Overview
- Critical services like water, electricity, banking, transport and healthcare depend on a vast network of infrastructure.
- Over the last few decades, these services have been scaled up through automation, IoT and Artificial Intelligence.
- However, the same connectivity that improves efficiency also expands the risk of remote disruption.
The IT-OT-IoT Triad: Understanding the Risk
- IT (Information Technology) operates in the digital space processing data and enabling computing.
- OT (Operational Technology) operates in the physical world of plants, machinery and industrial automation.
- IoT (Internet of Things) connects the two by sensing physical conditions and sending real-time data to digital systems.
- Earlier, systems were managed locally through SCADA (Supervisory Control and Data Acquisition) systems.
- Today they are increasingly connected to the internet for centralised monitoring and predictive maintenance.
- If the IoT layer is compromised, control over physical processes can be misused causing real-world damage.
Key Vulnerabilities
- Physical installations may be secure but IoT devices connecting them to digital systems remain exposed.
- Imported devices deployed in sensitive installations may contain hidden vulnerabilities, embedded Trojans or malicious control pathways.
- Tender conditions often do not insist on trusted Indian-made products or deep security evaluation.
- Eligibility is assessed through template-based compliance checks rather than careful security examination.
- Electronic locks with GPS capabilities manufactured in China are being certified as Indian products which is a serious concern.
- A recent attack on United States gas station fuel storage monitoring systems shows how real this threat is globally.
Existing Mechanisms and Their Limitations
- CERT-In (Indian Computer Emergency Response Team) addresses conventional cyber security threats.
- STQC (Standardisation Testing and Quality Certification) ensures cameras do not perform unintended data-sharing functions.
- However, similar certification mechanisms are not yet available or enforced for many other IoT devices used in critical infrastructure.
- Existing IT guidelines and IoT policies are not enforced with the seriousness required for national-level infrastructure.
Way Forward
- Tender conditions must mandatorily insist on trusted Indian-made products for critical infrastructure procurement.
- Rigorous certification mechanisms for all IoT devices used in critical infrastructure must be developed and enforced.
- The intent of Atmanirbhar Bharat and Make in India must translate into actual procurement practices at all levels.
- Continuous vigilance across government and industry is essential to detect and prevent infrastructure attacks.
- India must treat critical infrastructure safety as a matter of sovereignty, resilience and economic security and not merely a technical issue.
Conclusion
- The question is not whether India should adopt connected technologies but whether it is deploying them securely enough. As India moves toward becoming a major global digital economy, protecting critical infrastructure is a national security imperative that cannot be delayed.
