India is highly vulnerable in the domain of cyberwarfare.

While it's making strides to bolster its defenses, the sheer volume of cyberattacks on critical infrastructure, combined with a fragmented defense strategy and a shortage of skilled professionals, means that a major cyberattack could cripple the nation "without a shot fired."

The Threats are Real and Present-

India is among the top-most targeted countries for cyberattacks, with state-sponsored actors and cybercriminals exploiting vulnerabilities in both public and private sectors.

• Attacks on Critical Infrastructure: There have been numerous, high-profile attacks on India's critical infrastructure. A suspected state-sponsored cyberattack in 2020 was linked to a major power outage in Mumbai. Similarly, the All India Institute of Medical Sciences (AIIMS) was hit by a ransomware attack in 2022, paralyzing its services and exposing the sensitive data of millions of patients.

• Espionage and Data Theft: India is a prime target for cyber espionage. Adversaries frequently target government agencies, military networks, and defense research organizations to steal sensitive data and gain a strategic advantage. Attacks on the Union Bank of India in 2016 and other financial institutions highlight the significant economic risks.

India's Defensive Posture: A Work in Progress-

India is not ignoring the threat; it is taking significant steps to improve its cybersecurity posture, but progress has been slow.

• Defense Cyber Agency (DCyA): The establishment of the Defence Cyber Agency (DCyA) in 2018 was a crucial step toward creating a unified, tri-services command to handle cyber threats. The DCyA is tasked with both defensive and offensive cyber operations.

• Key Institutions: India has established several key institutions, including the Indian Computer Emergency Response Team (CERT-In), which acts as the national nodal agency for responding to cyber incidents. The National Critical Information Infrastructure Protection Centre (NCIIPC) is responsible for protecting India's critical infrastructure.

• National Cyber Security Strategy: The government has been working on a new National Cyber Security Strategy to replace its outdated 2013 policy. The proposed 2020 strategy is more comprehensive, with a focus on protecting critical infrastructure, promoting supply chain security, and fostering public-private collaboration. However, the implementation of the new strategy has been slow.

Systemic Vulnerabilities-

Despite these efforts, a number of systemic issues continue to hurt India's cyber preparedness.

• Lack of Skilled Professionals: India has a significant shortage of skilled cybersecurity professionals. While it has a large talent pool in IT, a lack of specialized training and education in cybersecurity leaves a huge gap between the demand and supply of professionals.

• Fragmented Legal Framework: India's legal and regulatory framework for cybersecurity is fragmented and lacks the teeth to deal with the rapidly evolving nature of cybercrimes. The absence of a robust data protection law has also been a major vulnerability.

• Dependence on Foreign Technology: India's critical infrastructure, including its power grids and financial systems, relies heavily on foreign hardware and software, which are susceptible to backdoors and vulnerabilities. This dependence poses a significant risk and makes the country vulnerable to supply chain attacks.

In conclusion, while the Indian government is aware of the cyber threat and has initiated measures to counter it, the nation is still far from being genuinely ready for a major cyberwar. The combination of a large attack surface, a shortage of skilled professionals, and a fragmented defense system makes India highly vulnerable in the digital domain.