Lok Sabha Question No. 3099 (UNSTARRED), answered on 2016-03-16
Subject: Security Issues in IT Sector
Ministry: COMMUNICATIONS AND INFORMATION TECHNOLOGY
Asked by: E. T. MOHAMMED BASHEER

## GOVERNMENT OF INDIA MINISTRY OF COMMUNICATIONS AND INFORMATION TECHNOLOGY (DEPARTMENT OF ELECTRONICS & INFORMATION TECHNOLOGY)

## LOK SABHA UNSTARRED QUESTION NO. 3099

TO BE ANSWERED ON: 16.03.2016

## SECURITY ISSUES IN IT SECTOR

## 3099 SHRI E.T. MOHAMMED BASHEER:

Will the Minister of Communications & Information Technology be pleased to state:-

- (a)  whether  the  Government  has  conducted  any  study  on  the  security  related  issues  in  the Communication and Information Technology sector and if so, the details thereof;
- (b)  whether  there  is  any  mechanism  to  check  the  operating  systems  developed  by  the  private players in the Communication and Information Technology sector?
- (c) if so, the details thereof;
- (a) whether the Government plans to encourage the open source software; and
- (b) if so, the steps taken in this regard so far?

## ANSWER

## MINISTER FOR COMMUNICATIONS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

(a):  The  area  of  Communications  and  Information  Technology  is  characterized  by  rapid developments and fast changing obsolescence. With every IT product introduced into the market, newer  vulnerabilities  are  discovered,  leaving  scope  for  malicious  actions.    In  tune  with  the dynamic nature of Information Technology and limited window time available for an effective response, continuous efforts are required to be made to detect and prevent cyber attacks by way of      continuous  threat  assessment  and  near  real-time  situational  awareness.    Such  timely information  enables  coordinated  actions  by  the  stakeholders  to  take  appropriate  proactive  and preventive actions.

Accordingly,  concerted  efforts  have  been  made  to  harvest  the  requisite  information  from multiple  sources  including  Communications  &  Information  Technology  sector.  These  include incidents reported to and tracked by  Indian Computer Emergency Response Team (CERT-In), technical  measures,  security  cooperation  arrangement  with  overseas  Computer  Emergency Response Teams (CERTs) and leading security product and service vendors as well as agencies within the government. In addition, the study reports published by various agencies across the world are also studied to understand the historical data with respect to global threat landscape and threat predictions. As such, Government has not felt the need to conduct a separate study on security related issues.

(b) and (c):  The National Cyber Security Policy has laid a clear emphasis on reducing supply chain risks by way of testing infrastructure and facilities for security evaluation of Information Technology  products,  building  trusted  relationship  with  vendors  and  service  providers  and enhancing  awareness  among  users  with  regard  to  threats  and  vulnerabilities  as  well  as consequences of security breaches.

In  this  direction,  Standardisation  Testing  and  Quality  Certification  (STQC)  Directorate  has established  Common  Criteria  (CC)  test  lab  for  security  evaluation  of  IT  products  including Operating Systems.  With the result, India is now recognized as a certification producing country as  part  of  the  Global  Common  Criteria  Recognition  Agreement  (CCRA).    Following  this, security evaluations done in India are acceptable among all the CCRA nations without the need for further testing.

- (d) and (e):  Government has taken many initiatives for encouraging the open source software, which are as follows:
- i. 'Policy on Adoption of Open Source Software for Government of India'   has been notified  in  March,  2015  as  part  of  Digital  India  Initiative  to  encourage  the  formal adoption and use of Open Source Software (OSS) in Government organizations.
- ii. The Department has implemented various projects like National Resource Centre for Free  &  Open  Source  Software  (NRCFOSS), Open Technology  Centre (OTC) and Establishment  of  Support  Centres  during  last few  years, which  have  led  to development  of  various  Open  Source  Software  and  capacity  building  in    area  of Open Source Software.
- iii. Indigenous GNU/Linux  based Operating System'Bharat Operating System Solutions (BOSS)'  with  Indian  languages  support has been brought out by NRCFOSS,  Centre  for  Development  of  Advanced  Computing  (CDAC),  Chennai. BOSS is available in Desktop, Server and educational version EduBOSS.   BOSS has  been  released  under  GPL  (General  Public  License)  and  is  available  for  free download at http://bosslinux.in. Support Centres have been set up for popularization and adoption of BOSS/ EduBOSS. CDAC has also developed Secured BOSS which is being deployed in strategic sector.
- iv. Communication  has  been  sent  to  all  State  Governments  and  UTs  for  possible deployment  of  BOSS  /  EduBOSS.  BOSS  has  been  successfully  deployed  in education, government and defense sectors in various States including Tamil Nadu, Kerala,  Maharashtra,  Chhattisgarh,  Haryana,  Orissa,  Tripura,  Pondicherry  and Andaman & Nicobar  Islands.    Current  installed  base  of  BOSS  and  its  variants  is around 32 lakhs.

<!-- image -->