)
According to Symantec’s Internet Security Threat Report (ISTR), India was ranked second on a list of countries targeted the most by cyber criminals through social media last year, after the US. And, new research by F-Secure shows India is the at the top among Asian countries in terms of botnet-related malware. A botnet is a collection of compromised computers infected with malware that allows an attacker to control them.
In a report, the Indian Computer Emergency Response Team said the total number of security-breach incidents, including phishing, virus/malicious code, network scanning/probing, spam and spread of malware through website compromise, was 8,311 in January this year, against 5,987 in November 2014. Also, 2,224 Indian websites were defaced in January, compared with 1,256 in November 2014.
Security experts tracking the segment say the increasing number of internet users in India is attracting cyber criminals, as these are first-time users, who can be duped easily. Add to this the fact that India is also one of the fastest growing markets in terms of smartphone usage.
Tarun Kaura, director (technology sales), India, Symantec, points to the rising instances of ransomware in India. “Ransomware attacks prove beneficial for attackers, as first-time internet users, unaware of the foul play, readily give in to attackers’ mischief, as their files, photos and other important data aren’t backed up. On an average, with one malicious email, attackers could gain $300 to $500 in 2014. In India, a staggering 86 per cent of ransomware is crypto- ransomware,” he said.
Ransomware is a type of malware that restricts access to the device it infects, and demands a ransom paid to the creators of the malware for the restriction to be removed.
ISTR stated last year, India recorded 170 ransomware attacks a day, or about 60,000 such attacks during the entire year. This means on an average, seven internet users in India faced ransomware attacks every hour.
Another factor is the huge impetus of the government to invest in technology. According to research and advisory firm Gartner, this year alone, the Centre will invest about $6.8 billion in upgrading its information technology requirements. Experts say cyber warfare is fast becoming a reality and India will also be targeted.
Another reason for the increase in such attacks is the perception with which security is still seen by the government and enterprises, in terms of the budget. Kartik Shahani, country manager (India and the South Asian Association for Regional Cooperation), RSA, says of the overall IT budget in India, that for security is only two-five per cent. For some developed countries, this is 8-10 per cent. With restricted budgets, innovation and decision-making takes a backseat.
Cyber security expert Vijay Mukhi agrees with Shahani. “The reason India is a sweet spot for cyber criminals is companies and the government do not spend money on protecting themselves in cyberspace. This leaves India vulnerable to global hackers. As a country, we do not spend enough on creating a police force that understands cyber crime and our legal system is too slow in convicting cyber criminals.”
Experts also point to a dilemma making such security take a backseat: If a platform is too stringent, you will have few users. When it is flexible, usage is high, as are issue such as security threats. An example is Andorid vs iOS: while Android has huge user base, it has a high incidence of security threats, too.
“We are still looking at parameter security, which needs anti-virus, some basic detection tools, etc. These are required but they are static. What we need is technology that gives better visibility, which uses contextual intelligence and has better identity and authentication tools. Such technology is available today. Are we using it? The answer is ‘no’,” says Shahani.
Another missing link hampering India’s security needs is ethical hackers, or those who hack within systems to make those more robust. They are a crucial segment for enterprises and government. The last count of the number for ethical hackers India needed was about 500,000; sources say today, the country has only 25,000-30,000. Mukhi said the salaries for ethical hackers are so low in India that many prefer to go abroad.
Symantec said in 2014, 60 per cent of targeted attacks were aimed at large enterprises in India. Among large enterprises, key sectors such as financial services (17.1 per cent, up from 11.1 per cent in 2013) continued to receive targeted attacks. Emerging sectors such as non-traditional services (40.5 per cent, up from 0.58 per cent in 2013) and with transport and communications (4.4 per cent, up from 0.8 per cent in 2013) have also seen a substantial increase in targeted attacks. Last year, 34 per cent of all targeted attacks were aimed at smaller businesses.
Currently, Kaspersky Lab detects 325,000 new malicious files every day. Altaf Halde, managing director (South Asia), Kaspersky Lab, says the threat landscape and targets have changed in the recent past. Today, cyber criminals are focusing less on theft of financial information and more on business espionage and accessing government information. “In the past, India was a target of cyber-attacks for political motivation alone. Until recently, malware, spam emails, hacking into corporate sites and other attacks of this nature were mostly the work of computer ‘geniuses’ showcasing their talent. These attacks, which were rarely malicious, have gradually evolved into cyber crime syndicates, siphoning money through illegal cyber channels,” he says.
TANGLED IN THE WEB
-
Stands 2nd in social media scams
-
Third in Asia for ransomware attacks
-
India is the 16th most Bot-infected country
-
34% of cyber attacks here were targeted at small businesses
- India saw seven ransomware attacks an hour in 2014 — 170 a day and 60,000 a year
