all right so I didn’t know I was the first speaker so anyway so I am talking
first speaker so anyway so I am talking
first speaker so anyway so I am talking about something that is supposed to
about something that is supposed to
about something that is supposed to scare you so I’m going to tell you a
scare you so I’m going to tell you a
scare you so I’m going to tell you a very scary not a doomsday scenario but
very scary not a doomsday scenario but
very scary not a doomsday scenario but close to that so so cybersecurity is
close to that so so cybersecurity is
close to that so so cybersecurity is something that I am passionate about and
something that I am passionate about and
something that I am passionate about and I want to tell you what is cybersecurity
I want to tell you what is cybersecurity
I want to tell you what is cybersecurity is all about what are the cyber threats
is all about what are the cyber threats
is all about what are the cyber threats and why we should care so it all started
and why we should care so it all started
and why we should care so it all started back in 1988 when a Stanford graduate
back in 1988 when a Stanford graduate
back in 1988 when a Stanford graduate student figured out that there is a way
student figured out that there is a way
student figured out that there is a way to exploit vulnerabilities in programs
to exploit vulnerabilities in programs
to exploit vulnerabilities in programs and this was the time when Windows was
and this was the time when Windows was
and this was the time when Windows was not all ubiquitous and therefore he
not all ubiquitous and therefore he
not all ubiquitous and therefore he exploited something called finger daemon
exploited something called finger daemon
exploited something called finger daemon in UNIX and that created the first known
in UNIX and that created the first known
in UNIX and that created the first known worm that very quickly spread it through
worm that very quickly spread it through
worm that very quickly spread it through the network fortunately the world was
the network fortunately the world was
the network fortunately the world was not that interconnected at that time so
not that interconnected at that time so
not that interconnected at that time so therefore it did not cause too much harm
therefore it did not cause too much harm
therefore it did not cause too much harm only in the academic community but it
only in the academic community but it
only in the academic community but it had a lot of fingerprints that are still
had a lot of fingerprints that are still
had a lot of fingerprints that are still there in cyberattacks
there in cyberattacks
there in cyberattacks so then 2001 so between 1998 and 2001 it
so then 2001 so between 1998 and 2001 it
so then 2001 so between 1998 and 2001 it was not that bad and then in 2001 there
was not that bad and then in 2001 there
was not that bad and then in 2001 there were subsequent storms like Code Red
were subsequent storms like Code Red
were subsequent storms like Code Red NIEM des and blasted worm they actually
NIEM des and blasted worm they actually
NIEM des and blasted worm they actually took the internet by storm by then we
took the internet by storm by then we
took the internet by storm by then we were quite quite a bit interconnected a
were quite quite a bit interconnected a
were quite quite a bit interconnected a lot of people were actually connected by
lot of people were actually connected by
lot of people were actually connected by their desktops and and so in some cases
their desktops and and so in some cases
their desktops and and so in some cases servers and so on so any kind of effect
servers and so on so any kind of effect
servers and so on so any kind of effect on people’s computers as well as the
on people’s computers as well as the
on people’s computers as well as the internet was quite problematic by 2001
internet was quite problematic by 2001
internet was quite problematic by 2001 then 2003 the SQL slammer now until then
then 2003 the SQL slammer now until then
then 2003 the SQL slammer now until then most of the attacks were filed based so
most of the attacks were filed based so
most of the attacks were filed based so you download a file and then that file
you download a file and then that file
you download a file and then that file would execute certain things on your
would execute certain things on your
would execute certain things on your machine and that might create too much
machine and that might create too much
machine and that might create too much traffic on the internet and this kind of
traffic on the internet and this kind of
traffic on the internet and this kind of stuff this was the first worm that was
stuff this was the first worm that was
stuff this was the first worm that was not even filed based it was completely
not even filed based it was completely
not even filed based it was completely memory based so nothing was stored on
memory based so nothing was stored on
memory based so nothing was stored on the file system or on the disk and this
the file system or on the disk and this
the file system or on the disk and this basically exploited SQL Server Microsoft
basically exploited SQL Server Microsoft
basically exploited SQL Server Microsoft SQL Server that was that had a buffer
SQL Server that was that had a buffer
SQL Server that was that had a buffer overflow problem and this had a huge
overflow problem and this had a huge
overflow problem and this had a huge effect on the internet so this kind of
effect on the internet so this kind of
effect on the internet so this kind of shows you know how this thing spreaded
shows you know how this thing spreaded
shows you know how this thing spreaded very very quickly and people were quite
very very quickly and people were quite
very very quickly and people were quite disabled by the slammer worm so then
disabled by the slammer worm so then
disabled by the slammer worm so then things started evolving the attackers
things started evolving the attackers
things started evolving the attackers got more and more clever
got more and more clever
got more and more clever so Trojans are viruses or worms that
so Trojans are viruses or worms that
so Trojans are viruses or worms that stay inside your machine and then will
stay inside your machine and then will
stay inside your machine and then will do something harmful but you wouldn’t
do something harmful but you wouldn’t
do something harmful but you wouldn’t see it so at least not immediately so
see it so at least not immediately so
see it so at least not immediately so Trojans started affecting machines and
Trojans started affecting machines and
Trojans started affecting machines and these Trojans would create a back door
these Trojans would create a back door
these Trojans would create a back door backdoor channel to a command and
backdoor channel to a command and
backdoor channel to a command and control center and that started creating
control center and that started creating
control center and that started creating this idea of a botnet so the botnet era
this idea of a botnet so the botnet era
this idea of a botnet so the botnet era started and these botnets are machines
started and these botnets are machines
started and these botnets are machines sometimes are called zombie machines
sometimes are called zombie machines
sometimes are called zombie machines they were recruited by infecting any
they were recruited by infecting any
they were recruited by infecting any users machine could be your machine it
users machine could be your machine it
users machine could be your machine it could be my machine by Trojans and they
could be my machine by Trojans and they
could be my machine by Trojans and they would create a backdoor towards the
would create a backdoor towards the
would create a backdoor towards the command command and control center and
command command and control center and
command command and control center and then they would do various things and it
then they would do various things and it
then they would do various things and it started because of spamming spamming of
started because of spamming spamming of
started because of spamming spamming of emails but now botnets are used for
emails but now botnets are used for
emails but now botnets are used for various other purposes including DDoS
various other purposes including DDoS
various other purposes including DDoS attack or distributed denial of service
attack or distributed denial of service
attack or distributed denial of service attacks so here is a kind of a list so
attacks so here is a kind of a list so
attacks so here is a kind of a list so one of the most famous one on top you
one of the most famous one on top you
one of the most famous one on top you can see is a Zeus worm that was used for
can see is a Zeus worm that was used for
can see is a Zeus worm that was used for making a lot of money from various US
making a lot of money from various US
making a lot of money from various US banks and the guy who was involved in
banks and the guy who was involved in
banks and the guy who was involved in this
this
this his name was his code name was liquor he
his name was his code name was liquor he
his name was his code name was liquor he has not been caught even today and in
has not been caught even today and in
has not been caught even today and in fact he has reappeared apparently in
fact he has reappeared apparently in
fact he has reappeared apparently in this new hacking scenario in the u.s.
this new hacking scenario in the u.s.
this new hacking scenario in the u.s. election so so this guy has changed his
election so so this guy has changed his
election so so this guy has changed his field from bank hacking to election
field from bank hacking to election
field from bank hacking to election hacking so there has been various kinds
hacking so there has been various kinds
hacking so there has been various kinds of botnets and even now that from 2003
of botnets and even now that from 2003
of botnets and even now that from 2003 2004 timeframe now we all have
2004 timeframe now we all have
2004 timeframe now we all have smartphones so there are smartphones
smartphones so there are smartphones
smartphones so there are smartphones recruited in the botnet now what
recruited in the botnet now what
recruited in the botnet now what happened in last October is even more
happened in last October is even more
happened in last October is even more scary because now we talk about IOT you
scary because now we talk about IOT you
scary because now we talk about IOT you will see here about Internet of Things
will see here about Internet of Things
will see here about Internet of Things your various kinds of equipments at your
your various kinds of equipments at your
your various kinds of equipments at your home are connected by network they talk
home are connected by network they talk
home are connected by network they talk to each other and they actually help you
to each other and they actually help you
to each other and they actually help you do things which you could not do before
do things which you could not do before
do things which you could not do before but these devices are also are very
but these devices are also are very
but these devices are also are very inexpensive and therefore not very
inexpensive and therefore not very
inexpensive and therefore not very secure so recently in October 2016 there
secure so recently in October 2016 there
secure so recently in October 2016 there was a huge distributed denial-of-service
was a huge distributed denial-of-service
was a huge distributed denial-of-service attack on the domain name system and
attack on the domain name system and
attack on the domain name system and that disable the you know access to
that disable the you know access to
that disable the you know access to Internet in large part of the eastern
Internet in large part of the eastern
Internet in large part of the eastern coast of us in October and that kind of
coast of us in October and that kind of
coast of us in October and that kind of botnets it was based on something called
botnets it was based on something called
botnets it was based on something called Mirai what net which was by infecting
Mirai what net which was by infecting
Mirai what net which was by infecting these devices with Mirai which is a sort
these devices with Mirai which is a sort
these devices with Mirai which is a sort of like a Trojan and that is now become
of like a Trojan and that is now become
of like a Trojan and that is now become a concern because we are talking about
a concern because we are talking about
a concern because we are talking about billions of devices being connected in
billions of devices being connected in
billions of devices being connected in the space of IOT and if that happens
the space of IOT and if that happens
the space of IOT and if that happens then we are kind of you know will be
then we are kind of you know will be
then we are kind of you know will be overwhelmed by various kinds of
overwhelmed by various kinds of
overwhelmed by various kinds of distributed denial-of-service so now
distributed denial-of-service so now
distributed denial-of-service so now jumping to 2009 what happened in Iran so
jumping to 2009 what happened in Iran so
jumping to 2009 what happened in Iran so Iranian nuclear enrichment plant was
Iranian nuclear enrichment plant was
Iranian nuclear enrichment plant was hacked and it was hacked with something
hacked and it was hacked with something
hacked and it was hacked with something called Stuxnet
called Stuxnet
called Stuxnet now this Stuxnet is very different from
now this Stuxnet is very different from
now this Stuxnet is very different from what we saw before because it attacked
what we saw before because it attacked
what we saw before because it attacked system which was air-gapped which means
system which was air-gapped which means
system which was air-gapped which means it was not connected to the Internet so
it was not connected to the Internet so
it was not connected to the Internet so which means that some social engineering
which means that some social engineering
which means that some social engineering went on some employees of this various
went on some employees of this various
went on some employees of this various forms that are involved in this Iranian
forms that are involved in this Iranian
forms that are involved in this Iranian nuclear plant we’re given something most
nuclear plant we’re given something most
nuclear plant we’re given something most probably an USB stick with a copy of the
probably an USB stick with a copy of the
probably an USB stick with a copy of the worm and if they plugged it in into
worm and if they plugged it in into
worm and if they plugged it in into their system and then the internal
their system and then the internal
their system and then the internal network even though it was not connected
network even though it was not connected
network even though it was not connected to the Internet the internal network was
to the Internet the internal network was
to the Internet the internal network was affected and the worm replicated itself
affected and the worm replicated itself
affected and the worm replicated itself and what it did was it slowed down the
and what it did was it slowed down the
and what it did was it slowed down the centrifuges that were enriching the
centrifuges that were enriching the
centrifuges that were enriching the uranium so it slowed down but it did not
uranium so it slowed down but it did not
uranium so it slowed down but it did not you know destroy them or he did not do
you know destroy them or he did not do
you know destroy them or he did not do anything outwardly obvious so he took
anything outwardly obvious so he took
anything outwardly obvious so he took them some time to even realize that they
them some time to even realize that they
them some time to even realize that they have been attacked so it was a very
have been attacked so it was a very
have been attacked so it was a very clever attack which was when people
clever attack which was when people
clever attack which was when people analyzed it they realized that this was
analyzed it they realized that this was
analyzed it they realized that this was not done by some hobby hackers this was
not done by some hobby hackers this was
not done by some hobby hackers this was this must have been done by some very
this must have been done by some very
this must have been done by some very powerful enemies of the country that is
powerful enemies of the country that is
powerful enemies of the country that is Iran and it was it had all kinds of
Iran and it was it had all kinds of
Iran and it was it had all kinds of vulnerabilities from windows 7 to
vulnerabilities from windows 7 to
vulnerabilities from windows 7 to Siemens PLC’s and so on where exploited
Siemens PLC’s and so on where exploited
Siemens PLC’s and so on where exploited so this is a little bit light-hearted
so this is a little bit light-hearted
so this is a little bit light-hearted hearted moment here that that you know
hearted moment here that that you know
hearted moment here that that you know here Iranian nuclear facility is
here Iranian nuclear facility is
here Iranian nuclear facility is affected but it is not this warm was not
affected but it is not this warm was not
affected but it is not this warm was not supposed to do something destructive it
supposed to do something destructive it
supposed to do something destructive it is supposed to do something clandestine
is supposed to do something clandestine
is supposed to do something clandestine or what we called it and covert attack
so I am NOT because you know we don’t
so I am NOT because you know we don’t have much time I’m not going to talk
have much time I’m not going to talk
have much time I’m not going to talk about how Stuxnet worked but you can
about how Stuxnet worked but you can
about how Stuxnet worked but you can find if you are more interested you can
find if you are more interested you can
find if you are more interested you can find it in many places on the Internet
find it in many places on the Internet
find it in many places on the Internet so but Stuxnet was not the only case
so but Stuxnet was not the only case
so but Stuxnet was not the only case where we saw that such a industrial
where we saw that such a industrial
where we saw that such a industrial critical system being affected by a
critical system being affected by a
critical system being affected by a cyberattack so this happened before you
cyberattack so this happened before you
cyberattack so this happened before you know starting from 2003 actually the
know starting from 2003 actually the
know starting from 2003 actually the 2003 East Coast blackout was proceed
2003 East Coast blackout was proceed
2003 East Coast blackout was proceed by this infection in the Ohio nuclear
by this infection in the Ohio nuclear
by this infection in the Ohio nuclear power plant with slammer worm so we
power plant with slammer worm so we
power plant with slammer worm so we talked about slammer worm before and
talked about slammer worm before and
talked about slammer worm before and then there is a train signalling system
then there is a train signalling system
then there is a train signalling system that was attacked there was a automobile
that was attacked there was a automobile
that was attacked there was a automobile plant whose manufacturing system was
plant whose manufacturing system was
plant whose manufacturing system was attacked and so on so these are some of
attacked and so on so these are some of
attacked and so on so these are some of the most well known are well publicized
the most well known are well publicized
the most well known are well publicized cases but this is not something that is
cases but this is not something that is
cases but this is not something that is very uncommon so if you look at the data
very uncommon so if you look at the data
very uncommon so if you look at the data so this is the industrial control system
so this is the industrial control system
so this is the industrial control system computer emergency response team in the
computer emergency response team in the
computer emergency response team in the u.s. they are 2010 to 2015 you see that
u.s. they are 2010 to 2015 you see that
u.s. they are 2010 to 2015 you see that in 2010 there were 39 reported cases in
in 2010 there were 39 reported cases in
in 2010 there were 39 reported cases in 2015 it is to 95 almost 300 which means
2015 it is to 95 almost 300 which means
2015 it is to 95 almost 300 which means we are talking about almost a nine-fold
we are talking about almost a nine-fold
we are talking about almost a nine-fold increase in the number of incidents that
increase in the number of incidents that
increase in the number of incidents that happened and if you look at the kind of
happened and if you look at the kind of
happened and if you look at the kind of incidents you know critical
incidents you know critical
incidents you know critical manufacturing seems to be the most
manufacturing seems to be the most
manufacturing seems to be the most affected but energy which means power
affected but energy which means power
affected but energy which means power transmission power distribution power
transmission power distribution power
transmission power distribution power generation then a water water
generation then a water water
generation then a water water purification water supply transportation
purification water supply transportation
purification water supply transportation and various communication and nuclear
and various communication and nuclear
and various communication and nuclear and so on so all these things have
and so on so all these things have
and so on so all these things have something in common which is they are
something in common which is they are
something in common which is they are controlled by a supervisory control and
controlled by a supervisory control and
controlled by a supervisory control and decision control system and data
decision control system and data
decision control system and data acquisition system and therefore the
acquisition system and therefore the
acquisition system and therefore the focus now is on how to secure this
focus now is on how to secure this
focus now is on how to secure this supervisory control and data acquisition
supervisory control and data acquisition
supervisory control and data acquisition system or SCADA systems so in a survey
system or SCADA systems so in a survey
system or SCADA systems so in a survey in 2015 it turns out and this is the
in 2015 it turns out and this is the
in 2015 it turns out and this is the u.s. so you can imagine what’s in the
u.s. so you can imagine what’s in the
u.s. so you can imagine what’s in the what’s happening in other parts of the
what’s happening in other parts of the
what’s happening in other parts of the world so 35.6% of the companies are
world so 35.6% of the companies are
world so 35.6% of the companies are saying we have no strategy or but we are
saying we have no strategy or but we are
saying we have no strategy or but we are developing one for you know saving
developing one for you know saving
developing one for you know saving ourselves from from an attack and these
ourselves from from an attack and these
ourselves from from an attack and these attacks are more and more common because
attacks are more and more common because
attacks are more and more common because the convergence of information and
the convergence of information and
the convergence of information and operational technologies so the factory
operational technologies so the factory
operational technologies so the factory floor is now connected to their business
floor is now connected to their business
floor is now connected to their business network and and that is basically the
network and and that is basically the
network and and that is basically the pathway through which this attacks high
pathway through which this attacks high
pathway through which this attacks high so in the last two years these things
so in the last two years these things
so in the last two years these things have been taken a very national security
have been taken a very national security
have been taken a very national security angle so Sony Israeli new electric grid
angle so Sony Israeli new electric grid
angle so Sony Israeli new electric grid was attacked but it was a surrogate
was attacked but it was a surrogate
was attacked but it was a surrogate great fortunately so they did not suffer
great fortunately so they did not suffer
great fortunately so they did not suffer a blackout but Ukraine was not that
a blackout but Ukraine was not that
a blackout but Ukraine was not that lucky so last year and this year Ukraine
lucky so last year and this year Ukraine
lucky so last year and this year Ukraine got blacked out by cyberattack and most
got blacked out by cyberattack and most
got blacked out by cyberattack and most probably by Russians so there were
probably by Russians so there were
probably by Russians so there were attacks on television network there were
attacks on television network there were
attacks on television network there were attacks on German steel plant there were
attacks on German steel plant there were
attacks on German steel plant there were attacks on Turkish banks so so all the
attacks on Turkish banks so so all the
attacks on Turkish banks so so all the banking network was completely jammed
banking network was completely jammed
banking network was completely jammed with a very large scale distributed
with a very large scale distributed
with a very large scale distributed denial-of-service attack by sending too
denial-of-service attack by sending too
denial-of-service attack by sending too much data on the network this one I all
much data on the network this one I all
much data on the network this one I all so IOT ransomware so an Australian hotel
so IOT ransomware so an Australian hotel
so IOT ransomware so an Australian hotel sorry Austrian hotel was actually locked
sorry Austrian hotel was actually locked
sorry Austrian hotel was actually locked out by using ransomware so they could
out by using ransomware so they could
out by using ransomware so they could not open the doors of the visitors or
not open the doors of the visitors or
not open the doors of the visitors or whether they’re in or out so they had to
whether they’re in or out so they had to
whether they’re in or out so they had to pay ransom in order to get themselves
pay ransom in order to get themselves
pay ransom in order to get themselves unencrypted and and get things going
unencrypted and and get things going
unencrypted and and get things going again so and we already talked about
again so and we already talked about
again so and we already talked about this reduce attack by mere a botnet
this reduce attack by mere a botnet
this reduce attack by mere a botnet using IOT devices so now focusing on
using IOT devices so now focusing on
using IOT devices so now focusing on India so this is a last year survey it
India so this is a last year survey it
India so this is a last year survey it turns out that financial sector is a 70
turns out that financial sector is a 70
turns out that financial sector is a 70 point 2 percent of the financial sector
point 2 percent of the financial sector
point 2 percent of the financial sector companies are saying that they have been
companies are saying that they have been
companies are saying that they have been attacked pharmaceutical and chemical 44%
attacked pharmaceutical and chemical 44%
attacked pharmaceutical and chemical 44% companies have been at least seeing
companies have been at least seeing
companies have been at least seeing attacks and oil and gas 37% but there is
attacks and oil and gas 37% but there is
attacks and oil and gas 37% but there is a saying in cybersecurity parlance that
a saying in cybersecurity parlance that
a saying in cybersecurity parlance that 100 percent have been attacked the
100 percent have been attacked the
100 percent have been attacked the difference is whether you know it or not
difference is whether you know it or not
difference is whether you know it or not so 72 percent are at knows that they
so 72 percent are at knows that they
so 72 percent are at knows that they have been attacked because it takes
have been attacked because it takes
have been attacked because it takes about an average 260 plus days to
about an average 260 plus days to
about an average 260 plus days to actually figure out that you have been
actually figure out that you have been
actually figure out that you have been attacked that has been also surveyed and
attacked that has been also surveyed and
attacked that has been also surveyed and and computed so some of the ways cyber
and computed so some of the ways cyber
and computed so some of the ways cyber attacks are happening in India a large
attacks are happening in India a large
attacks are happening in India a large percentage of it by is by social
percentage of it by is by social
percentage of it by is by social engineering so
engineering so
engineering so so you convince somebody that you know
so you convince somebody that you know
so you convince somebody that you know carry this thing into the into your
carry this thing into the into your
carry this thing into the into your office or into your factory and and an
office or into your factory and and an
office or into your factory and and an USB or something or you know ask them to
USB or something or you know ask them to
USB or something or you know ask them to go go to a go to an email the download
go go to a go to an email the download
go go to a go to an email the download an email attachment or by going through
an email attachment or by going through
an email attachment or by going through you know pushing it through some
you know pushing it through some
you know pushing it through some messenger service and so on and then the
messenger service and so on and then the
messenger service and so on and then the result is the malware infection a lot of
result is the malware infection a lot of
result is the malware infection a lot of DDoS attacks cyber espionage and
DDoS attacks cyber espionage and
DDoS attacks cyber espionage and exploitation of vulnerabilities and all
exploitation of vulnerabilities and all
exploitation of vulnerabilities and all that is happening so one of the thing
that is happening so one of the thing
that is happening so one of the thing that we kind of we the importance got
that we kind of we the importance got
that we kind of we the importance got lost because of all the all the hoopla
lost because of all the all the hoopla
lost because of all the all the hoopla about this D monetization just before D
about this D monetization just before D
about this D monetization just before D monetization it was found that 3.2
monetization it was found that 3.2
monetization it was found that 3.2 million debit card information we’re
million debit card information we’re
million debit card information we’re hacked from the ATM services supplied by
hacked from the ATM services supplied by
hacked from the ATM services supplied by Hitachi and this are the some of the
Hitachi and this are the some of the
Hitachi and this are the some of the banks that got affected so we you know
banks that got affected so we you know
banks that got affected so we you know in another country this would be a very
in another country this would be a very
in another country this would be a very very big deal but here because of the
very big deal but here because of the
very big deal but here because of the subsequent D monetization thing it did
subsequent D monetization thing it did
subsequent D monetization thing it did not get that much pressure or you know
not get that much pressure or you know
not get that much pressure or you know importance so recently it was found that
importance so recently it was found that
importance so recently it was found that the hackers could easily bypass the SBI
the hackers could easily bypass the SBI
the hackers could easily bypass the SBI is OTP so in any case this SMS based OTP
is OTP so in any case this SMS based OTP
is OTP so in any case this SMS based OTP is unsafe in ist has completely
is unsafe in ist has completely
is unsafe in ist has completely prohibited in the u.s. to use SMS based
prohibited in the u.s. to use SMS based
prohibited in the u.s. to use SMS based OTP but in this case it was a web based
OTP but in this case it was a web based
OTP but in this case it was a web based attack by which you can actually change
attack by which you can actually change
attack by which you can actually change the OTP I mean change the settings so
the OTP I mean change the settings so
the OTP I mean change the settings so that you do not require an OTP so just
that you do not require an OTP so just
that you do not require an OTP so just stealing the password would have been
stealing the password would have been
stealing the password would have been enough so now talking about other and
enough so now talking about other and
enough so now talking about other and other based payment it turns out that
other based payment it turns out that
other based payment it turns out that you know if you look at the way this
you know if you look at the way this
you know if you look at the way this happens there is a huge possibility of
happens there is a huge possibility of
happens there is a huge possibility of insider attacks and you have seen this
insider attacks and you have seen this
insider attacks and you have seen this happening to a minder saying singh dhoni
happening to a minder saying singh dhoni
happening to a minder saying singh dhoni his other was actually leaked out on
his other was actually leaked out on
his other was actually leaked out on twitter by the organisation that was
twitter by the organisation that was
twitter by the organisation that was supposed to take the information from
supposed to take the information from
supposed to take the information from him but that is the list you know you
him but that is the list you know you
him but that is the list you know you know that is the easiest to figure out
know that is the easiest to figure out
know that is the easiest to figure out who leaked it but there are multiple
who leaked it but there are multiple
who leaked it but there are multiple stages by which
stages by which
stages by which other based verification happens and in
other based verification happens and in
other based verification happens and in all stages there are huge amount of
all stages there are huge amount of
all stages there are huge amount of possibility of insider attack and it
possibility of insider attack and it
possibility of insider attack and it happened so exist bank and its
happened so exist bank and its
happened so exist bank and its subsidiary to be the enforcer they
subsidiary to be the enforcer they
subsidiary to be the enforcer they actually did this and they actually
actually did this and they actually
actually did this and they actually transferred money in the name of others
transferred money in the name of others
transferred money in the name of others by using their other information so so
by using their other information so so
by using their other information so so these are some of the things that are
these are some of the things that are
these are some of the things that are happening in India one more thing that
happening in India one more thing that
happening in India one more thing that we we are seeing is that 60% of Android
we we are seeing is that 60% of Android
we we are seeing is that 60% of Android phones and these are Enterprise Android
phones and these are Enterprise Android
phones and these are Enterprise Android phones not even common people’s Android
phones not even common people’s Android
phones not even common people’s Android phone was known to is known to be
phone was known to is known to be
phone was known to is known to be affected by a critical Qualcomm AC e
affected by a critical Qualcomm AC e
affected by a critical Qualcomm AC e vulnerability so that basically means
vulnerability so that basically means
vulnerability so that basically means that all the encryption that you do on
that all the encryption that you do on
that all the encryption that you do on the on your phone are vulnerable so
the on your phone are vulnerable so
the on your phone are vulnerable so anybody can read your your secret key so
anybody can read your your secret key so
anybody can read your your secret key so that basically means that sometimes the
that basically means that sometimes the
that basically means that sometimes the company’s the B Airtel’s and what a
company’s the B Airtel’s and what a
company’s the B Airtel’s and what a phone’s they will push a update or a
phone’s they will push a update or a
phone’s they will push a update or a patch but many times we don’t accept it
patch but many times we don’t accept it
patch but many times we don’t accept it because it consumes data so it turns out
because it consumes data so it turns out
because it consumes data so it turns out that about 70% of phones in India use
that about 70% of phones in India use
that about 70% of phones in India use less than lollipop version of Android
less than lollipop version of Android
less than lollipop version of Android and what that means is that all those
and what that means is that all those
and what that means is that all those are vulnerable to something called a
are vulnerable to something called a
are vulnerable to something called a dirty cow and we in our lab we have
dirty cow and we in our lab we have
dirty cow and we in our lab we have created an exploit that I can read all
created an exploit that I can read all
created an exploit that I can read all your sms’s and all your whatsapp
your sms’s and all your whatsapp
your sms’s and all your whatsapp messages if you have lollipop or less so
messages if you have lollipop or less so
messages if you have lollipop or less so so so I painted a very grim picture so I
so so I painted a very grim picture so I
so so I painted a very grim picture so I want to tell you that there is still
want to tell you that there is still
want to tell you that there is still hope so we recently got from the
hope so we recently got from the
hope so we recently got from the government some funding to actually set
government some funding to actually set
government some funding to actually set up a cybersecurity center for
up a cybersecurity center for
up a cybersecurity center for cybersecurity and cyber defense of
cybersecurity and cyber defense of
cybersecurity and cyber defense of critical infrastructures and so we are
critical infrastructures and so we are
critical infrastructures and so we are going to set up India’s first the
going to set up India’s first the
going to set up India’s first the largest probably largest in Asia the
largest probably largest in Asia the
largest probably largest in Asia the critical infrastructure experimental lab
critical infrastructure experimental lab
critical infrastructure experimental lab which is very similar to what they have
which is very similar to what they have
which is very similar to what they have in the Idaho National Lab and Sandia
in the Idaho National Lab and Sandia
in the Idaho National Lab and Sandia National Lab in the US so we’ll be doing
National Lab in the US so we’ll be doing
National Lab in the US so we’ll be doing work on this trying to figure out how to
work on this trying to figure out how to
work on this trying to figure out how to protect ourselves
protect ourselves
protect ourselves there is also
there is also
there is also you know we are trying to engage as much
you know we are trying to engage as much
you know we are trying to engage as much as possible with the rest of the country
as possible with the rest of the country
as possible with the rest of the country so we have MoU with the Bombay Stock
so we have MoU with the Bombay Stock
so we have MoU with the Bombay Stock Exchange
Exchange
Exchange we are working with Bombay Stock
we are working with Bombay Stock
we are working with Bombay Stock Exchange on their cybersecurity and RBI
Exchange on their cybersecurity and RBI
Exchange on their cybersecurity and RBI and say we both have taken cybersecurity
and say we both have taken cybersecurity
and say we both have taken cybersecurity quite seriously and in 2016 they have
quite seriously and in 2016 they have
quite seriously and in 2016 they have given us a given circulars to their
given us a given circulars to their
given us a given circulars to their respective you know companies like banks
respective you know companies like banks
respective you know companies like banks and securities and exchange companies
and securities and exchange companies
and securities and exchange companies that they have to completely overhaul
that they have to completely overhaul
that they have to completely overhaul their security and in that process we
their security and in that process we
their security and in that process we have a way to actually engage and help
have a way to actually engage and help
have a way to actually engage and help them we also are working with various
them we also are working with various
them we also are working with various universities that are really top in the
universities that are really top in the
universities that are really top in the in the indica in the world so Tel Aviv
in the indica in the world so Tel Aviv
in the indica in the world so Tel Aviv University we signed agreements and we
University we signed agreements and we
University we signed agreements and we have signed agreements with New York
have signed agreements with New York
have signed agreements with New York University for cybersecurity so with all
University for cybersecurity so with all
University for cybersecurity so with all that we have still hope so I try to
that we have still hope so I try to
that we have still hope so I try to scare you and then I am trying to say
scare you and then I am trying to say
scare you and then I am trying to say that we are working on some of these
that we are working on some of these
that we are working on some of these problems but it’s just not one IIT or
problems but it’s just not one IIT or
problems but it’s just not one IIT or one Institute can do everything so we
one Institute can do everything so we
one Institute can do everything so we need these kind of centers and this kind
need these kind of centers and this kind
need these kind of centers and this kind of research programs throughout the
of research programs throughout the
of research programs throughout the country at various locations and which
country at various locations and which
country at various locations and which can cooperate and build a real cyber
can cooperate and build a real cyber
can cooperate and build a real cyber security and cyber defense posture of
security and cyber defense posture of
security and cyber defense posture of the country we also started from last
the country we also started from last
the country we also started from last year this seesaw the which is a cyber
year this seesaw the which is a cyber
year this seesaw the which is a cyber security awareness week when to engage
security awareness week when to engage
security awareness week when to engage students from all over India to do
students from all over India to do
students from all over India to do various kinds of cybersecurity
various kinds of cybersecurity
various kinds of cybersecurity activities and competitions so that
activities and competitions so that
activities and competitions so that there is a you know awareness as well as
there is a you know awareness as well as
there is a you know awareness as well as there is an interest so that people
there is an interest so that people
there is an interest so that people actually follow through these things in
actually follow through these things in
actually follow through these things in their career so we will do this again in
their career so we will do this again in
their career so we will do this again in this year so so these are some of our
this year so so these are some of our
this year so so these are some of our way of trying to you know solve this you
way of trying to you know solve this you
way of trying to you know solve this you know problem that we feel is very very
know problem that we feel is very very
know problem that we feel is very very important and very very urgent to
important and very very urgent to
important and very very urgent to actually look into so but at the end I
actually look into so but at the end I
actually look into so but at the end I want to also tell you
want to also tell you
want to also tell you that major cyber attacks will happen
that major cyber attacks will happen
that major cyber attacks will happen right so it’s not possible to stop them
right so it’s not possible to stop them
right so it’s not possible to stop them so we have to either create enough
so we have to either create enough
so we have to either create enough technology and enough methodologies to
technology and enough methodologies to
technology and enough methodologies to actually safeguard ourselves from cyber
actually safeguard ourselves from cyber
actually safeguard ourselves from cyber attacks or we have to do something
attacks or we have to do something
attacks or we have to do something called a resilient system design so we
called a resilient system design so we
called a resilient system design so we have to design our systems resilient to
have to design our systems resilient to
have to design our systems resilient to cyberattack which means even after the
cyberattack which means even after the
cyberattack which means even after the attack happens we should be able to
attack happens we should be able to
attack happens we should be able to detect it very very fast and then we
detect it very very fast and then we
detect it very very fast and then we have to segment part of the system it’s
have to segment part of the system it’s
have to segment part of the system it’s like you know amputating your your part
like you know amputating your your part
like you know amputating your your part of your body so that you can the rest of
of your body so that you can the rest of
of your body so that you can the rest of the body can survive so we have to be
the body can survive so we have to be
the body can survive so we have to be able to do that resilience built into
able to do that resilience built into
able to do that resilience built into all our systems financial systems power
all our systems financial systems power
all our systems financial systems power systems industrial manufacturing systems
systems industrial manufacturing systems
systems industrial manufacturing systems so all kinds of systems have to have
so all kinds of systems have to have
so all kinds of systems have to have built-in resilience so that that’s a way
built-in resilience so that that’s a way
built-in resilience so that that’s a way we have to solve this problem and and we
we have to solve this problem and and we
we have to solve this problem and and we have to solve this very very urgently in
have to solve this very very urgently in
have to solve this very very urgently in a war footing because this is something
a war footing because this is something
a war footing because this is something that is coming very very fast towards us
that is coming very very fast towards us
that is coming very very fast towards us and we have already been a little bit
and we have already been a little bit
and we have already been a little bit delayed here in India so that’s all I
delayed here in India so that’s all I
delayed here in India so that’s all I have
”
Be First to Comment