Lok Sabha Question No. 469 (UNSTARRED), answered on 2017-07-19
Subject: Cyber Security
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: SISIR KUMAR ADHIKARI

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 469

TO BE ANSWERED ON: 19.07.2017

## CYBER SECURITY

## 469 SHRI SISIR KUMAR ADHIKARI:

Will the Minister of Electronics & Information Technology be pleased to state:-

- (a) whether India ranks 4th globally in cyber threats of hacking data;
- (b) if so, the action proposed by the Government on security breaches therefor;
- (c) whether India has an instance of increase in cyber fraud from 3.4 per cent in 2015 to 5.1 per cent in 2016 therein; and
- (d) if so, the proposed action of the Government to prevent such attacks/threats?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI P.P. CHAUDHARY)

- (a):      There  have  been  some  media  reports  based  on  the  survey  by  Symantec  indicating  India ranks 4th globally in cyber threats of hacking data.
- (c): With the proliferation of Information Technology and related services there is a rise in instances of cyber crimes in the country like elsewhere in the world. As per the data maintained by National Crime Records Bureau (NCRB), a total of 9622 and 11592 cyber crime cases were registered during the years 2014 and 2015 respectively, showing a rise of 20% during 2014 to 2015. This includes cases registered under the Information Technology (IT) Act, 2000 and related sections of Indian Penal Code and  Special & Local Laws involving computer as medium/ target. Similar data for the year 2016 is under collection.  Further, as per the information reported to and tracked by Indian Computer Emergency Response Team (CERT-In), a total no. of 44679, 49455, 50362 and  27482 cyber security incidents were observed during  the year 2014, 2015, 2016 and 2017  (till June) respectively. The  types of cyber security incidents include phishing, scanning/probing, website intrusions and defacements, virus/malicious code, ransomware, Denial of Service attacks, etc.
- (b)  and  (d):  Government  has  taken  a  number  of  legal,  technical  and  administrative  policy measures for addressing cyber security.  These include  the following, namely:-
- I. Enactment of the Information Technology (IT) Act, 2000 which has adequate provisions for safety of sensitive personal information.
- II. Government is implementing a Framework for enhancing cyber security, with a multi-layered approach for ensuring defence-in-depth and clear demarcation of responsibilities among the stakeholder organizations in the country.
- III. Government  has  established  National  Critical  Information  Infrastructure  Protection  Centre (NCIIPC) as per the provisions of Section 70A of the IT Act, 2000 for protection of Critical Information Infrastructure in the country.
- IV. The CERT-In, a statutory authority under IT Act, 2000, issues alerts and advisories regarding latest cyber threats and countermeasures on regular basis.  CERT-In has published guidelines for  securing  IT  infrastructure,  which  are  available  on  its  website  (www.certin.org.in).    In

order  to  detect  variety  of  threats  and  imminent  cyber  attacks  from  outside  the  country, periodic scanning of cyber space is carried out.

- V. Government  has  initiated  setting  up  of  National  Cyber  Coordination  Centre  (NCCC)  to generate necessary situational awareness of existing and potential cyber security threats and enable  timely  information  sharing  for  proactive,  preventive  and  protective  actions  by individual entities.
- VI. Cyber  Crime  Cells  have  been  set  up  in  all  States  and  Union  Territories  for  reporting  and investigation of Cyber Crime cases.
- VII. Government has set up cyber forensic training and investigation labs in the States of Kerala, Assam, Mizoram, Nagaland, Arunachal Pradesh, Tripura, Meghalaya, Manipur and Jammu & Kashmir for training of law enforcement personnel and Judiciary in these States.
- VIII. Industry  associations  such  as  Data  Security  Council  of  India  (DSCI),  NASSCOM,  Cyber Forensic Labs, set up in certain States, have taken up tasks of awareness creation and training programmes on Cyber Crime investigation.  Academia like National Law School, Bangalore and  NALSAR  University  of  Law,  Hyderabad  are  also  engaged  in  conducting  several awareness and training programmes on Cyber Laws and Cyber crimes for judicial officers.
- IX. A  number  of  Cyber  forensics  tools  for  collection,  analysis  and  presentation  of  the  digital evidence  have  been  developed  indigenously  and  such  tools  are  being  used  by  law enforcement Agencies.
- X. CERT-In  and  Centre  for  Development  of  Advanced  Computing  (C-DAC)  are  involved  in providing  basic  and  advanced  training  to  law  enforcement  agencies,  Forensic  labs  and judiciary on the procedures and methodology of collecting, analysing and presenting digital evidence.
- XI. Reserve Bank of India (RBI) issues Circulars/advisories to all Commercial Banks on phishing attacks  and  preventive  /  detective  measures  to  tackle  phishing  attacks.    RBI  also  issues advisories  relating  to  fictitious  offers  of  funds  transfer,  remittance  towards  participation  in lottery, money circulation schemes and other fictitious offers of cheap funds.
- XII. All banks have been mandated to report cyber security incidents to CERT-In expeditiously.
- XIII. All authorised entities/banks issuing Prepaid Payment Instruments (PPIs) in the country have been advised to carry out audit by the empanelled auditors of CERT-In on a priority basis and take  immediate steps thereafter to comply with the findings of the audit report and ensure implementation of security best practices. Government has empanelled 54 security auditing organisations to support and audit implementation of Information Security Best Practices.
- XIV. Government has formulated Cyber Crisis Management Plan for countering cyber attacks for implementation by all Ministries/ Departments of Central Government, State Governments and their organizations and critical sectors. Regular workshops are conducted for Ministries, Departments,  States  &  UTs  and  critical  organizations  to  sensitize  them  about  the  cyber security  threat  landscape  and  enabling  them  to  prepare  and  implement  the  Cyber  Crisis Management Plan.
- XV. Government  has  launched  the  Cyber  Swachhta  Kendra  (Botnet  Cleaning  and  Malware Analysis Centre). The centre is providing detection of malicious programs and free tools to remove the same for banks as well as common users.
- XVI. Ministry  of  Home  Affairs  has  issued  National  Information  Security  Policy  and  Guidelines (NISPG) to Government organizations to ensure safety of data and minimize cyber threats.
- XVII. Cyber  security  mock  drills  are  being  conducted  regularly  to  enable  assessment  of  cyber security  posture  and  preparedness  of  organizations  in  Government  and  critical  sectors.  15 such drills have so far been conducted by CERT-In where 148 organisations from different states  and  sectors  such  as  Finance,  Defence,  Power,  Telecom,  Transport,  Energy,  Space, IT/ITeS, etc have participated.
- XVIII. CERT-In is conducting cyber security trainings for IT / cyber security professionals including Chief Information Security Officers (CISOs) of Government and critical sector organisations. 14  training  programs  covering  431  participants  and  13  training  programs  covering  329 participants were conducted during 2016 and 2017 (till June).
- XIX. Ministry of Electronics & Information Technology (MEITY) regularly conducts programs to generate  information  security  awareness.  Specific  book,  videos  and  online  materials  are developed  for  children,  parents  and  general  users  about  information  security  which  are disseminated through Portals like 'http://infosecawareness.in/' and 'www.cyberswachhtakendra.in'

********