Every time you order food online, pay a friend back over UPI, or log into your college portal, you are handing over a small piece of personal data. Multiply that by the hundreds of millions of Indians online today, and you get a digital economy that runs on trust. Security and privacy in Information and Communication Technology (ICT) are what keep that trust intact. When either breaks down, the fallout ranges from an emptied bank account to a hospital that cannot pull up a patient’s file. This post walks through the main threats you should know about, the tools that defend against them, the privacy questions that come with a data-driven world, and a real Indian case study that shows what happens when security fails.
Table of Contents
Understanding security threats and attacks
A security threat is any deliberate attempt to compromise the confidentiality, integrity, or availability of digital information. In simple terms: someone is trying to see data they should not see, change data they should not change, or block access to systems that people rely on. India’s cybersecurity nodal agency, CERT-In, tracks these incidents at national scale, and the trend line only goes up as digital payments, e-commerce, and online governance expand.
Malware
Malware, short for malicious software, is any program built to damage a system or steal information without the user’s consent. This includes viruses that attach themselves to files, worms that spread across networks on their own, trojans that disguise themselves as legitimate software, and ransomware that locks up files until a ransom is paid. Malware infections in India have been rising sharply; CERT-In’s own data shows malware attacks increased by 45 per cent in a single year, alongside a jump in unauthorised network scanning and website intrusions.
Phishing
Phishing relies on deception rather than code. An attacker sends an email, text message, or fake website that looks like it comes from a bank, employer, or government body, and tricks the recipient into typing in a password, OTP, or card number. During the pandemic, CERT-In flagged a wave of phishing attempts built around the Aarogya Setu contact-tracing app, where scammers impersonated HR departments and health officials to spread panic-driven messages. Phishing has grown even faster than malware in recent years; the same CERT-In report cited above recorded a 230 per cent rise in phishing incidents compared to the previous year.
Hacking
Hacking refers to unauthorised access to a computer system or network, whether to steal data, disrupt operations, or plant further malware. It can be as simple as guessing a weak password or as sophisticated as exploiting an unpatched software vulnerability. Government portals, banks, and hospitals are frequent targets precisely because they hold large volumes of sensitive data, and India has been ranked among the most targeted countries for ransomware attacks globally, second only to the United States.
Cybersecurity measures that keep systems safe
Every threat above has a corresponding line of defence. No single tool covers everything, which is why organisations layer several measures together.
Firewalls
Firewalls sit at the boundary of a network and decide which traffic is allowed in or out, based on rules around IP addresses, ports, and protocols. A firewall is often described as the first line of defence in network security, blocking known-bad traffic before it ever reaches internal systems.
Antivirus software
Antivirus software works at the device level. It scans files, downloads, and email attachments for known malicious code and stops it from executing. A good antivirus solution also watches for suspicious behaviour in real time, not just files that match an existing virus signature, since new malware variants appear constantly.
Intrusion detection systems
Intrusion detection systems (IDS) monitor network or system activity for signs of an attack that may have slipped past the firewall or antivirus. An IDS does not usually block traffic on its own; instead, it detects anomalies and alerts administrators, who can then investigate and respond. Its more active cousin, the intrusion prevention system, goes a step further and blocks suspicious traffic automatically. Together, firewalls, antivirus tools, and intrusion detection form layers of defence, so that if an attacker gets past one, another layer is still standing in the way.
Privacy issues in the digital age
Security is about keeping attackers out. Privacy is a related but separate question: even when a system is secure from outside attack, how much personal data should be collected in the first place, and who gets to control what happens to it afterward? Apps, websites, and even public Wi-Fi networks collect location data, browsing habits, purchase history, and biometric details, often far beyond what is strictly needed to deliver the service.
India’s Supreme Court settled part of this question in 2017, ruling that privacy is a fundamental right under Article 21 of the Constitution. That judgment set the stage for the Digital Personal Data Protection Act, 2023, which is India’s first comprehensive law dedicated to digital personal data. The Act requires organisations, referred to as data fiduciaries, to collect data only for a clear, stated purpose, obtain valid consent, and allow individuals to withdraw that consent later. Entities that handle especially large volumes of sensitive data can be designated as Significant Data Fiduciaries, which comes with extra obligations such as appointing a dedicated Data Protection Officer.
Even with a strong law in place, the practical challenge remains: most users click “agree” on lengthy privacy policies without reading them, and once data is shared with one app, tracing exactly where copies of it end up is nearly impossible. That lack of visibility and control is the core privacy problem of the digital age, and it is separate from, though closely linked to, the security failures discussed below.
Ethical considerations and a real data breach case study
Beyond laws and firewalls, ICT professionals and organisations carry an ethical responsibility to protect the data entrusted to them, especially in sectors like healthcare where a breach can affect patient safety directly. The 2022 ransomware attack on the All India Institute of Medical Sciences (AIIMS), Delhi, is one of the clearest illustrations of what happens when that responsibility is not met.
On 23 November 2022, doctors at AIIMS found they could not access patient records, lab results, or the appointment system. The hospital’s Hospital Information System had been hit by ransomware, and investigators later found that attackers had breached a hospital system storing sensitive patient histories, diagnostic reports, and financial information. Within days, AIIMS had to shift entirely to manual, paper-based operations to keep patient care running. According to reporting on the incident, the breach potentially exposed personal data belonging to nearly three to four crore patients, including administrative records on blood donors, vaccinations, and hospital staff. Attackers reportedly demanded a large ransom in cryptocurrency in exchange for restoring access.
The response involved multiple government agencies, including CERT-In, the Delhi Police, and national investigative bodies, working together to trace the attack and restore systems. It took the hospital roughly two weeks to bring core services back online. The case carries a few clear lessons for anyone working with ICT systems:
Regular system updates close known vulnerabilities before attackers can exploit them. Outdated software is one of the easiest entry points for hackers.
Layered security measures, including firewalls, antivirus tools, and intrusion detection, need to be applied consistently across every server, not just the ones considered “critical.”
Incident response plans matter as much as prevention. Organisations that can switch to backup processes quickly, as AIIMS did with its manual paper system, limit the damage a breach causes to essential services.
The healthcare sector carries an added ethical weight here: a breach does not just cost money or embarrass an institution, it can delay treatment for people who are already unwell. That is precisely why data protection laws increasingly treat health data as a special, more sensitive category deserving stronger safeguards than ordinary personal information.
Bringing it all together
Security and privacy are two sides of the same coin. Security measures like firewalls, antivirus software, and intrusion detection systems protect data from being stolen or destroyed by outside attackers. Privacy principles and laws like the DPDP Act govern how that same data should be collected and used even when no attack is happening at all. Ethical responsibility ties both together: technology built without care for security or privacy eventually fails the very people it is meant to serve, as the AIIMS case makes clear.
What do you think? If you were designing the IT policy for a college or hospital in India today, which would you prioritise first with a limited budget: stronger technical defences like firewalls and intrusion detection, or better staff training to prevent phishing in the first place? And how much personal data are you comfortable sharing with an app in exchange for convenience?
References
- https://www.pib.gov.in/PressReleasePage.aspx?PRID=2217537&lang=1®=3
- https://www.business-standard.com/india-news/1-39-million-cyberattacks-handled-in-2022-phishing-attacks-rise-cert-in-123111500614_1.html
- https://www.pressreader.com/india/hindustan-times-delhi/20200517/281844350824241
- https://gulfnews.com/amp/world/asia/india/how-indias-premier-cyber-agency-is-fighting-evolving-threats-1.1607259141285
- https://www.stamus-networks.com/blog/what-is-the-difference-between-a-firewall-and-ids
- https://www.infosecinstitute.com/resources/network-security-101/network-design-firewall-idsips/
- https://www.dlapiperdataprotection.com/?t=law&c=IN
- https://fpf.org/blog/the-digital-personal-data-protection-act-of-india-explained/
- https://aikosh.indiaai.gov.in/home/use-cases/details/aiims_delhi_ransomware_attack_cyberpeace_foundation_s_insights_for_forging_secure_and_resilient_digital_health_ecosystems_in_india.html
- https://blog.lukmaanias.com/2023/03/22/topic-cyberattack-on-critical-information-ci-infrastructure-a-case-study-of-ransomware-on-aiims/
Leave a Reply