
Elements of cyber security
- Network security — protecting communication infrastructure from intrusion.
- Application and endpoint security — securing software and devices.
- Information/data security — confidentiality, integrity and availability (the CIA triad).
- Operational and critical-infrastructure security — protecting power grids, banking and defence systems.
- Disaster recovery and cyber resilience — continuity after attacks.
- End-user awareness — the human firewall.
Challenges
- Rising attacks — ransomware, phishing, state-sponsored intrusions, and threats to critical infrastructure.
- Shortage of skilled professionals and low cyber hygiene.
- Attribution difficulty, cross-border origin and rapidly evolving technology (AI, IoT).
- Data localisation and jurisdictional gaps.
Examining India's strategy
India has built an institutional scaffolding — the National Cyber Security Policy 2013, CERT-In (with 2022 incident-reporting directions), the National Critical Information Infrastructure Protection Centre (NCIIPC), the Defence Cyber Agency, Cyber Swachhta Kendra, I4C, and the Digital Personal Data Protection Act 2023. However, a promised comprehensive National Cyber Security Strategy (drafted around 2020) has not been formally released. Coordination across agencies remains fragmented, and offensive-defensive doctrine is underdeveloped.
Conclusion
India has laid substantial building blocks but lacks a single, up-to-date, legally anchored National Cyber Security Strategy. Finalising it — with clear coordination, capacity-building and public-private partnership — is essential for genuine cyber resilience.
What an examiner expects to see
- Cyber security elements: network, application/endpoint, data (CIA triad), operational, critical-infrastructure, resilience, user awareness
- Challenges: ransomware/phishing, state-sponsored attacks, skill shortage, attribution difficulty, evolving AI/IoT threats
- National Cyber Security Policy 2013 remains the last formally notified policy
- CERT-In is the nodal agency; 2022 directions mandate 6-hour incident reporting
- NCIIPC protects critical information infrastructure; Defence Cyber Agency for military domain
- I4C and Cyber Swachhta Kendra support cybercrime coordination and hygiene
- A comprehensive National Cyber Security Strategy (drafted ~2020) is still not officially released
- Gaps: fragmented inter-agency coordination, weak offensive-defensive doctrine, capacity shortfalls
Concrete cases, schemes and judgments
- National Cyber Security Policy 2013
- CERT-In April 2022 cyber-incident reporting directions (6-hour rule)
- NCIIPC under NTRO; Defence Cyber Agency (2019)
- Indian Cyber Crime Coordination Centre (I4C) and Cyber Swachhta Kendra
- Digital Personal Data Protection Act, 2023; attacks on AIIMS Delhi (2022) servers