Lok Sabha Question No. 2340 (UNSTARRED), answered on 2023-03-15
Subject: Prevention of Cyber Attack
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Mitesh Rameshbhai (Bakabhai) Patel, Shardaben Anilbhai Patel

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 2340

TO BE ANSWERED ON: 15.03.2023

## PREVENTION OF CYBER ATTACK

## 2340. SHRI MITESH RAMESHBHAI PATEL (BAKABHAI): SHRIMATI SHARDABEN ANILBHAI PATEL:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

(a)  whether  the  Government  has  recently  taken  a  few  measures  to  prevent  cyber  attacks, including creation of inter-Departmental panel to coordinate with various agencies and if so, the details thereof;

(b) the number of cyber security incidents reported during the last three years, year-wise;

(c)  whether  those  cases  were  tracked  by  Indian  Computer  Emergency  Response  Team (CERT-In) and necessary action taken, if so, the details thereof; and

(d)  whether  any  proactive  measures  have  been  taken  for  sharing  alerts  with  organisations across the sectors and if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a): Government is fully cognizant and aware of growing cyber security threats and attacks, and has taken the following measures to prevent and accelerated reporting of cyber attacks to ensure overall safe and trusted in for Digital Nagriks:

- (i) CERT-In,  in  April  2022,  issued  directions  under  section  70B  for  mandatory reporting of cyber incidents to CERT-In within six hours of such incidents being noticed or being brought to notice.
- (ii) CERT-In, in December 2022, issued a special advisory on best practices to enhance the resilience of health sector entities, and has requested the Ministry of Health and Family Welfare to disseminate the same to all authorised medical care entities and service providers in the country.
- (iii) Cyber security best practices have been issued in September 2022 for adherence by all government  employees,  including  outsourced, contractual  and  temporary employees who work for Central Government's Ministries and Departments.
- (iv) The  Ministry  of  Home  Affairs  has  created  the  National  Counter  Ransomware Taskforce, comprising of multiple stakeholders, to formulate strategies to effectively  tackle  ransomware  threats  and  put  in  place  proactive  and  responsive systems by stakeholders. The Taskforce comprises Working Groups on Cooperation and Diplomacy, Incident Response, Security Cluster, Awareness and Capacity Building.
- (v) CERT-In, on an ongoing basis, disseminates information and shares security tips on cyber  safety  and  security  through  its  official  social  media  handles  and  websites. CERT-In has organised  various events  and  activities  for  citizens  during  the  Safe Internet  Day  on  8.2.2022  and  the  Cyber  Security  Awareness  Month  in  October 2022, by posting security tips and videos on social media platforms and websites.

(C-DAC),  has  conducted  an  online  awareness  campaign  for  citizens,  covering topics such as general online safety, social media risks and safety, mobile related frauds and safety, secure digital payment practices, etc., through videos and quizzes on the MyGov platform.

- (vii) CERT-In, on an ongoing basis, issues alerts and advisories regarding latest cyber threats/vulnerabilities  and  countermeasures  to  protect  computers  and  networks. Security  tips  are  published  for  users  to  secure  their  desktops  and  mobile  phones and to prevent phishing attacks.
- (viii) CERT-In regularly conducts training programmes for network and system administrators and CISOs  of government and critical sector organisations, regarding securing the information technology infrastructure and mitigating cyberattacks.  A  total  of  42  training  programmes  were  conducted,  covering  11,486 participants, during the years 2021 and 2022.
- (ix) Cyber  security  mock  drills  are  being  conducted  to  enable  assessment  of  cyber security  posture  and  preparedness  of  organisations  in  the  government  and  the critical  sectors.  74  such  drills  have  so  far  been  conducted  by  CERT-In,  in  which 990 organisations from various States and sectors participated.

(b) and (c): As per the information reported to and tracked by CERT-In, a total of 11,58,208, 14,02,809 and 13,91,457 cyber security incidents were observed during the years 2020, 2021 and 2022 respectively. CERT-In receives inputs from its situational awareness systems and threat  intelligence  sources  about  malware  infections  and  vulnerabilities  in  networks  of entities across sectors and issues alerts to the organisations and sectoral Computer Security Incident Response Teams (CSIRTs) concerned for remedial measures.

(d):    The  following  measures  have  been  taken  for  sharing  alerts  with  organisations  across sectors:

- (i) CERT-In  has  set  up  the  National  Cyber  Coordination  Centre  to  generate situational awareness regarding existing and potential cyber security threats. It operates an automated cyber-threat exchange platform for proactively collecting, analysing  and  sharing  tailored  alerts  with  organisations  across  sectors  for proactive threat mitigation actions by them.
- (ii) CERT-In operates the Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) to detect malicious programs and offer free tools to remove the same,  and  to  provide  cybersecurity  tips  and  best  practices  for  citizens  and organisations.

*******