Lok Sabha Question No. 3423 (UNSTARRED), answered on 2017-03-22
Subject: CERT-IN
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: JYOTIRADITYA MADHAVRAO SCINDIA

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 3423

TO BE ANSWERED ON: 22.03.2017

## CERT IN

## 3423 SHRI JYOTIRADITYA M. SCINDIA

Will the Minister of Electronics & Information Technology be pleased to state:-

- (a) whether in view of Union Government's push in promoting digital payments, the premier cyber security agency CERT-IN (Computer Emergency Response Team) has warned that all is not well with the digital mode of payments and it could be vulnerable to cyber attacks;
- (b) if so, the reaction of the Government on such warning by one of the premier cyber security agency;
- (c) whether the common man is feeling insecure by adopting mode of digital transactions; and
- (d) if so, the steps the Government proposes to take in this regard

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI P.P. CHAUDHARY)

(a):  The  Indian  Computer  Emergency  Response  Team  (CERT-In)  issues  alerts  and  advisories  regarding  latest cyber  threats/vulnerabilities  along  with  countermeasures  to  create  awareness  among  stakeholders  to  take appropriate measures to ensure safe usage of digital technologies. 21 such advisories have been issued regarding safeguards for users and institutions to secure digital payments.

(b), (c) and (d): In order to enhance security of online financial systems in the country, the following key actions are taken:

- (i) All authorized entities/banks issuing Prepaid Payment Instruments (PPIs) in the country have been advised by  Indian  Computer  Emergency  Response  Team  (CERT-In)  through  the  Reserve  Bank  of  India  (RBI)  to carry out audit by the empanelled auditors of CERT-In on a priority basis and take immediate steps thereafter to comply with the findings of the audit report and ensure implementation of security best practices.
- (ii) All organizations providing digital payment services have been mandated to report cyber security incidents to CERT-In expeditiously.
- (iii) Government has formulated Cyber Crisis Management Plan for countering cyber attacks for implementation by  all  Ministries/  Departments  of  Central  Government,  State  Governments  and  their  organizations  and critical sectors.
- (iv) Cyber security mock drills are being conducted regularly to enable assessment of cyber security posture and preparedness  of  organizations  in  Government  and  critical  sectors.  Till  date,  11  such  drills  have  been conducted by the Indian Computer Emergency Response Team (CERT-In) involving 110 organizations from different  sectors  including  Finance  sector.  The  last  drill  was  conducted  on  30th  September  2016  in coordination with Reserve Bank of India for Finance Sector.
- (v) Government has launched the Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre). The centre is providing detection of malicious programs and free tools to remove the same for banks as well as common users.
- (vi) Cyber security awareness sessions are conducted under the Digishala Awareness Campaign.
- (vii) 2 workshops have been held for banks, Internet Service Providers (ISPs) and Prepaid Payment Instruments (PPIs) issuing entities regarding security of digital payments systems.
- (viii) Ministry of Electronics & Information Technology (MeitY) has formulated draft rules on Security of Prepaid Payment Instruments under Information Technology, Act, 2000. The objective of the proposed rules is to ensure  adequate  integrity,  security  and  confidentiality  of  electronic  payments  effected  through  prepaid payment instruments. The draft rules have been published on MeitY website inviting comments from public at large and all stakeholders

********