Q. What is CERT-IN?
A.
- Computer Emergency Response Team - India is an organisation of the Ministry of Electronics and Information Technology with the objective of securing Indian cyberspace.
- It is the nodal agency which deals with cybersecurity threats like hacking and phishing.
- It collects, analyses and disseminates information on cyber incidents, and also issues alert on cybersecurity incidents.
- CERT-IN provides Incident Prevention and Response Services as well as Security Quality Management Services.
Q. What are the Mandates of the CERT-In?
A.
It mandates all service providers, intermediaries, data centres, corporates and government organisations to mandatorily enable logs of all their ICT (Information and Communication Technology) systems.
The service providers has to maintain the logs securely for a rolling period of 180 days, and the same shall be maintained within the Indian jurisdiction.
The log should be provided to CERT-In along with reporting of any incident or when directed by the computer emergency response team.
- Connect and Synchronize all ICT systems:
-
- To ensure the chain of events is accurately reflected in the time frame, service
- providers have been asked to connect and synchronize all their ICT systems clocks
- to the Network Time Protocol (NTP) Server of the National Informatics Centre (NIC)
- or National Physical Laboratory (NPL).
- NTP is a protocol used for reliably transmitting and receiving accurate time source
- over TCP/IP-based networks.
- It is used for synchronizing the internal clock of computers to a common time source.
Requires Maintaining Records:
- It also require virtual asset, exchange, and custodian wallet providers to maintain records on KYC and financial transactions for a period of five years.
- Companies providing cloud, virtual private network (VPN) will also have to register validated names, emails, and IP addresses of subscribers.
Q. What is the Need of Such Initiative?
A.
- Address the issue Hindrance:
- It will address the issue of hindrance in the analysis of breach incidents in handling cyber incidents.
- Streamline the Date Records:
- There have been cases in the past where cases of non-storage or availability of data and proper records with intermediaries and service providers have been identified.
- These guidelines will streamline the date records to be maintained and proper reporting of security incidents to CERT-In.
- Address the Users Right to Know:
- End-user has the right to know if their data is loaded so that an individual can protect himself from fraud transactions, fake loans, ID misuse etc.
- Government should also force companies to inform their users within 24 hours of the incident.
- Many users are still unaware if their KYC (Know Your Customer) and financial data is safe or not.
Q. What are Government Initiatives for Cyber Security?
A.
- Cyber Surakshit Bharat Initiative
- Cyber Swachhta Kendra
- Online cybercrime reporting portal
- Indian Cyber Crime Coordination Centre (I4C)
- National Critical Information Infrastructure Protection Centre (NCIIPC)
- Information Technology Act, 2000
- National Cyber Security Strategy 2020
