CERT-In

CERT-In
Name	CERT-In
Native name	Indian Computer Emergency Response Team
Formation	2004
Headquarters	New Delhi
Jurisdiction	India
Parent agency	Ministry of Electronics and Information Technology

CERT-In The Indian Computer Emergency Response Team (CERT-In) is the national agency for cybersecurity incident response in India. Established to analyze, respond to, and mitigate cyber threats, CERT-In interacts with domestic agencies, private sector entities, and international counterparts such as US-CERT, NATO Cooperative Cyber Defence Centre of Excellence, and the Interpol cybercrime units. Its role spans incident coordination, advisories, capacity building, and policy input within frameworks influenced by instruments like the Information Technology Act, 2000 and multilateral dialogues including the BRICS cyber cooperation initiatives.

History

CERT-In was created in 2004 following recommendations linked to national cybersecurity priorities after notable incidents affecting Indian Space Research Organisation, State Bank of India, and other critical infrastructures. Early collaborations included exchanges with Carnegie Mellon University's CERT Coordination Center, Microsoft security teams, and the National Institute of Standards and Technology in efforts similar to earlier responses to the 2003 Slammer worm and patterns observed since the 2001 Code Red worm. Over time, CERT-In expanded during administrations that advanced digitization programs such as Digital India and initiatives tied to the Unique Identification Authority of India. Major capacity-building phases involved partnerships with Telecom Regulatory Authority of India stakeholders and training through institutions like the Indian Institute of Technology Delhi and the Indian School of Business.

Organization and Structure

CERT-In operates under the Ministry of Electronics and Information Technology and maintains regional coordination nodes interfacing with entities like National Critical Information Infrastructure Protection Centre and the Computer Emergency Response Team (CERT) for the financial sector. Its internal units mirror models found at US-CERT and ENISA with cells focused on incident handling, malware analysis, vulnerability assessment, and outreach. Leadership appointments have reported engagement with advisory councils including experts from Infosys, Tata Consultancy Services, Wipro, HCLTech, and academia represented by Indian Statistical Institute and IIT Bombay. Liaison roles extend to international partners such as Cybersecurity and Infrastructure Security Agency and bilateral cyber dialogues with Japan and Australia.

Functions and Responsibilities

CERT-In issues advisories, alerts, and vulnerability notes inspired by protocols used at FIRST and coordination approaches similar to US-CERT incident reporting. Responsibilities include incident response for attacks affecting systems of entities like Reserve Bank of India-regulated institutions, mitigation guidance for threats linked to malware families mirrored in advisories from Kaspersky Lab and Symantec, and dissemination of best practices aligned with standards from ISO/IEC 27001 and the National Institute of Standards and Technology. CERT-In also conducts drills, such as tabletop exercises modeled on scenarios used by NATO and regional exercises involving South Asian Association for Regional Cooperation partners. It maintains registries and reporting obligations influenced by provisions in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Major Incidents and Response

CERT-In has issued responses and advisories during high-profile incidents impacting entities such as Air India, Indian Railways, and major banking groups like State Bank of India and HDFC Bank. It coordinated responses to widespread ransomware strains reminiscent of WannaCry and NotPetya incidents and has addressed compromises related to supply chain events analogous to the SolarWinds intrusion. CERT-In has engaged in cross-border malware takedowns with partners including Europol and FBI and provided technical advisories during disruptions attributed to actors linked to nation-state tooling observed in investigations by Mandiant and FireEye.

Policies, Standards, and Guidelines

CERT-In issues mandates and technical guidelines intended to align with frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, and national statutes like the Information Technology Act, 2000. It publishes advisories on patch management, incident reporting timelines, and encryption practices that intersect with regulatory instruments overseen by Reserve Bank of India and sectoral regulators including Telecom Regulatory Authority of India. Guidance has also referenced vendor disclosures from Cisco, Juniper Networks, and cloud operators such as Amazon Web Services and Google Cloud Platform when addressing vulnerabilities and mitigation measures.

Criticism and Controversies

CERT-In has faced scrutiny over directives perceived to affect privacy and operational burdens on firms, drawing commentary from civil society groups like Internet Freedom Foundation and technology companies including WhatsApp and Twitter. Debates have centered on mandatory data retention, timelines for incident disclosure that intersect with compliance regimes enforced by the Reserve Bank of India, and tensions with principles advocated by Electronic Frontier Foundation and privacy scholars at National Law School of India University. Judicial and parliamentary questions have referenced incidents where coordination between CERT-In and law enforcement bodies such as Central Bureau of Investigation and National Investigation Agency raised concerns about scope and oversight.

Category:Computer security organizations Category:Indian government agencies