Is India Cyber Security Ready?

The recent breach at the Kudankulam Nuclear Power plant and the way it was handled leave a lot to be desired

- N Madhavan

MATTERS OF FACT

Towards end-October, social media was agog with reports of a cyber attack at Kudankulam Nuclear Power plant. The Nuclear Power Corporation of India Ltd (NPCIL), on October 29, denied such a development and said both the reactors were running without ‘any operational or safety concerns’.

In a disturbing move, within 24 hours, NPCIL ate its own words and admitted that there indeed was an incident. Computer Emergency Response Team (CERT-In), it said, had noticed a malware attack that breached India’s largest nuclear power facility’s administrative network on September 4.

Further investigations had revealed that a user had connected a malware infected personal computer to the administrative network.

NPCIL emphasised that the nuclear plant’s operational systems were separate (in technical parlance this is called an air-gap) and the administrative network was not connected to it. Hence there was nothing to fear.

What is more worrying than NPCIL’s somersault was its lack of openness (the attack happened almost 55 days earlier), reluctance to share any details about the nature of the malware and, most importantly, obfuscate this grave development by saying that ‘any attack on the nuclear power plant control system is not possible’ as they are standalone systems.

The malware, DTRACK, was developed by a North Korean hacker group and specialises in extracting information from a system. The Washington Post has quoted Virus Total, a virus scanning website owned by Alphabet (Google’s parent), saying a large amount of data was stolen during the breach. This, data, the paper added, could be used to plan the next attack more efficiently.