Chapter 3 · Topic 3.1 · Prelims + Mains1 of 3
Communication Networks, Media & Social Networking: Cyber security
Key points
- Cyber security aims at the CIA triad: confidentiality, integrity, availability; the base law is the IT Act, 2000.
- CERT-In (Section 70B) is the national response agency; incidents must be reported within six hours (April 2022 directions).
- Fighting cyber crime: I4C, the 1930 helpline, NCIIPC for critical systems, Kerala's CyberDome; NCSP 2013 is still the only policy.
4 PYQs 2014–2026
Prelims box: facts and traps
- Prelims 2017: service providers, data centres and body corporate must all report cyber incidents (answer d).
- CERT-In works under Section 70B of the IT Act; NCIIPC protects critical information infrastructure.
- Report cyber fraud on the 1930 helpline, run with I4C.
- Trap: the National Cyber Security Strategy (drafted 2020) has not been released; the 2013 policy still applies.
Cyber security basics
Cyber security protects computers, networks, programs and data from attack, damage or unauthorised access. Its three classic goals, the “CIA triad”, are confidentiality (only the right people see data), integrity (nobody changes it secretly) and availability (it works when needed). Like a bank locker: only you open it, nothing is swapped, and it opens when you need it. India’s legal base is the Information Technology Act, 2000. CERT-In (Indian Computer Emergency Response Team) is the national agency for incident response under Section 70B.
UPSC Prelims 2017 asked: In India, it is legally mandatory for which of the following to report on cyber security incidents? The answer was all three: service providers, data centres and body corporate (option d). CERT-In rules of 2013 require reporting, and CERT-In directions of April 2022 set a six-hour reporting window.
In India, it is legally mandatory for which of the following to report on cyber security incidents ? 1. Service providers 2. Data centres 3. Body corporate Select the correct answer using the code given below :
- 1 only
- 1 and 2 only
- 3 only
- 1, 2 and 3
Show answer
Answer: (d) · UPSC official key
Mains 2022 asked: What are the different elements of cyber security? Elements: application security, network security, information security, operational security, disaster recovery and end-user education. India has the National Cyber Security Policy, 2013, but a full National Cyber Security Strategy, drafted in 2020, has not been released, so coverage is partial.
Mains 2017 asked candidates to discuss the potential threats of Cyber attack and the security framework to prevent it. Threats: malware (harmful software), ransomware (locks your files until you pay), phishing (fake messages that steal passwords), attacks on power grids and banks. Framework: CERT- In, the National Critical Information Infrastructure Protection Centre (NCIIPC), sector CERTs and audits.
What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.
Discuss the potential threats of Cyber attack and the security framework to prevent it.
Mains 2013 said cyber warfare is considered by some defense analysts to be a larger threat than even Al Qaeda or terrorism. Cyber warfare is the use of digital attacks by a state or its proxies to disrupt another country’s systems. India is vulnerable through imported hardware, critical infrastructure (power, banking, telecom) and a shortage of skilled staff. The Defence Cyber Agency (2019) and NCIIPC are part of preparedness.
Cyber warfare is considered by some defense analysts to be a larger threat than even Al Qaeda or terrorism. What do you understand by Cyber warfare? Outline the cyber threats which India is vulnerable to and bring out the state of the country’s preparedness to deal with the same.
What UPSC asks: Section 70B, CIA triad.
Cyber crime and policy
Mains 2020 asked candidates to discuss different types of cyber crimes and measures required to be taken to fight the menace.
- Types: financial fraud and phishing, identity theft, ransomware, cyber stalking, child sexual abuse material, and ‘digital arrest’ scams (fraudsters posing as police on video calls).
- Measures: the Indian Cyber Crime Coordination Centre (I4C), the national reporting portal and the 1930 helpline, trained cyber police, and public awareness.
Discuss different types of cyber crimes and measures required to be taken to fight the menace.
Mains 2019 asked: What is CyberDome Project? CyberDome is the Kerala Police’s technology research and development centre for cyber security, run with volunteer experts from industry and academia. It tracks online fraud and child abuse content, runs awareness drives and builds police skills: a model of public-private partnership.
What is CyberDome Project? Explain how it can be useful in controlling internet crimes in India.
Mains 2015 said India needs a “Digital Armed Force” to prevent crimes and asked candidates to critically evaluate the National Cyber Security Policy, 2013. The policy aimed at a secure cyber ecosystem, a 24×7 critical infrastructure centre and 500,000 trained professionals in five years. Challenges: weak funding, skill shortage, overlapping agencies and slow updates. It has not been replaced by a new policy.
Considering the threats cyberspace poses for the country, India needs a “Digital Armed Force” to prevent crimes. Critically evaluate the National Cyber Security Policy, 2013 outlining the challenges perceived in its effective implementation.
What UPSC asks: I4C and 1930, CyberDome (Kerala), NCSP 2013.
Mains box: analysis and answer points
- Elements of cyber security (Mains 2022, 15 marks): six elements, then assess India's partial coverage.
- Cyber crime (Mains 2020): types including digital arrest scams; I4C, 1930, cyber police, awareness.
- NCSP 2013 (Mains 2015): goals vs gaps in funding, skills and coordination.
- Next likely angle: AI-driven fraud and deepfakes.
Practice
Prelims PYQs on this topic (4)
Which of the following statements about Crowdfunding is/are correct ?
- 1. Crowdfunding is solicitation of funds (small amount) from multiple investors through a web-based platform or social networking site for a specific project.
- 2. Small and Medium Enterprises (SMEs) are able to raise funds at lower cost of capital without undergoing rigorous procedures.
Select the answer using the code given below :
Answer (c) & explanation
Both statements are correct (c). Statement 1 is right: crowdfunding means raising small sums from many investors through an online platform or social media for a specific project. Statement 2 is right: it lets start-ups and SMEs raise money at a lower cost and with fewer procedures than a bank loan or public issue. Both lines come almost word for word from SEBI's 2014 consultation paper. So options (a), (b) and (d) fail.
Notice the types: donation-based (like Ketto for medical bills), reward-based, debt-based (peer-to-peer lending, regulated by the RBI since 2017), and equity-based. SEBI has not yet allowed equity crowdfunding in India, warning platforms against it.
Answer as per the official UPSC answer key.
Read the passage
Computers increasingly deal not just with abstract data like credit card details and databases, but also with the real world of physical objects and vulnerable human bodies. A modern car is a computer on wheels; an aeroplane is a computer on wings. The arrival of the “Internet of Things” will see computers baked into everything from road signs and MRI scanners to prosthetics and insulin pumps. There is little evidence that these gadgets will be any more trustworthy than their desktop counterparts. Hackers have already proved that they can take remote control of internet connected cars and pacemakers.
Which one of the following statements best reflects the most critical inference that can be made from the passage given above ?
Answer (a) & explanation
The critical inference is that computers are not completely safe (a). Step 1: the passage says hackers have taken control of connected cars and pacemakers. If such devices can be hacked, computers are not fully safe. That is (a). Step 2: option (b) blames companies for not taking security seriously; the passage does not say this. Option (c) asks for new laws; this also goes beyond the passage. Step 3: option (d), technology will affect our lives, is too vague to be the critical inference.
Tip: the safest inference stays closest to the facts given. Blame and remedies usually go beyond a passage that only reports events.
Answer as per the official UPSC answer key.
In India, it is legally mandatory for which of the following to report on cyber security incidents ?
- 1. Service providers
- 2. Data centres
- 3. Body corporate
Select the correct answer using the code given below :
Answer (d) & explanation
All three must report cyber incidents (d). Under Section 70B of the IT Act, 2000 and the CERT-In Rules, 2013, service providers (1), data centres (2), body corporates (3) and intermediaries must report cyber security incidents to CERT-In (the Indian Computer Emergency Response Team, under MeitY). CERT-In's April 2022 directions set a six-hour reporting deadline. They also require logs to be kept for 180 days, and VPN providers must store user details for five years.
Critical sectors are protected by NCIIPC under Section 70A. Notice the related laws: the Digital Personal Data Protection Act, 2023 and its 2025 Rules, which add a duty to report data breaches to the Data Protection Board.
Answer as per the official UPSC answer key.
The terms 'Marginal Standing Facility Rate' and 'Net Demand and Time Liabilities', sometimes appearing in news, are used in relation to
Answer (a) & explanation
Both terms belong to banking operations (a). The Marginal Standing Facility (2011) lets banks borrow overnight from the RBI in an emergency against government securities, at a rate above the repo rate; it forms the ceiling of the policy corridor. Net Demand and Time Liabilities are a bank's deposits and certain other liabilities; the CRR and SLR are calculated as a share of NDTL. The other options are unrelated fields.
The floor of the corridor is now the Standing Deposit Facility (2022). Notice how these tools let the RBI keep the overnight call rate close to the repo rate.
Answer as per the official UPSC answer key.
Write an answer
In 150 words, explain the significance of Communication Networks, Media & Social Networking with one recent example.
Flashcards (12)
IT Act year?
2000.
CERT-In legal basis?
Section 70B, IT Act.
Incident reporting window (2022)?
Six hours.
Who must report incidents?
Service providers, data centres, body corporate.
National Cyber Security Policy?
2013.
NCSP skill target?
500,000 professionals in 5 years.
Cyber crime helpline?
1930.
CyberDome belongs to?
Kerala Police.
Defence Cyber Agency?
2019.
Blocking power section?
Section 69A.
CIA triad?
Confidentiality, integrity, availability.
NCIIPC protects?
Critical information infrastructure.
Read more: related explainers
In the news
- 25 Oct 2026Vehicle data sold for ₹5: Centre orders CERT-In audit of VAHAN, SARATHI and e-Challan portals
- 23 Oct 2026Prasar Bharati at 29: why India’s public broadcaster still lacks the autonomy its law promised
- 22 Oct 2026eMudhra weak-key flaw: browsers block 8 certificates; what it means for India’s web trust
- 21 Oct 2026Open-weight AI models: why Big Tech gives them away and what it means for India
Next topic · 3.2 →Communication Networks, Media & Social Networking: Social mediaSyllabus: GS-III · Challenges to internal security through communication networks, role of media an…