Lok Sabha Question No. 6045 (UNSTARRED), answered on 2018-04-04
Subject: Securing Communication Infrastructure
Ministry: COMMUNICATIONS
Asked by: C. MAHENDRAN, J. JAYASINGH THIYAGARAJ NATTERJEE

## GOVERNMENT OF INDIA MINISTRY OF COMMUNICATIONS DEPARTMENT OF TELECOMMUNICATIONS

## LOK  SABHA UNSTARRED QUESTION NO.6045 TO BE ANSWERED ON 4 TH  APRIL, 2018

## SECURING COMMUNICATION INFRASTRUCTURE

6045.  SHRI C. MAHENDRAN:

SHRI J.J.T. NATTERJEE:

Will the Minister of COMMUNICATIONS be pleased to state:

- (a) whether the Government is planning a more integrated and strategic approach to securing the communication networks of the country;
- (b) if so, the details thereof;
- (c) whether securing such networks is complicated by a number of factors like much of the hardware and software that make up the communications ecosystem is sourced externally and much  communication  infrastructure are in the hands of private companies  who  see  measures  such  as  security  auditing  and  other  regulations  and frameworks as adding to their costs; and
- (d) if so, the details thereof and the opinion of the Government in this regard?

## ANSWER

## THE MINISTER OF STATE (IC) OF THE MINISTRY OF COMMUNICATIONS & MINISTER OF STATE IN THE MINISTRY OF RAILWAYS (SHRI MANOJ SINHA)

(a)  &  (b)    To  address  the  security  concerns  of  telecom  networks,  Department  of Telecommunications(DoT)  has  consolidated  the  security  requirements  in  May/June 2011  and  brought  in  security  related  amendment  to  the  license  conditions  for  the provision  of  Telecom  services.  These  conditions  were  made  part  of  the  subsequent Unified Service License. The amendment in license agreement inter alia mandates for the  telecom  service  provider  to  have  organisational  policy  on  security  and  security management  of  their  networks.  The  security  policy  mandatorily  contains  network forensics, network hardening, network penetration test, risk assessment, actions to fix problems and to prevent such problems from  recurring.  The license conditions allow induction of  only  those  network  elements  into  the  telecom  network,  which  have  been tested as per relevant contemporary Indian or International security standards, mandate keeping record of all operation and maintenance command logs and record of supply chain  of  the  products.  The  licensee  needs  to  create  facilities  for  monitoring  all intrusions, attacks and frauds and report the same to Computer Emergency Response Team-India (CERT-In) and DoT. Further, the license conditions provide for the security audit of telecom network from security angle once in year.

(c) & d) Yes,  much  of  the  telecom  network  equipment  is  sourced  externally  and the  telecom  service  is  provided  by  licensed  operators  many  of  whom  are  private companies. Though security measures add to the costs, but security of the networks in addition to being of national security concern is also in the commercial interest of the companies.  DoT  has  taken  steps,  through  security  related  amendment  in  May/June 2011  in  license  agreement,  which  provides  among  other  measures  that  the  licensee shall audit their network or get the network audited from security point of view once a year from a network auditing and certification agency. Further to ensure compliance the Department of Telecom conducts security audits of telecom networks for and Telecom Service Providers are actively participati ng in these security audits.

***************