Question : Securing Communication Infrastructure

(a) whether the Government is planning a more integrated and strategic approach to securing the communication networks of the country;

(b) if so, the details thereof;

(c) whether securing such networks is complicated by a number of factors like much of the hardware and software that make up the communications ecosystem is sourced externally and much communication infrastructure are in the hands of private companies who see measures such as security auditing and other regulations and frameworks as adding to their costs; and

(d) if so, the details thereof and the opinion of the Government in this regard?

THE MINISTER OF STATE (IC) OF THE MINISTRY OF COMMUNICATIONS &
MINISTER OF STATE IN THE MINISTRY OF RAILWAYS
(SHRI MANOJ SINHA)

(a) & (b) To address the security concerns of telecom networks, Department of Telecommunications(DoT) has consolidated the security requirements in May/June 2011 and brought in security related amendment to the license conditions for the provision of Telecom services. These conditions were made part of the subsequent Unified Service License. The amendment in license agreement inter alia mandates for the telecom service provider to have organisational policy on security and security management of their networks. The security policy mandatorily contains network forensics, network hardening, network penetration test, risk assessment, actions to fix problems and to prevent such problems from recurring. The license conditions allow induction of only those network elements into the telecom network, which have been tested as per relevant contemporary Indian or International security standards, mandate keeping record of all operation and maintenance command logs and record of supply chain of the products. The licensee needs to create facilities for monitoring all intrusions, attacks and frauds and report the same to Computer Emergency Response Team-India (CERT-In) and DoT. Further, the license conditions provide for the security audit of telecom network from security angle once in year.


(c) & d) Yes, much of the telecom network equipment is sourced externally and the telecom service is provided by licensed operators many of whom are private companies. Though security measures add to the costs, but security of the networks in addition to being of national security concern is also in the commercial interest of the companies. DoT has taken steps, through security related amendment in May/June 2011 in license agreement, which provides among other measures that the licensee shall audit their network or get the network audited from security point of view once a year from a network auditing and certification agency. Further to ensure compliance the Department of Telecom conducts security audits of telecom networks for and Telecom Service Providers are actively participating in these security audits.