Govt plans cyber security system

NEW DELHI: The government is in the process of setting up a system to secure the country’s financial sector from cyber attacks after agencies pointed to its vulnerability due to the increase in number of digital transactions over the past few months on account of the coronavirus disease (Covid-19) pandemic, and threats from hostile countries such as China and Pakistan, three officials aware of the plans said on condition of anonymity.

At present, the Indian Computer Emergency Response Team (CERT-IN) deals with all types of cyber security threats but officials in the administration have been discussing the need for a specialised agency, which could be called Cert-fin, the officials said, asking not to be identified.

“This is a work in progress. Several rounds of discussions have been held at the Financial Stability and Development Council (FSDC) on the matter of securing the financial sector from cyber attacks,” one of the officials said. FSDC is an apex body for coordination between the various regulators of the financial sector, and is chaired by the finance minister.

Its members include top bureaucrats and heads of financial sector regulators such as the Reserve Bank of India (RBI), the Securities and Exchange Board of India (Sebi), the Pension Fund Regulatory and Development Authority of India (PFRDA), the Insurance Regulatory and Development Authority (IRDA) and the Forward Markets Commission (FMC). “The government may set up a Computer Emergency Response Team for Financial Sector (CERT-FIN). This has been also discussed at FSDC, but a final decision is awaited as government wants to take a comprehensive view of cyber security” a second official said. CERT-FIN was first proposed on February 1, 2017 by then finance minister, the late Arun Jaitley.

Banking and ATM networks have been the target of cyber criminals for several years, with attackers often disrupting operations and attempting to steal sensitive data. In one of the biggest attacks of this kind, the data of 3.2 million debit cards used in India was stolen after a malware was injected in a back-end banking system in 2016.

A third official said cyber security, in general, tops the government’s agenda since it can disrupt social and political harmony and dislocate financial systems.

Based on inputs from agencies such CERT-IN and complaints received by agencies, the government recently decided to ban 59 mobile applications mostly of Chinese origin over what it said was concerns that they may be jeopardising user data.

The security of the financial system has been accorded high priority ; Prime Minister Narendra Modi raised the matter in his Independence Day speech on Saturday. CERT-IN functions under the ministry of electronics and information technology (Meity).

The finance ministry and Meity did not respond to queries on this matter.

The PM announced on Saturday that a draft of new cyber security policy would be unveiled soon. He said that the government was aware of cyber threats “to the social fabric” and the “economy”. According to the proposal under consideration, Cert-fin will draw expertise from various financial sector agencies such as the ministry of corporate affairs (MCA), the Employees Provident Fund Organization (EPFO), the Serious Fraud Investigation Office (SFIO), the Security Printing and Minting Corporation of India Limited (SPMCIL) and the Goods and Service Tax Network (GSTN).

RBI’S latest Financial Stability Report also flagged the issue of cyber threats to the financial sector. “Cyber security preparedness requires continuous and synchronous efforts from multiple stakeholders with varied levels of cyber security preparedness,” it said. Quoting a report by Vmware Carbon Black, Shree Parthasarathy, partner and national leader- Cyber Risk Services at Deloitte India said that hackers from various countries attempted over 40,000 cyber attacks on India’s Information Technology infrastructure and banking sector over five days in the last week of June.