UPSC Mains 2017 GS Paper 3 Q9: model answer
Discuss the potential threats of Cyber attack and the security framework to prevent it.
What the question wants
Discuss the possible threats of cyber attacks and the security framework to prevent them.
How to structure it
Threats, then framework.
- Types of threats
- Legal and institutional framework
- Gaps
How to think it through
Threats: malware, ransomware (WannaCry May 2017 hit AP police systems), phishing, DDoS, APTs, data breaches, attacks on critical infrastructure, financial fraud. Framework: IT Act 2000/2008 (66F cyber terror, 70 protected systems), NCSP 2013, CERT-In, NCIIPC, Cyber Swachhta Kendra, sectoral CERTs, RBI cyber framework 2016, crisis management plan, CISO in ministries, I4C later.
Model answer
In May 2017, the WannaCry ransomware locked computers in over 150 countries. In India, some police computers in Andhra Pradesh were hit. It showed that a cyber attack does not need a war to cause harm.
Potential threats
- Ransomware that locks data for money.
- Phishing to steal passwords and bank details.
- DDoS attacks that crash websites and services.
- Advanced persistent threats by state actors spying on defence and government networks.
- Attacks on critical infrastructure: power, banking, telecom, transport.
- Data breaches of citizens' personal data.
The security framework
- IT Act, 2000: Section 66F on cyber terrorism and Section 70 on protected systems.
- NCSP, 2013.
- CERT-In and sectoral CERTs.
- NCIIPC for critical systems.
- Cyber Swachhta Kendra for botnet cleaning.
- A Cyber Crisis Management Plan and CISOs in ministries.
- RBI's cyber security framework (2016) for banks.
Gaps
- Low awareness and weak security in small firms.
- Skill shortage and slow incident reporting.
- Imported equipment whose security cannot always be checked.
Cyber security is a chain; one careless click is enough to break it.
Draw: A threat-shield diagram: threats on the left, framework layers on the right.
Keywords, cases and data to drop in
WannaCry May 2017, ransomware, phishing, DDoS, APT, critical infrastructure, IT Act 66F and 70, NCSP 2013, CERT-In, NCIIPC, Cyber Swachhta Kendra, Cyber Crisis Management Plan, CISO, RBI framework 2016.
Where most answers lose marks
- Writing a list of threats with no framework, or a framework with no threats.
Related Mains PYQs
- Explain how fake news and disinformation pose threat to Internal Security and Public Order in Indian context? In this regard, discuss salient… UPSC 2026 · GS-III
- Describe the context and salient features of the Digital Personal Data Protection Act, 2023. UPSC 2024 · GS-III
- Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the… UPSC 2024 · GS-III
- What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India… UPSC 2022 · GS-III
Fresh examples from current affairs
Vehicle data sold for ₹5: Centre orders CERT-In audit of VAHAN, SARATHI and e-Challan portals
The Ministry of Road Transport and Highways has asked CERT-In, India’s cyber-security agency, for a forensic audit of its VAHAN, SARATHI, e-Challan and pollution-certificate portals. A security firm found that owners’ names, addresses and phone numbers were being sold through apps and a Telegram channel for as little as ₹5. On the same day, The Hindu reported a separate leak of film certification records. For you, this connects cyber security, the right to privacy and the Digital Personal Data Protection Act, 2023.
UPSC angle: Prelims: CERT-In, Section 70B IT Act, VAHAN/SARATHI, Puttaswamy, DPDP Act 2023, GDPR. · Mains GS-III: cyber security and data protection.
25 Oct 2026
eMudhra weak-key flaw: browsers block 8 certificates; what it means for India’s web trust
Google, Mozilla, Apple and Microsoft have blocked eight intermediate certificates of Bengaluru-based eMudhra, India’s largest certifying authority, after a researcher found their private keys were tiny numbers between 1 and 256 instead of proper 384-bit keys. eMudhra revoked them, CERT-In issued an advisory on 21 October 2026 and MeitY set up a special team. India’s regulated digital signatures and eSign are unaffected.
UPSC angle: Prelims: CCA, CERT-In, TLS, eSign. · Mains GS-III: cyber security, digital trust, data protection.
22 Oct 2026
Open-weight AI models: why Big Tech gives them away and what it means for India
In October 2026 alone, Reflection AI, Meta, NVIDIA and Mistral released or announced open-weight AI models. The Hindu explained on 20 October why firms spend heavily and then let anyone download the weights: to win developers, set standards and earn from cloud, chips and services. For India, open weights offer a base to build Indian-language AI, but they also bring safety risks.
UPSC angle: Prelims: weights, open-weight vs open-source, IndiaAI, AI4Bharat. · Mains GS-III: AI sovereignty, safety and regulation.
21 Oct 2026
Supreme Court: children have a right to the internet, and platforms must block child abuse material
In a judgment of 15 October 2026, the Supreme Court said that the right to access and use the internet is a fundamental right of every person, children included, under Article 21 read with Article 19(1)(a). So the answer to online danger is not to lock children out but to go after the abusive content and the platforms that fail to remove it. The Court ordered a National Hash and URL List Database, two-hour reporting of unknown abuse material, and loss of revenue for platforms that profit from it through paywalls.
UPSC angle: Prelims: Arts. 21 and 19(1)(a); POCSO s.15; IT Act ss.67B and 79; CSEAM. · Mains GS-II: rights of children, regulation of platforms.
18 Oct 2026Learn the concept
Question text as printed in the official UPSC Civil Services (Main) question paper. The model answer is original Battle IAS work; use it to learn structure, not to memorise.
Want every PYQ in one place? See the Battle IAS PYQ Book.