document name: back story (latest information...

SKOCHCyberPatriotsTaskForce

SKOCHDEVELOPMENTFOUNDATION(Section25Not-for-ProfitCompanyregisteredundertheCompaniesAct,1956,

andRegisteredunder80Gand12AAoftheIncomeTaxAct,1961)Gurgaon,Haryana,India

©SKOCH,2019

1

DocumentName:BackStory(LatestInformationFirst)CyberPatriotsTaskForceMay2019Allrightsreserved




©SKOCH,2019

2

VersionControlVersionNo IssueDate ChangeDetails1 9thMarch2019 1.1 21stMay2019 ListofParticipantsUpdate

InitiativeName CyberSecurityPatriotsTaskForceDocumentName CyberSecurityStrategyofIndiaDocumentOwner SameerKochharSecurityClassification LimitedCirculationDocumentStatus DraftDateofRelease




©SKOCH,2019

3

7thCommunication:WhatsAppMessage,16thMay2019Message2:Mypersonalrequesttoyouisthatwereallyneedtogrow.Thereare100ofuscurrently.Caneachoneofusnotgetanother5tojoin?Itisimportantforthistobecomeamovement.Iwouldbetrulygratefulifyoucanmake5meaningfulmemberadditions.Thanksinanticipation.




©SKOCH,2019

4

6thCommunication:WhatsAppMessage,16thMay2019Message1:Greetings,youmusthaveseenmymailfromyesterday.Foreasierworking,wearecreatingfourgroups.1)PolicyGroup2)OTGroup3)BFSIGroupand4)ServicesGroup.Thesewouldalsobeformed onWhatsApp. These groups can simultaneouslywork on their areas of expertise. AllCyberPatriotswillbedividedacrossthesegroupsdependingontheirdomainarea.Allkeypapersandinputswouldbesharedacrossgroups.Since,mymailyesterday,IhavereceivedonepaperfromDr.AnupamSaraphandanotheronefromDr.C.MuralikrishnaKumarofNITIAyog.Iamsendingthismessagethroughthebroadcastroute.Themessagewillbesenttoeveryonebuttherepliescomeonlytome.Inthe4functionalgroups,allcommunicationcanbebi-directional.Iwillforwardtheinputsreceivedinthefollowingmessages.Encl(s):

1. Fourgroups2. ArticlebyDrAnupamSaraph




©SKOCH,2019

5

Encl1:FourgroupsServicesGroup

S/N Sector IndustrySegment Name Organisation1 Services ITIndustry AkilurRahman ABBIndiaLtd2 Services ITIndustry AnkushChowdhary AmazonWebServices3 Services ITIndustry ArchieJackson Genpact4 Services Hospitality AshishKhanna OberoiGp5 Services ITIndustry DebashisSingh MphasisLimited6 Services ITIndustry DeepakKalambkar MarvelDataServicesLLP7 Services ITIndustry DhruvKhanna DataResolveTechnologiesPrivateLimited8 Services ITIndustry DilipPanjwani L&TInfotechltd9 Services ITIndustry GaneshVishwanathan AithentTech10 Services ITIndustry GauravAgarwal SymantecSoftwareSolutionsPvtLtd11 Services FinTech GautamPande Mastercard12 Services ITIndustry GovindRammurthy MicroWorldTechnologiesInc.:13 Services ITIndustry KesavardhananJayaraman K7ComputingPvtLtd14 Services ITIndustry MohitMakol SymantecSoftwareSolutionsPvtLtd15 Services ITIndustry MrOmKumar BlueEarthSoftwaresGroup.16 Services ITIndustry MurtazaBhatia DimensionDataIndia,17 Services Media RDBhatnagar DainikBhaskarGroup|DbCorpLimited18 Services Manufacturing RajivArora SiemensLtd19 Services ITIndustry RavinderArora IrisSoftware20 Services ITIndustry SandeepBhambure ManagingDirector21 Services ITIndustry SapanTalwar ARISTININJA22 Services PSU-Bank AjayKumar VijayaBank23 Services Academia AnupamSaraph SymbiosisInstituteofComputerStudiesandResearch24 Services Consultancy GautamKapoor Deloitte25 Services Consultancy JaspreetSingh KPMG26 Services Manufacturing MashiThapar Jaquar27 Services Manufacturing RajivAgarwal HAL28 Services Manufacturing VikramGR DiageoIndia




©SKOCH,2019

6

PolicyGroup

S/N Sector IndustrySegment Name Organisation1 Policy Academia AkashKundu CBIAcademy2 Policy Consultancy AkhileshTuteja KPMG3 Policy Academia AnilKoushal IndianInstituteofManagementIndore4 Policy Academia AnjaliKaushik ManagementDevelopmentInstitute5 Policy ITIndustry AnkushChowdhary AmazonWebServices6 Policy Academia AnupamSaraph SymbiosisInstituteofComputerStudiesandResearch7 Policy Government BKVVPrasadRao NICAndhraPradesh8 Policy ThinkTank C.MuralikrishnaKumar NITIAayog9 Policy Consultancy CmdeJHarshaVardhan Deloitte10 Policy Academia DeepakPhatak IITBombay11 Policy Consultancy DineshKPillai AcquisoryRiskConsultingPvt.Ltd.12 Policy Government DrLalthlamuana MizoramStatee-GovernanceSociety(MSeGS)13 Policy Consultancy GautamKapoor Deloitte14 Policy FinTech GautamPande Mastercard15 Policy Government GolokKumarSimli MinistryofExternalAffairs16 Policy Academia HRKrishnamurthy IndianInstituteofScience17 Policy Consultancy JaspreetSingh Ernst&YoungLlp18 Policy Independent NVijayaditya19 Policy LawFirm PratibhaJain NishithDesaiAssociates20 Policy Consultancy RahulAggarwal PricewaterhouseCoopersPvtLtd21 Policy Manufacturing RajeevAgarwal HindustanAeronauticsLimited22 Policy Government SSSarma CERT-IN23 Policy Government SaibalSarkar NIC24 Policy Government SanjayBehl CERT-IN25 Policy Consultancy SivaramaKrishnan PricewaterhouseCoopersPvtLtd26 Policy Consultancy SrivathsaRamantha Deloitte27 Policy Bank-PSU AjayKumar VijayaBank28 Policy Manufacturing ManshiThapar Jaquar29 Policy Manufacturing PradeepChaudhary BalrampurChinimills30 Policy Consultancy PrashantGupta GrantThorton31 Policy Government SanjayJaju DepartmentofDefenceProduction32 Policy ITIndustry SapanTalwar ARISTININJA33 Policy Manufacturing VikramGR Diageo34 Policy ITIndustry ArchieJackson Genpact




©SKOCH,2019

7

BFSIGroup

S/N Sector IndustrySegment Name Organisation1 BFSI Bank AbhijitShah DevelopmentCreditBank2 BFSI Bank-PSU AjayKumar VijayaBank3 BFSI Insurance-Life AshishShah StarUnionDai-ichiLifeInsuranceCo.Ltd4 BFSI AMC BRNath Edelweiss5 BFSI Bank-Co-operative ColVinodVShah TheGujaratStateCo-operativeBankLtd6 BFSI Academia DeepakPhatak IITBombay7 BFSI Finance DominicVijayKumar ArtAffordableHousingFinance8 BFSI Academia HRKrishnamurthy IndianInstituteofScience9 BFSI NBFC HarenderSingh CapitalTrustLimited10 BFSI Bank-PSU JNMallikarjunRao SyndicateBank11 BFSI Bank-PSU JagmohanSingh CanaraBank,12 BFSI Finance JoydeepDutta CentralDepositoryServicesLimited13 BFSI Insurance-Life KumarSaurav EdelweissTokioLifeInsuranceCompanyLimited14 BFSI Finance MakeshChandramohan AdityaBirlaCapitalLtd15 BFSI Finance ManikantRSingh ORBISFinancialCorporation16 BFSI Bank-SFB ManishSehgal AUSmallFinanceBank17 BFSI AMC MannanGodil EdelweissAssetManagementLtd18 BFSI Finance ManojSarangi NationalSecuritiesDepositoryLimited

19 BFSI PaymentBank MrNileshGade AdityaBirlaIdeaPaymentsBankLtd20 BFSI Finance NafeesAhmed IndiabullsGroup

21 BFSI Bank-MNC NeerajChandra AbuDhabiCommercialBankLtd

22 BFSI Bank-PVT NeerajNaidu IDFCFirstBankLtd

23 BFSI Bank-PSU PremnathPandey StateBankofIndia

24 BFSI Bank-PVT RajeshHemrajani IDFCBankLtd

25 BFSI Bank-PVT RajeshThapar YESBANKLtd

26 BFSI Bank-PVT SameerRatolikar HDFCBankLtd

27 BFSI Finance SanjayTiwari IIFL

28 BFSI AMC SanjivanShirke UTIMutualFund

29 BFSI Insurance-General ShashankBajpai AckoGeneralInsuranceLimited

30 BFSI Exchange ShivkumarBhasin NSE

31 BFSI Exchange ShivkumarPandey BSELtd

32 BFSI Consultancy SivaramaKrishnan PricewaterhouseCoopersPvtLtd

33 BFSI Insurance-Life SunderKrishnan RelianceNipponLifeInsurance,

34 BFSI Bank-PSU Suryanarayanan.K CentralBankofIndia

35 BFSI Insurance-Life VikasYadav MaxLifeInsurance

36 BFSI Bank-Pvt VishalMadan CapitalBank

37 BFSI Bank-PSU VivekGupta AllahabadBank

38 BFSI Bank-PVT ZuzarTinwalla StandardCharteredBank

40 BFSI Academia AnupamSaraph SymbiosisInstituteofComputerStudiesandResearch41 BFSI Consultancy GautamKapoor Deloitte42 BFSI Consultancy JaspreetSingh KPMG43 BFSI Manufacturing MansiThapar Jaquar44 BFSI ITIndustry ArchieJackson Genpact




©SKOCH,2019

8

OperationalTechnologyGroup

S/N Sector IndustrySegment Name Organisation

1 OperationTechnology Manufacturing AjitsinghNawale MahindraCieAutomotiveLtd

2 OperationTechnology Manufacturing AnandRuhela KwalityLimited

3 OperationTechnology Hospitality AshishKhanna OberoiGp

4 OperationTechnology Transport&logistics AshishMathur AllcargoLogisticsLtd.

5 OperationTechnology Power&Energy AvaneeshVats EnergyEfficiencyServicesLtd

6 OperationTechnology Manufacturing BalajiAravamudhan UnitedPhosphorusLimited

7

OperationTechnology PSU-Oil&Gas DharamRaj OilandNaturalGasCorporation

Ltd(ONGC)

8 OperationTechnology Power DharmendraKumar TataPowerDelhiDistribution,

9 OperationTechnology Pharmaceutical DineshKumar AlkemLaboratoriesLtd.

10 OperationTechnology Manufacturing DrVineetBansal GreenplyIndustriesLtd

11 OperationTechnology Government GolokKumarSimli MinistryofExternalAffairs

12 OperationTechnology PSU-OIL&Gas JayantGupta HindustanPetroleumCorporation

13 OperationTechnology Manufacturing KamalDhamija ApolloTyresLtd

14

OperationTechnology Fertiliser MakarandSawant DeepakFertilisersAnd

PetrochemicalsCorporation

15 OperationTechnology Power&Energy ManojKumar HPCL-MittalEnergyLtd

16 OperationTechnology Manufacturing ManoranjanKumar ShreeCementLtd

17 OperationTechnology Manufacturing MansiThapar Jaquar

18 OperationTechnology Manufacturing MuditAgarwal UflexLimited

19 OperationTechnology Power&Energy NagsenWankhade EnergyEfficiencyServicesLtd

20 OperationTechnology Manufacturing NiranjanBal HindalcoIndustriesLtd

21 OperationTechnology Power&Energy NitishVyas AdaniElectricityMumbaiLtd

22 OperationTechnology Manufacturing ParshantKumar KHDHumboldtWedag

23 OperationTechnology Manufacturing PradeepChaudhary BalrampurChiniMillsLtd

24 OperationTechnology Manufacturing RDMalav JindalPolyFilmsLtd

25OperationTechnology Engineeringand

TechnicalServices

RPriyamvada EngineersIndiaLtd

26 OperationTechnology Manufacturing RajeevAgarwal HindustanAeronauticsLimited

27 OperationTechnology Manufacturing RajivArora SiemensLtd

28 OperationTechnology Manufacturing RamanKrishnamoorthy BataIndiaLimited

29 OperationTechnology Power&Energy SSamanta TataPowerDelhiDistributionLtd

30 OperationTechnology Manufacturing SSrikanth TVSMotorCompanyLtd

31 OperationTechnology Pharmaceutical SanjayNandavadekar Cipla

32 OperationTechnology PSU-Consultancy SatishNangia NBCC(India)Limited

33 OperationTechnology Power SatyaGupta TataPowerDelhiDistribution

Ltd,34 OperationTechnology Pharmaceutical SubhajitDeb Dr.Reddy'sLaboratoriesLtd.

35 OperationTechnology Manufacturing SurendraBisht JindalStainless(Hisar)Ltd.

36

OperationTechnology Minerals(SOE) SurendraKumar

Upadhyay

NMDCLimited

37 OperationTechnology Oil&Gas TarunSharma GujaratGasLimited




©SKOCH,2019

9

38 OperationTechnology Manufacturing VikramGR DiageoIndia39 OperationTechnology Construction VinayKhargonkar Larsen&ToubroLimited

40OperationTechnology Manufacturing VipulAnand HSILLimited(FormerlyHindustan

Sanitaryware&IndustriesLtd)41 OperationTechnology Academia AnilKoushal

IndianInstituteofManagementIndore

42OperationTechnology

Academia AnupamSaraphSymbiosisInstituteofComputerStudiesandResearch

43 OperationTechnology Consultancy GautamKapoor Deloitte44 OperationTechnology Consultancy JaspreetSingh KPMG45 OperationTechnology Finance ManikantRSingh OrbisFinancialServicesLimited46 OperationTechnology PSU-Oil&Gas DharamRaj ONGC47 OperationTechnology LawFirm PratibhaJain NishithDesaiAssociates48 OperationTechnology Government SanjayJaju DepartmentofDefenceProduction49 OperationTechnology ITIndustry SapanTalwar ARISTININJA50 OperationTechnology Manufacturing VineetBansal Greenply51 OperationTechnology Manufacturing Kavitha HAL52 OperationTechnology Academia DrSangalVelu AchartaSchoolofManagement53 OperationTechnology Consultancy Anil KPMG54 OperationTechnology ITIndustry Nishant Fortinet55 OperationTechnology ITIndustry ArchieJackson Genpact

56OperationTechnology

Academia AkashBhardwajUniversityofPetroleumandEnergyStudies




©SKOCH,2019

10

Encl2:ResponsebyDrAnupamSaraphDearSameer,herearemyquickresponsestoyourquestions.

1. Whatarethefeltneedsforcybersecurityfrom:a.CISOPerspectiveb.BusinessPerspectiveThe ability to protectmy relationshipwithmy customer is the number one need from abusinessperspective.Currentexcursionsintooutsourcing,creatingorusingplatformslikeIndia Stack,wheremy customer relationship is completely out ofmy control, are posingenormousrisknotmerelytomydatabuttomybusinessitself.

FromaCISOperspectivetheexcursionsofmyCTOtooutsourcetechnologiesandjoinforums,likeiSprit,wheremysecuritypracticesandbusinessneedscarrynoweightarethenumberone cyber security risk. These companies and forums are not exposed to the loss of mycustomers, my business, its business processes, or even the legal compliances andinternationalbestpracticesinmysector.

2. Whatarethegapsinwhatindustryisoffering?a.Productsb.Servicesc.AdviseThe IT industry isoffering technologyandplatforms for technologybasedauthentication.Howevertheymissthepointthatyoucannotandmustnotoutsourcethemostimportantpartofabusinesstransaction:identificationofthetransactingparties.Thisisthebiggestsecurityholethathasbeenofferedasproducts,servicesandadvise.Itisevidentthattheindustryhasno understanding of business processes or simply don’t care to protectmy business andcustomers.Thefailureoftechnologycompaniestounderstandthatnooneneedstechnologysolutions,theyneedgovernancesupportisalsoabiggapintheirofferings.Intheirfailuretorecognizethatbycausingoutsourcingassolutionstheynotonlydestroymyconnectionwithmycustomers,theyweakenmyabilitytodealwiththeproblemsofmybusiness.

3. Inwhatscenarioscanindustryengagementsincreasevulnerabilities?Asabusiness,Iincreasemyvulnerabilitybyoutsourcingmyrelationshipwithmycustomersorbyalteringmybusinessprocesses to suit theneedsof technologysolutionsofferedbytechnologyvendors.

4. Howmuchdoyouthinkmarketleadpressuresandtargetpressuresmakevendorpushsub-

optimalsolutions?While target pressures definitely cause a push in sales, it is the failure of research anddevelopment in developingmeaningful solutions that has pushed technology as solutionswhenitismostlyaproblem.

IthinkthebigchallengebeforetheRBIGovernoristoundothechangesinbusinessprocessesasa resultof the technologyTrojanhorses thathave invaded thebankingsector.Re-KYC isonewhichisdestroyingcustomerrecordsandcausingfinancialfraudinthefinancialworld.Moneywallets,Aadhaarpayments andUPI are another that are enabling the creationofmoneyandlaunderingofmoney.ThenewCyberSecurityCoordinatormusttakeupthesechallengesasanationalemergencyandensuretheRBI,theECI,theothernationalinstitutionsundertakethedismantlingoftheserisks.Bestregards,Anupam




©SKOCH,2019

11

5thCommunicationE-Mail:15thMay2019DearThesecondmeetingofCyberPatriotsTaskForcewasheldinBengaluruattheOberoiHotelonMay9th,2019.CISOsfrombanks,defencemanufacturing,ITServicesandMNCmanufacturingparticipated.Someofthelearning’swereasfollows:

1. Bankmergersareposingnewsecuritychallengesfortheshorttomediumterm.2. Theoutsourcingmodelisposingahigherdegreeofrisk.3. Customisingsolutionsisnotpossibleandprivilegedidentitymanagementisabigareafor

concern.4. CyberSecurityisaspecialisedjob,whilethereisfocusonmovementofCISOstobusiness,

thereisnoattempttogivebusinessteam’sexposuretosecurity.5. ThebiggestresistancetosecuritycomesfromITvendorsthemselveswhowouldlikeitto

takeabackseat.

Thesearejustafewoftheseveralfeedbacks.Thishasgotmethinkingondoingasmallnotebasedonyourinputs.Iseekanswerstothefollowingquestions:

1. What are the felt needs for cyber security from: a. CISO Perspective b. BusinessPerspective

2. Whatarethegapsinwhatindustryisoffering?a.Productsb.Servicesc.Advise3. Inwhatscenarioscanindustryengagementsincreasevulnerabilities?4. Howmuchdoyouthinkmarketleadpressuresandtargetpressuresmakevendorpush

sub-optimalsolutions?

Iwouldreallyappreciateifyoucanprovideyourinputsontheaboveatyourearlyconvenience.InthemeanwhileIalsohadtheopportunitytocalluponMr.ShaktikantaDasandbriefhimonourwork.Hewasverysupportiveandpromisedtoexamineourrecommendationsandactonthemwhereversuitable.PersonnelfromRBImayalsoparticipateintheexercisefromtimetotime.Oneofhisideaswastoalsoexamineroleofdisruptivetechnologiese.g.AIandBlockChainetc.andcomebackwithoursuggestions.IalsometMajGeneralRajeshPant,thenewNationalCyberSecurityCoordinator.Hetoowasverysupportiveofourworkandwillbeparticipating.Hehasagreedtowritethechapteron“TheThreatLandscape.”I lookforwardtoyourmail.Onceagain,ourCyberPatriotCongressison17thAugust2019attheConstitutionClub,NewDelhi.Thankingyou,Yourssincerely,SameerKochharChairmanSKOCHGroup+919811089604




©SKOCH,2019

12

ParticipantListofSecondMeetingofCyberPatriotsTaskForce,Bangalore:

1. MrDebashisSingh,CISO,Mphasis2. MrVikramGR,CISO,Diageo3. MrAjayKumar,CISO,VijayaBank4. MrJNMallikarjunRao,CISO,SyndicateBank5. MrRajivAgarwal,GM,IT&CISO,HindustanAeronauticsLimited6. MrSameerKochhar,Chairman,SKOCHGroup7. DrGursharanDhanjal,MD&Editor,SKOCHGroup8. MrKunalChauhan,President,SKOCHGroup9. MrStefanKaushik,BusinessAnalyst,SKOCHGroup




©SKOCH,2019

13

4thCommunicationE-Mail,29thApril2019DearWelcomeaboard!ItismygreatestpleasuretohaveyouaspartofourcyberpatriotteamthathascometogethertogivethisCyberSecurityInitiativethemuchneededinputs.ItisourpleasuretoannouncethatwehaveflaggedofftheinitiativeformallyonMarch23,2019atConstitutionClubofIndia,NewDelhiwherecyberpatriotsfromdifferentpartsofthecountrybrainstormedanddiscussedtheurgentneedforcybersecurityframeworkinthecountry.However,toensurethatyoudonotmissonanydevelopmentordiscussionsofar,pleaseallowmetowalkyouthroughthetimelinefromthethoughttowherearewesofar.ThethoughtCyberthreatisreal.Soiscyberterrorism.Aswearemakinginroadsinthedigitalworld,wearealso increasing our vulnerability. But how prepared is India against cyber-crimes, cybermonopoliesandinthewakeofapotentialcyberwar?Youwouldbesurprisedtoknowthattherearelessthan1000Indianswiththerequisiteskillsetsandtheabilitytocontribute.ThisiswhentheideaofformingacybersecuritytaskforcegotitsrootsandthatiswhenIdecidedtogetasmanyofthese1,000individualsonboardandyouareoneofthose1000Indianswiththeskill.TheobjectiveThrough this task force, we should be able to identify the various contours of the Indiancybersecurity system through various views likePolicy (national, corporate, individual, etc.);Verticals(financialservices,homelandsecurity,etc.);Technology(AI,IoT,etc),Diplomacyandpointsofmultilateralnegotiations(datalocalizing,etc).Onceweareabletoidentifyanddetailthese,wecanevolveacoherentandpublishasabluebookthatcanbeupdatedperiodically.TheFirstMeetingWeformallygottheballrollingonMarch232019whenallthedelegatesandselectmembersmetforapaneldiscussionfollowedbyaboardroommeetingtodiscusstheactionplan.Pleasefindattached the list and details on the same. The meeting was a mixed bag, given the variedstakeholdersandexpertspresent,withlotofinputs,fewdifferencesandacommonpassiontowork towards this goal. You can access the panel discussion byclicking hereand for theboardroommeeting,pleaseclickhere.Toknowabouttheattendeesfortheabovetwo,pleasecheckattachment.However,togiveyouabriefideaofthe“Worksofar”,herearethepointersfromourfirstmeeting.1. Thedocument,asofnow,isnamed“NationalCyberSecurityStrategyofIndia”.




©SKOCH,2019

14

2. Theopeningsectionwillthrowlightonthecurrentstatus,theprogressandthemuchneededarticulation.

3. Isuggestthefollowingstructureforthefirstsection:a. GlobalScenariob. FactorsdrivingNationalCyberSecurityStrategiesc. TheIndiancontext(ThisincludesFacilities,PeoplebothinSkillandHR,Funds,Systems,CompetitiveAdvantages,AreasforUpgrade,Policygaps,Factorsdrivingfuturecourse,needarticulationforthestrategy)

4. EconomicRationalefortheStrategyOnustakenthusfar

• MrSivaramanKrishnan,Leader-CyberSecurity,PwCispreparingadraftpaperonthefirstsection(Point3).

• ProfAnjaliKaushik,Professor,ManagementDevelopmentInstitute(MDI),whohasdoneextensiveworkonInformationSecurityAssuranceFramework,hassharedsomeofhervaluableworkwithus.Attachedisthedocument.

• MrAkhileshTuteja,GlobalCo-Leader-CyberSecurity,KPMGisworkingonapaperon“EconomicRationaleandthecostofnothavingone”

• Mr Brijesh Singh, Inspector General of Police- Cyber, Maharashtra had a differentviewpointonthetopicandhasbeenrequestedtosharehisinputdocument.

• Everyone has enthusiastically and sincerely agreed to build thisworkforce to a solid1000-membergroupandwillberecommendingresourcepersonsfromthetechnologyandoperations.

TheStepAheadNowthatyouareoneoftheCyberPatriots,weexpectyourinputandfeedbackinthePhaseIIoftheinitiative.ThephaseIIincludes:

• Identifying teams and coordinators for the chapters based on their expertiseandinterests

• Teamstocreatedraftwhichcanthenbeanalysedandbrainstormedbythetaskforce.• Chapterstobepresentedon17thAugust,2019atthefirstCyberPatriots’Summittobe

heldinNewDelhi.Dokeepyourcalendarblockedforthesame.• BooktobepublishedandreleasedinQ-4of2019.

Now that you have joined us in this mission, we believe that your expertise will help thisframeworkimmensely.Givenyourbusyschedules,wewillkeepourcommunicationsprimarilythroughe-mails,callsandsoon,andsometimeshavesmallermeetingsatNewDelhiorMumbai.You can contribute through discussions, inputs, write-ups and feedback. Even though yourinvolvement is totally voluntary with no financial or legal liability, it becomes an unsaidresponsibilitytowardsthetreasuretroveofknowledgeandexpertiseyouhaveonthesubject.Wewill lookforwardtoenrichingthisvisionandwitheveryone’sconsortedefforts; thebookshouldbeabletoseethelightofthedaybytheendofthisyear.Iwouldrequestyoutokindlyacknowledgethereceiptatskoch@skoch.in.




©SKOCH,2019

15

Lookforwardtohearingfromyousoon.Bestregards,SameerKochharChairmanSKOCHGroup+919811089604




©SKOCH,2019

16

3rdCommunication:E-Mail,26thMarch2019DearIamhappytoinformyouthattheCyberPatriotsInitiativedrivenbySKOCHGroupwaslaunchedformallyonMarch23,2019attheConstitutionClubofIndiathroughapaneldiscussion.Youcanwatchthediscussionhere.Thiswasfollowedbythefirstmeetingofthetaskforce.Youcanseethemeetinghere.Thelistofparticipantsisenclosed.Itwasclearthattherearestakeholderswhoseinterestistop-levelpolicy,otherswhowouldliketoseeanoperationsortechnologiesviewetc.Werecognisetheimportanceofalloftheseandpropose to hold meetings consisting of different types of stakeholders to cover all areaseventually.ForthepurposesoffocusthefirstmeetingwasonPolicyIssuesandexaminedsomeoftheareasthatareimportantfromagovernmentperspective.Afterdetaileddiscussions,severaldecisionsweretaken.Theinitialactionsareasfollows:

1. Theworking name for the document would be “National Cyber Security Strategy forIndia.”

2. Underthefirstsectionofthebook,wewouldtakestockofthecurrentprogressandneedarticulation.

3. Accordingly,Isuggest,thefirstsectioncouldbestructuredasbelow:a. GlobalScenariob. FactorsDrivingNationalCyberSecurityStrategiesc. TheIndianContext(currentpolicyenvironment,assets,institutionsetc)

i. Facilitiesii. People(skillsandHR)iii. Fundsiv. Systemsv. CompetitiveAdvantagesvi. AreasforUpgradation

d. PolicyGapse. KeyFactorsDrivingFutureCourse(egVirtualisation,5G,AI,IoTetc)f. NeedArticulationfortheStrategy

4. EconomicRationalefortheStrategy

SinceSivaramofPwChadcomepreparedforinputson3above,hewasrequestedtoputtogetheradraftpaper.Hispresentationisenclosed.Similarly, Anjali Kaushik has also done extensive work on Information Security AssuranceFrameworkfore-Governancewasrequestedtosharesomeofherwork.Thedocumentsentbyherisenclosed.AkhileshTutejaofKPMGwasrequestedtoworkonapaperonEconomicRationaleandthecostofnothavingsuchastrategy.




©SKOCH,2019

17

BrijeshSinghofMaharashtraPolicehassuggestedanalternativeviewpointandisrequestedtosharehisinputdocuments.Movingforward,Iwouldbehavingafewoneononediscussionstobettercrystallisethoughtsonotherchaptersandareasofaction.Ilookforwardtoyourinputsandfeedback.Oneareathateveryonehaspromisedtohelponistohelpexpandthisgroupandrecommendresourcepersonsfromthetechnologyandoperationssidestojoinus.Weneedtohavea1000stronggroup.ThefirstNationalCyberPatriotConventionisscheduledon17thAugust2019atConstitutionClubofIndia,NewDelhi.Dokeepyourcalendarblocked.Bestregards,SameerKochharChairmanSKOCHGroup+919811089604Encl(s):

1. ParticipantstotheSKOCHCyberPatriotsTaskForceMeetingI2. SecuringIndianCyberSpace–PWCInputs3. InformationSecurityAssuranceFrameworkfore-Governance–MDIInputs




©SKOCH,2019

18

Encl1:ParticipantstotheSKOCHCyberPatriotsTaskForceMeetingI

SKOCHCyberPatriotsTask-forceMeeting1

23rdMarch2019

12:15-14:00HrsBoardroom,ConstitutionClubofIndia,NewDelhi

Participants:

• MrAkhileshTuteja,GlobalCo-Leader-CyberSecurity,KPMG

• ProfAnjaliKaushik,InformationManagement,ManagementDevelopmentInstitute

(MDI)

• MrAvaneeshVats,DeputyGeneralManager-IT,EnergyEfficiencyServicesLtd

• MrBhushanMohan,FormerPrincipalConsultant,NeGD,MeitY

• MrBrijeshSingh,InspectorGeneralofPolice-Cyber,Maharashtra

• DrCMuralikrishnaKumar,SeniorAdvisor-ICT,NITIAayog

• MrGautamKapoor,Partner,DeloitteIndia

• MrGolokKumarSimli,PrincipalConsultant&ChiefTechnologyOfficer,PassportSeva,

MinistryofExternalAffairs

• DrGulshanRai,NationalCyberSecurityCoordinator

• MrJaspreetSingh,Partner–CyberSecurity,Africa,India&MiddleEast(AIM),Ernst&

Young

• MrMannanGodil,CISO-InformationSecurityGroup,EdelweissRural&Corporate

ServicesLimited

• MrNafeesAhmed,CIO,IndiabullsGroup

• DrNVijayaditya,FormerDirectorGeneral,NIC

• MsRPriyamvada,ITHead,EngineersIndiaLtd(EIL)

• DrShefaliDash,FormerDirectorGeneral,NationalInformaticsCentre

• MrSivaramaKrishnan,Leader-CyberSecurity,PwC

• MrSSSarma,Director,CERT-In,MeitY




©SKOCH,2019

19

Encl2:SecuringIndianCyberSpace–PWCInputs

Cyber Security

Securing Indian Cyber SpaceDiscussion document

Strictly Private and ConfidentialDraft

January 2017




©SKOCH,2019

20

Encl3:InformationSecurityAssuranceFrameworkfore-Governance–MDIInputs

Information Security Assurance Framework for e-Governance (ISAF) 2016

1

Information Security Assurance Framework for e-Governance -Introduction and Overview March 2016

DOCUMENT NUMBER & VOLUME

Draft prepared by

Management Development Institute, Gurgaon

Study Commissioned by

Department of Electronics and Information Technology, Ministry of Communication and IT




©SKOCH,2019

21

2ndCommunication:Follow-upE-Mail,9thMarch2019DearThanksforjoiningtheCyberPatriotInitiative.Movingforwardtheplanisasfollows:Phase-I

1. VisualiseCyberSecurityDoctrineasabook.2. MakeChapterisationPlan.3. Open for comments and to identify areas that need to be covered in each Chapter. (I

enclosethedraftplanandseekyourhelpinfinetuningandidentifyingcontentineachchapterthroughsub-headsperhaps).Feelfreetoproposeadditionalchapters.Theideaistocreateatemplate.

4. Formallaunchoftheinitiativeandapublicdiscussiononthecontentproposedtoseekinputsandshareideas.

5. ThisisscheduledonMarch23,2019atConstitutionClubofIndia,NewDelhifrom09:00to12:00hrs.

6. PeopleonthisdiscussionareDr.GulshanRai(NCSC);AkhileshTuteja(KPMG);DrAnjaliKaushik (MDI); Jaspreet Singh (E&Y); Sivarama Krishnan (PwC); Gautam Kapoor(Deloitte);BrijeshSingh(MaharashtraPolice);GautamPande(MasterCard);DrShefaliDash(formerDG-NIC);ShivkumarPandey(BSE).

7. Thefirstadvertisementon thiswaspublishedonMonday,11thMarch2019 in IndianExpress(National)andinMint(Bangalore,ChennaiandAhmedabad).

8. Membersareinvitedtoparticipatea)Inperson(justmailus),nodelegatefeewouldapplyorb)watchandcommentonFacebooklive.

Phase-II

1. Depending on the interest and expertise, identify teams and coordinators for eachChapter.

2. Teamstocreatedraftsandthenopenthemfordiscussion.3. Localworkshopsandfacetofacecanbeorganised.4. Finalisethedraftchaptersandopenforcommentsanddiscussion.5. ChapterstobepresentedonAugust17th,2019atthefirstCyberPatriotsSummitatNew

Delhi.Doblockyourcalendarnow.6. Basedoninputsanddiscussions,chaptersneedtobefinalised.7. BooktobeproducedandreleasedinQ-42019timeframe.

Thisiswhereweare,lookforwardtoyoursuggestionsandmoreimportantlyyourcontributionstowardsthechaptersandvarioussectionsplanned.Youmayproposemoreexpertsthatcouldbeapproachedtocontributeonvariousareas.Thanksandregards,SameerKochharChairmanSKOCHGroup




©SKOCH,2019

23

Encl1:TentativeStructureoftheBookIndia’sCyberSecurityDoctrine

1. Introductiona. DefiningCyberandLifeinaNetworkedWorldb. EvolutionofCyberThreatsc. StatusofCyberinIndiad. CyberAttacksandCyberEspionagee. DisruptionsinBFSI,PaymentsSystem,GovernmentandIndustryf. TypesofThreatsandResponseg. NeedforaCyberSecurityDoctrineh. ExistingCyberSecurityFrameworkandPolicyi. CybervsDigitalIndiaj. Cybersecurityasapublicgoodk. Producingcybersecurityvsmanaginginsecurity

2. ThreatorPerceptiona. DeterminingMotivesofCyberTerrorismb. BuildingResilienceasPre-emptivec. ProtectingNetworksagainstInnovationsd. Howothershavedoneit?e. TheLegalFrameworkf. India’sReadiness

3. ProtectingAgainstaCyberWara. DetectionandResponseb. Surveillanceinnetworkedsystemsc. CyberDeterrenced. VulnerabilityManagemente. RegulatoryFrameworkf. Doctrineofpreventiong. Doctrineofriskmanagementh. Doctrineofdeterrencethroughaccountability

4. CriticalInformationInfrastructurea. NationalSecurityandPrivacyb. DataProtectionc. FreedomofExpressiond. CreatingStandardse. EducationandAwarenessf. StrengtheningInstitutionsandCapacityBuilding

5. ContoursofCyberSecurityDoctrinea. Policy:National,Corporate,Individualb. Technology:AI,Blockchain,IoTc. DiplomacyandPointsofMultilateralNegotiationsd. CoordinationStructureforCyberandInformationWarfaree. Patchingvsisolationf. AIbasedautomaticresponsesystems

6. Recommendations




©SKOCH,2019

24

Encl2:NationalReleaseannouncingtheTaskForce

FOR SPONSORSHIP AND EXHIBITION OPPORTUNITIES: [email protected] REGISTER AT delegate.skoch.in skochgroup@skochsameer skochsameer@skochgroup

GOLD SPONSORS

Sameer KochharChairman

SKOCH Group

Kaveree BamzaiFormer Editor, India Today

POST TRUTH PATRIOTISM

Gulshan RaiNational Cyber Security

Coordinator

Cheering our armed forces is essential, but can we also constructively use our

own patriotism to make it more actionable for the nation?

CYBER PATRIOTISMWe need strategy and policies – at the national, corporate and individual levels. We need these across verticals – Fintech, internal security, social and information technology. We need a whole regime of international diplomacy and multilateral negotiations. We are raising a Cyber Patriotism Task Force to write India’s Cyber Security Doctrine.

CORPORATE PATRIOTISMWhat is patriotic corporate conduct? Besides fewer scams, paying taxes honestly, not being a wilful defaulter and not adding to Non-Performing Assets (NPAs) of banks, of course.

ECONOMIC PATRIOTISM MSMEs are the lifeline of the economy. They are a source of livelihood for millions of Indians. MSMEs, including kirana stores, are folding up. On the one hand is the MNC onslaught and on the other is big Indian business wanting to monopolise. We try to create a knowledge

based argument on what needs to change to protect and promote MSMEs.

POST TRUTH PATRIOTISMLies, mistaken beliefs, fake news and erroneous information endanger democracy. Ultimately, each one of us must do what we can at our individual OHYHO� WR�¿JKW�PLVLQIRUPDWLRQ�ZDUIDUH�DQG�safeguard India’s cherished democracy.

57TH SKOCH SUMMIT will serve as a wake-up call to all Indians to remind us of our duties and the fact that patriotism has to be practiced.

www.caii.in www.skoch.inwwwww

��

PRACTISING PATRIOTISM57th

23rd March 2019, Constitution Club of India, New Delhi

Akhilesh TutejaGlobal Co-Leader - Cyber

Security, KPMG

Anjali KaushikProfessor, Management

Development Institute (MDI)

Jaspreet SinghPartner – Cyber Security, AIM

Ernst & Young

Sivarama KrishnanLeader - Cyber Security

PwC

Gautam KapoorPartner, Cyber Security

Deloitte

Brijesh SinghInspector General of Police -

Cyber, Maharashtra

Gautam PandeDirector - Authentication and

Decision Products, Mastercard

Shefali DashFormer Director General,

National Informatics Centre

Shivkumar PandeyCISO

BSE Ltd

CYBER PATRIOTISM

M DamodaranChairman, Damodaran Group and Former Chairman, SEBI

Bhaskar ChatterjeeFormer Secretary

Government of India

Deepali Pant Joshi,Distinguished Fellow, SKOCH &

Former ED, RBI

Kishore SansiDistinguished Fellow, SKOCH & Former MD & CEO, Vijaya Bank

Rajeev Kumar Agarwal,Former Whole Time Member

SEBI

Rajkiran Rai GManaging Director and CEO

Union Bank of India

Saurabh ChandraChairman, MCX and Former

Secretary, Government of India

CORPORATE PATRIOTISM

Anil BhardwajSecretary General

FISME

Dilip ChenoySecretary General

FICCI

Priyanka MokshmarChairman and Managing

Director, Vaayu India

Mahavir LunavatGroup MD, Pantomath Capital

Advisors Private Limited

Shubhashis GangopadhyayManaging Trustee & Research

Director, IDF

Rohan KochharDirector, Public Policy

SKOCH Group

Subodh AgarwalAddl. Chief Secretary - Industries

Government of Rajasthan

ECONOMIC PATRIOTISM

Aruna SharmaDistinguished Fellow, SKOCH &

Former Secretary, GoI




©SKOCH,2019

25

1stCommunication:IntroductoryLetter,February2019DearPatriotismcanbegut-wrenching!Youwanttodosomethingforthecountry,butdon’tknowhowto?India is being bled through amillion cuts. Not all of them are physical. Our cybersecurity isconstantly under attack from within the country and outside. As we move on to digitiseeverything, conventional armieswill be replaced by cyber armies and criminalswill becomecybercriminals.ThisgotmethinkingonthelevelofpreparednessofIndiaasacountryagainstcybercrime,cybermonopoliesandthethreatofapotentialcyberwar.Ispoketotheindustry,theassociations,thegovernment,thethink-tanks,socialnetworksetc.toputtogetheradatabaseofpeoplewhocanmeaningfullycontribute.Youwillbeshockedtoknowthattherearelessthan1,000Indianswiththerequisiteskillsetstoevencomprehendwhatisrequiredtobedone.Throughmyresearch,yournamecameupasoneofthose1,000Indians,whohaveboththeskillandtheabilitytocontribute;whichislessthan.0001%ofourpopulation.Thequestiontoyouthenis,wouldyou?Iinviteyoutoparticipateinagreatnationalsecurityinitiative.Wehavesetupadiscussiongrouponcybersecuritywiththefollowingobjectives:

• IdentifythecontoursofIndiancybersecuritythroughthefollowingviews:o Policy,e.g.,national,corporate,individualetc.o Verticals,e.g.,financialservices,homelandsecurityetc.o Technology,e.g.,AI,Blockchain,IoTo Diplomacyandpointsofmultilateralnegotiations,e.g.,datalocalisation

• Havingidentifiedanddetailedtheabovedocumentandevolveacoherent,implementablestrategy.Thatcanbepublishedasabluebookandperiodicallyupdated.

TheinitiativeisbeingdrivenbySKOCHDEVELOPMENTFOUNDATION,anot-for-profitcompany.ThedetailsofourDistinguishedFellows&AdvisoryBoardareasfollows:

• Dr N C Saxena, Distinguished Fellow, SKOCH Development Foundation & FormerSecretary,PlanningCommission,GovernmentofIndia

• DrMRamachandran,DistinguishedFellow,SKOCHDevelopmentFoundation&FormerSecretary,UrbanDevelopment,GovernmentofIndia

• Dr Zohra Chatterji, Distinguished Fellow, SKOCH Development Foundation & FormerSecretary,Textiles,GovernmentofIndia

• DrArunaSharma,DistinguishedFellow,SKOCHDevelopmentFoundation,DevelopmentEconomist&FormerSecretary,Steel,GovernmentofIndia




©SKOCH,2019

26

• Prof Charan Singh, Distinguished Fellow, SKOCH Development Foundation & Non-ExecutiveChairman,PunjabandSindBank

• MrKishoreSansi,DistinguishedFellow,SKOCHDevelopmentFoundation&FormerMD&CEO,VijayaBank

• DrDeepaliPantJoshi,DistinguishedFellow,SKOCHDevelopmentFoundation&FormerExecutiveDirector,ReserveBankofIndia

• MrBhaskarPramanik,DistinguishedFellow,SKOCHDevelopmentFoundation&FormerChairman,MicrosoftIndia

• MrNirmalBansal,SeniorFellow,SKOCHDevelopmentFoundation&FormerBanker• ProfVNAlok, SeniorFellow, SKOCHDevelopmentFoundation&AssociateProfessor,

IndianInstituteofPublicAdministration• DrKGKarmakar,SeniorFellow,SKOCHDevelopmentFoundation&FormerManaging

Director,NABARD• ProfDeepakBPhatak,Director,SKOCHDevelopmentFoundation&ProfessorEmeritus,

IITBombayAfewoftheinitialmembersoftheCyberSecurityDiscussionGroupare:

• MrSivaramaKrishnan,Leader,CyberSecurity,PricewaterhouseCoopersPvtLtd• Mr Ankush Chowdhary, Principal Security Advisor, Asia Pacific Japan, Amazon Web

Services• MrAkhileshTuteja,Partner,NationalHead-TechnologyandBPMSector,KPMG• MrRahulAggarwal,Partner,CyberSecurity,PricewaterhouseCoopersPvtLtd• MrGautamPande,Director,EnterpriseSecuritySolutions-SouthAsia,Mastercard• MrJaspreetSingh,Partner–CyberSecurity,Africa,India&MiddleEast(AIM),Ernst&

Young• MrC.MuralikrishnaKumar,SeniorAdviser-ICT,NITIAayog,GoI• ProfDeepakBPhatak,Director,SKOCHDevelopmentFoundation&ProfessorEmeritus,

IITBombay• MrDinesh(Krishna)Pillai,ManagingDirector,AcquisoryRiskConsultingPvt.Ltd.• DrNVijayaditya,FormerDirectorGeneral,NIC• MsPratibhaJain,Partner,NishithDesaiAssociates• ProfAnjaliKaushik,Professor,ManagementDevelopmentInstitute,Gurgaon

Given the time pressures on experts such as yourself, our attempt is to hold most of thediscussions remotely through email, calls, online and so on. There may be smaller groupdiscussionsheldatDelhi,Mumbaietc.togetsomefacetime.Basedonthese,someofthemembersmaywishtocontributepapersandotherstocritiqueandmakesuchinputsbetter.Yetothersmaycontributetotheknowledgerepositoryandsharebestpractices.AsIndiacelebratesthe73rd IndependenceDay,oureffortswouldcometogetherasanationalconsultationonAugust17,2019,atConstitutionClubofIndia,NewDelhientitled“CyberPatriotsConvention”.ItwillbethebiggestgatheringofIndiancyberexperts.Basedonthepapers,discussionsandtheconference,thefirst“IndianCyberSecurityDoctrine”wouldbepublishedasabook.The relevant stakeholders from the government, policymaking, civil society etc. would beengagedtomakeourworkameaningfulandactionableinput.




©SKOCH,2019

27

Atthisjuncture,followingquestionsmaycometoyourmind:

Q:WhatdoIhavetodo?A:Beinvolvedinconsultationsanddiscussions.Contributethroughinputsorwrite-ups,ifyousodesire.Q:Whatisthenatureofthisinvolvement?A:Theinvolvementispurelyvoluntarywithoutanyfinancialorlegalliability.Q:HowmuchtimedoIneedtocommit?A: Whatever can fit into your day-to-day schedule, while being patriotically justifiable.Leavingasidepaperwriting,thismayamountto4-5mandaysspreadoveraone-yeartimeperiod.Q:Whatisinitforme?A:Besidesthegreatsatisfactionofhavingservedthecountry,thisisahighvisibility,highimpactexercisewherethememberswillreceivenationalpublicityandmayevenqualifyfortheprestigiousSKOCHCyberPatriotAwardonthebasisofthecontributionsmade.

Ifyouhaveanyotherquestions,Iwouldbehappytoaddressthose.MayIrequestyoutokindlyacknowledgereceiptatskoch@skoch.in.IlookforwardtoyourkindacceptancetohelpincludeyoutotheCyberPatriotdiscussiongroup.Thankingyou,Yourssincerely,SameerKochharChairmanSKOCHGroup+919811089604Encl(s):

1. Book“ModiNomics:InclusiveEconomics,InclusiveGovernance”authoredbySameerKochhar

document name: back story (latest information...

Documents