Lok Sabha Question No. 1021 (UNSTARRED), answered on 2023-02-08
Subject: National Cyber Security Policy
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: S. Venkatesan

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 1021

TO BE ANSWERED ON: 08.02.2023

## NATIONAL CYBER SECURITY POLICY

## 1021.   SHRI S. VENKATESAN:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a)   Whether the Government has introduced a new National Cyber Security Policy in light of recent cyber attacks on Government Websites;
- (b)   if so, the details thereof along with the proposed timelines for its implementation and if not, the reasons therefor;
- (c)   whether  the Government has taken any steps to mitigate citizens' vulnerability to cyber attacks;
- (d)   if so, the details thereof and if not, the reasons therefor;
- (e)   whether Government intends to coordinate with other countries to develop a global legal framework on cyber terrorism and if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a) and (b):The Government is committed to ensure that the Internet in India is Open, Safe & Trusted and Accountable for all users. The National Security Council Secretariat (NSCS) has formulated  a  draft  National  Cyber  Security  Strategy  2021,  which  holistically  looks  at addressing the issues of security of national cyberspace.

(c) and (d):With the expansion of the Internet and more and more Indians coming online, the possibility  that  Digital  Nagrik  or  citizens  being  exposed  to  user  harms  and  criminality  has also increased.  Government is fully cognizant and aware of various cyber security threats and has taken following measures to mitigate citizens vulnerability to cyber-attacks:

- (i) On  observing  a  incident,  CERT-In  notifies  the  affected  organisations  along  with remedial  actions  to  be  taken,  and  coordinates  incident  response  measures  with affected organisations, service providers, respective sector regulators and law enforcement agencies.
- (ii) CERT-In  operates  the  National  Cyber  Coordination  Centre  to  generate  situational awareness regarding existing and potential cyber security threats.
- (iii) CERT-In  operates  an  automated  cyber-threat  exchange  platform  for  proactively collecting, analysing and sharing tailored alerts with organisations across sectors for proactive threat mitigation actions by them.
- (iv) Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) is operated by CERT-In to detect malicious programs and free tools to remove the same, and to provide cyber security tips and best practices for citizens and organisations.
- (v) CERT-In  has  empanelled  150  security  auditing  organisations  to  support  and  audit implementation of Information Security Best Practices.
- (vi) A Cyber Crisis Management Plan for countering cyber-attacks and cyber-terrorism, formulated by CERT-In, for implementation by all Ministries and Departments of the Central Government, State Governments and their organisations and critical sectors.
- (vii) The  Indian  Cyber  Crime  Coordination  Centre  (I4C)  under  the  Ministry  of  Home Affairs has been designated as the nodal point in the fight against cybercrime. A tollfree number 1930 has been made operational for citizens to get assistance in lodging

online  complaints  in  their  own  language.  To  spread  awareness  on  cybercrime,  the Ministry  of  Home  Affairs  has  taken  several  steps  that  include  dissemination  of messages on cybercrime through the Twitter handle @cyberDost and radio campaigns.

- (viii) RBI has issued various instructions in respect of security and risk mitigation measures related  to  electronic/digital  transactions.  These  cover  securing  card  transactions, securing payments through Internet banking / electronic payments, ATM transactions, prepaid  payment  instruments  (PPIs),  limiting  customer  liability  on  unauthorized electronic  banking  transactions,  including  PPIs  issued  by  authorised  non-banks, safeguarding against email spoofing attacks, etc.
- (ix) CERT-In has been issuing alerts and advisories regarding latest cyber threats/vulnerabilities and countermeasures to protect computers and networks, on an ongoing basis.
- (x) Cyber  security  mock  drills  are  conducted  to  enable  assessment  of  cyber  security posture and preparedness of organisations in the government and critical sectors.
- (xi) Regular  training  programmes  for  network  and  system  administrators  and  the  Chief Information  Security  Officers  of  government  and  critical  sector  organisations  are conducted  by  CERT-In,  for  securing  the  information  technology  infrastructure  and mitigating cyber-attacks.
- (xii) The  Ministry  of  Electronics  and  Information  Technology  conducts  programmes  to generate information security awareness. Specific books, videos and online materials are  developed  for  children,  parents  and  general  users  about  information  security, which  are  disseminated  through  portals  such  as  www.infosecawareness.in  and www.csk.gov.in.

(e): Pursuant to United Nations General Assembly resolution 75/282, adopted in May 2021, an Ad Hoc Committee to elaborate a Comprehensive International Convention on Countering the  Use  of  Information  and  Communications  Technologies  for  Criminal  Purposes  was established with all member states of the United Nations as part of the Ad Hoc Committee. India has proposed criminalisation of "cyber terrorism" under the Convention.

******