Having identified critical sectors that could be vulnerable to cyber attacks, the Ministry of Communications & Information Technology has issued security guidelines to all ministries and government departments asking them to set up 24x7 cyber control rooms, implement information security best practices, deploy information security experts, formulate their own information security policies and ensure background checks of all personnel employed in IT divisions. Henceforth, the National Crisis Management Committee (NCMC) headed by the Cabinet Secretary will also be monitoring all national-level cyber crises.

The Armed Forces, defence production and research, power, oil and gas, stock exchanges, depositories, banks and financial institutions, space research installations, Internet services, telecom and data centers, broadcasting services, railways, civil aviation, shipping and surface transport, public utilities and law enforcement agencies have been identified as critical sectors, with both public and private installation marked as vulnerable.

The plan mandates that central administrative departments under each critical sector will set up 24-hour control rooms which will get activated immediately after a crisis situation is reported and also prepare detailed contingency plans. Each organisation has also been directed to screen and do background checks of all employees engaged in implementing and monitoring cyber security and crisis management plans including contractors and third party users. This screening entails that each employee be checked for satisfactory character references, accuracy of CVs, claimed academic and professional qualifications, credit checks, criminal record checks and independent identity checks in the form of passport or similar documents.

Organisations have also been directed to implement periodic IT security risk assessments, back up of files critical to mission accomplishment, security awareness training of personnel and periodic testing and evaluation of technical security measures.

Type of Crisis: Large scale defacement and semantic attacks targets: High-profile national websites. e.g.: President’s, PM’s, Parliament

Crisis: Malicious Code attacks (virus/worms/Trojans/botnets) targets: Key national databases.

e.g.: tax information network, passports, reservations, hospital information systems

Crisis: Large-scale SPAM attacks

targets: ISP networks, large corporate networks

Crisis: Identity Theft Attacks (Spoofing/phishing,)

targets: High profile users in govt, users of banks, e-commerce, senior executives

Crisis: Denial of Service Attacks

targets:Public utility services, web-based key economic targets

Crisis: Domain Name Server attacks

targets:Country-level domain registry systems (.in registry)

Crisis: High-Energy Radio Frequency attacks

targets:Wireless, mobile, satellite communication networks