UPSC CSE · Mains GS-III · Security · TOPIC LESSON
Assess security risks through evidenced conduct, vulnerabilities and consequences, with resilient services and proportionate public institutions.
BY THE END, YOU CAN
BEFORE YOU START
Original educational lesson. Work through the examples before revealing the practice answers. This original common-core lesson supports its declared paper scope. Optional subjects, qualifying language papers and the interview are outside this resource.
LEARN THROUGH ORIGINAL PRACTICE
All teaching examples, cases, prompts and model answers are original. Official exam questions and answer keys are not reproduced. This common-core lesson does not imply complete historical paper coverage or an official score.
01 / UNDERSTAND & APPLY
State actors act through governmental institutions. Non-state actors include individuals, lawful businesses, civil-society organizations and other groups, as well as criminal or violent organizations. Non-state describes an institutional category, not hostility or illegality.
Identity, intent, capability and conduct answer different questions. An actor can possess a technical capability without intending harm; an intention may exist without the ability to carry it out; observed conduct requires its own evidence. Nationality, religion or peaceful political disagreement cannot substitute for that evidence.
A useful security analysis defines the protected interest and the alleged harmful behaviour. Broad labels can obscure lawful cooperation and misdirect attention from actual vulnerabilities. The examples here are hypothetical and do not accuse a current government, company or community.
ORIGINAL PRACTICE · 1
A lawful community organization providing disaster assistance is a non-state actor and can strengthen public resilience.
The category also includes businesses and individuals with lawful roles. Assess specific conduct and evidence rather than infer hostility from being outside government.
02 / UNDERSTAND & APPLY
Threat assessment considers relevant intent and capability. Vulnerability concerns weaknesses that could be exploited or cause harm, while consequence concerns what would happen if a disruption occurred. A serious capability is not proof of an imminent attack, and a vulnerability can matter even when no hostile actor has been identified.
Prioritization should consider likelihood, impact, uncertainty, prevention cost and resilience. A scenario is a tool for testing preparedness, not an intelligence finding. Clearly label assumptions and distinguish a plausible possibility from evidence that an event is occurring.
Expected loss can support comparison, but the same average can hide different distributions and rights implications. Essential-service failure, irreversible harm and uncertainty may require attention beyond a single score.
Full-size scientific diagram. Swipe or scroll horizontally; keyboard users can focus the diagram and use arrow keys.
ORIGINAL WORKED EXAMPLE
In an original one-year model, risk A has probability 0.02 and loss 500 units if it occurs; B has probability 0.20 and loss 30 units. Assume zero loss otherwise and assess the risks separately.
Answer Expected annual losses are 10 and 6; final priority needs consequences, confidence, prevention costs and feasible measures.
ORIGINAL PRACTICE · 1
Capability is an ability; intent concerns a purpose or willingness to act; imminence requires evidence about a near-term threat in context.
Possession of a technology or resource alone does not establish the other two. Assess corroborated behaviour and uncertainty before making a consequential allegation.
03 / UNDERSTAND & APPLY
External support to harmful actors may have political, financial, informational or material dimensions. The existence and nature of such support require corroboration and an explicit confidence level. A shared interest or public statement does not by itself establish direction, control or responsibility for a particular act.
Domestic grievances and institutional weaknesses can interact with external pressure. Evidence of foreign involvement would not explain every internal conflict or remove domestic responsibility for fair governance and effective services. Conversely, domestic problems do not rule out external links.
The analytical task is to separate mechanisms and evidence rather than select one total explanation. Investigations and public claims must respect applicable standards, while service protection can address known vulnerabilities without waiting for every attribution question to be resolved.
ORIGINAL PRACTICE · 1
They concern different mechanisms: external resources or pressure may interact with local conditions that shape vulnerability or participation.
Neither explanation automatically displaces the other. Establish each link through evidence and preserve domestic accountability rather than use a foreign allegation to dismiss every local concern.
04 / UNDERSTAND & APPLY
Cyber disruption, disinformation, economic coercion and violence can interact across civilian systems. Hybrid pressure is an analytical description of such combinations, not a universal legal category that settles jurisdiction or permissible response.
Ordinary economic competition, criticism and lawful advocacy must be distinguished from coercive or unlawful interference. A foreign source or unpopular opinion does not automatically make speech a security threat. Evidence of deception, harmful conduct or other relevant facts must be assessed within the applicable framework.
Responses should address the demonstrated mechanism. A broad measure that suppresses legitimate activity can impose large costs without reducing the actual vulnerability. Proportionality and review help avoid turning uncertainty into an unlimited mandate.
ORIGINAL WORKED EXAMPLE
A fictional allegation of coordinated foreign influence relies on shared language and synchronized posts. Assess what follows and propose a proportionate approach.
Answer Treat the pattern as a limited indicator, seek lawful corroboration and protect legitimate speech while addressing evidenced misconduct.
05 / UNDERSTAND & APPLY
Energy, transport, finance, water, communications and health services are interdependent. Electricity failure can affect communications and water pumping; communications failure can impair coordination and payment access. Continuity planning should therefore consider service networks rather than only individual assets.
Redundancy, alternative suppliers and tested recovery arrangements can reduce consequences, but each has costs and must function under the relevant disruption. A backup dependent on the same failed component may offer little protection. Assurance and maintenance are continuing governance tasks.
Supply concentration and vendor dependence can create vulnerability without proving hostile intent. Quality, substitution time, contractual support and repair capability matter alongside supplier nationality. No single technology purchase makes a complex service secure.
ORIGINAL WORKED EXAMPLE
A fictional public agency obtains 80% of a critical input from one overseas supplier. Analyze resilience options without alleging hostility.
Answer Treat concentration as a vulnerability to assess, then compare feasible resilience measures without inferring hostile intent.
ORIGINAL PRACTICE · 1
Water pumping and communication services can depend on reliable electricity.
The severity of interruption depends on actual system design, backup capability and duration. Map and test those dependencies rather than assume every outage causes identical consequences.
ORIGINAL PRACTICE · 2
Known service dependencies and continuity needs can be addressed regardless of whether the cause was accident, error or hostile action.
Investigation should continue, but appropriately authorized protective work need not wait for public blame. Avoid measures that presume an unproven culprit or interfere with evidence.
06 / UNDERSTAND & APPLY
Transparent, verified communication can reduce panic and manipulation. It should distinguish what is known, uncertain and being investigated, and correct errors promptly. Independent scrutiny can reveal mistakes and strengthen credibility rather than being treated automatically as disloyalty.
Suppressing every disagreement can undermine trust and reduce the availability of useful information. Countermeasures affecting privacy or expression need a lawful basis, necessity, proportionality, oversight and a route to challenge or correct mistakes.
Security and institutional legitimacy can support one another when people see that measures are evidence-based and constrained. This does not eliminate difficult tradeoffs, but it requires explaining them and reviewing whether the measure actually reduces harm.
ORIGINAL WORKED EXAMPLE
Develop an original answer to the claim that strong security necessarily requires abandoning civil liberties.
Answer Use evidence-based, proportionate measures with oversight and correction, while strengthening resilience and public trust.
07 / UNDERSTAND & APPLY
Police, intelligence bodies, regulators, emergency agencies, diplomatic institutions and private operators hold different information and responsibilities. Coordination should establish who assesses, who investigates, who manages service continuity and who communicates, without assuming one body has every power.
Lawful information sharing can reduce gaps and duplication, but indiscriminate pooling can expose personal data and confuse responsibility. Share what is necessary for a defined purpose with appropriate access, quality checks and accountability. Coordination is not the removal of all institutional boundaries.
International cooperation can assist evidence gathering, standards and response, but sovereignty, jurisdiction and rights remain relevant. An allegation does not automatically oblige another state to take the requested action. Procedures and evidential requirements must be respected.
ORIGINAL PRACTICE · 1
Sharing can reveal dependencies and coordinate response, while excessive or inaccurate sharing can expose personal information and spread errors.
Use lawful purpose-based access, data minimization, quality checks and clear responsibility for action and correction. The amount of data shared is not itself a measure of effective coordination.
08 / UNDERSTAND & APPLY
Technical indicators describe observed features; intelligence assessments interpret evidence with stated confidence; public allegations make claims; judicial findings arise through the applicable legal process. These categories have different standards and limitations and should not be treated as interchangeable proof.
A system outage can result from accident, error, equipment failure or hostile action. Initial similarity to another event does not establish a common actor. Investigators should test alternatives while service managers protect users and preserve relevant evidence through authorized procedures.
Public communication should avoid premature blame and avoid pretending certainty when attribution remains unresolved. It can still provide clear information about service status and protective institutional actions without revealing sensitive operational details.
ORIGINAL WORKED EXAMPLE
A fictional national payment service suffers an outage with an unknown cause. Develop a response at governance level.
Answer Separate continuity, authorized evidence handling, transparent communication and attribution review; protect service without inventing a culprit.
ORIGINAL PRACTICE · 1
As an allegation with its source and limitations, pending corroboration and evaluation of alternative explanations.
Do not upgrade it to an established fact merely because it is repeated. Consequential action requires the applicable authority and evidence standard, with appropriate safeguards.
09 / UNDERSTAND & APPLY
A strong answer connects a specified vulnerability to preventive safeguards, continuity, lawful response and oversight. It should compare costs and implementation capacity and explain how success will be measured through reduced harm and dependable institutions.
The examples are original and hypothetical. No classified information, current intelligence assessment, target-specific weakness or operational attack or response method is provided. Institutional sources support broad public functions and defensive risk governance, not accusations against named actors.
ORIGINAL PRACTICE · 1
“Security policy should assess evidenced conduct and concrete vulnerabilities while maintaining resilient essential services. Clear institutional roles, lawful information sharing and proportionate measures with independent oversight can reduce harm without treating identity or dissent as threat evidence. Public confidence depends on accurate communication, correction of errors and demonstrable service protection.”
The conclusion integrates risk, rights and implementation. A full answer should specify the scenario’s uncertainty and the evidence needed to review the chosen measures.
KEEP THE BIG IDEAS
READ WITH CONTEXT
The teaching notes, passages, worked explanations and practice are original. Official references identify the assessment framework and skill scope; they do not endorse this lesson or license official question reproduction.
Administrative, diplomatic, security, legal and economic coordination; public border-management functions only. Checked 11 October 2026; broad public functions only.
Scheduled-offence investigation and transfer framework; avoid asserting jurisdiction over every crime. Checked 11 October 2026; broad public functions only.
Six concurrent governance functions: Govern, Identify, Protect, Detect, Respond, Recover. Defensive risk framework, not legal certification. Checked 11 October 2026; broad public functions only.
UPSC analytics cover only explicitly reviewed printed papers. Paper-specific parent counts include unresolved classifications; subparts and Essay choices remain separate. Teaching availability is independent of historical observations.