Government of Tripura Industries & Commerce Department- (Information Technology) No.F.17(11)/DIT/IT/2017/M oq - 1614- Dated, the, 2“ May, 2018 NOTIFICATION Subject: Introduction of Cyber Security Policy for the State of Tripura.
The Governor of Tripura is pleased to approve Cyber Security Policy for the State of Tripura as per the details appended with this notification.
2. Title of the Policy: Tripura Cyber Security Policy, 2018.
3. Objective of the Policy: To create a secure cyber ecosystem in the State, generate adequate trust & confidence in IT systems and transactions in cyberspace and thereby enhance adoption of IT in all sectors of the economy.
4. Duration of the Policy: The Tripura Cyber Security Policy, 2018 shall be applicable in the State from the issue date of this notification, till further notification / order in this regard.
5. Cyberspace is a complex environment consisting of interactions between people, software and sen/ices, supported by worldwide distribution of Information and Communication Technology (ICT) devices and networks. Cyberspace is vulnerable to a wide variety of incidents, whether intentional or accidental, manmade or natural and the data exchanged in the cyberspace can be exploited for nefarious purposes. The Cyber Security Policy serves as an umbrella framework for defining and guiding the actions related to security of cyberspace.
6. The policy guidelines of the Cyber Security Policy for the State of Tripura mainly focus on following areas:
(i) Cyber grievance redressal efforts.
(ii) Cyber forensics.
(iii) Computer Emergency Response Team.
(iv) Establishment of Cyber Security standard and practices.
(v) Establishment of role of Government at Cyber Space.
By order of the Governor, WLl: ll Z (M. Nagaraju) Principal Secretaiy Copy to:
1. Secretary to the Governor of Tripura for kind information of Hon'ble Governor.
Principal Secretary to Chief Minister for kind information of Hon'ble Chief Minister.
. PS to all Ministers for kind information of Hon'ble Ministers.
PPS to Chief Secretary, Tripura.
. All Principal Secretaries / Secretaries/ Special Secretaries, ............................................... ..
6. All Directors / HoD, Government of Tripura, ...................................................................... ..
Copy also to:
1. Manager, Tripura Government Press, Printing & Stationary Department for publication of the notification in next issue of Tripura Gazette and send 25 copies of the same to this office. ' Telephone : (0381)-2413474 / (0381)-241-8110 (Fax) / email : secy.icdept-tr@gov.in Page 1 of 6 Government of Tripura Department of Industries and Commerce Directorate of Information Technology Tripura Cyber Security Policy, 2018
1. This Policy may be called “Tripura Cyber Security Policy, 2018” and shall be applicable in the State of Tripura. It shall come into force from the date of its notification in the Official Gazette.
2. Definitions:
(i) Cyber Space - Cyber space is a complex environment consisting of interactions between people, software and services, supported by worldwide distribution of information and communication technology (ICT) devices and networks.
(ii) Cyber Security - The activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation.
(iii) Critical Information Infrastructure - Critical Information Infrastructure (CII) is defined as a computer resource, the incapacitation or destruction of which, shall have debilitating impact on National security, Economy, Public Health or Safety.
“S‘ wIm ‘____',_Uas_"‘V‘L h‘y_3Uml'_MmMA ___“\‘vvw_V_M“__h'‘Wu“ m3§L_§_W@“awNW?"Agrag 1>\' Page 2 of 6
(iv) Cyber Crime – Cyber crime is defined as a crime in which a computer system is the object of the crime (hacking, phishing, spamming) or is used as a tool to commit an offense (child pornography, hate crimes). Cyber crimes range from basic crimes such as online harassment to calculated attacks such as fraud and financial crimes. A few broad categories of attacks are as follows:
• Fraud and Financial Crimes: Computer fraud is any dishonest misrepresentation of fact intended to let another to do or refrain from doing something which causes loss.
• Cyber terrorism: Any act of terrorism committed through the use of cyber space or computer resources can be categorized as cyber terrorism.
• Cyber extortion: Cyber extortion occurs when a website, e-mail server, or computer system is subjected to or threatened with repeated denial of service or other attacks by malicious hackers, who demand money in return for stopping the attacks and for offering protection.
• Obscene or offensive content: Delivering obscene and offensive content to users through the use of cyberspace or computer resources.
• Cyber harassment: Any form of harassment, such as directing obscenities and derogatory comments at specific individuals, committed through the use of computer resources can be categorized as cyber harassment.
Page 3 of 6
3. Introduction Information Technology (IT) is one of the critical sectors that rides on and resides in cyberspace. It has emerged as one of the most significant growth catalysts for the Indian economy. In addition to fuelling India’s economy, this sector is also positively influencing the lives of its people through direct and indirect contribution to the various socio-economic parameters such as employment, standard of living and diversity among others. The sector has played a significant role in transforming India’s image to that of a global player in providing world-class technology solutions and IT business services. The government of India has been a key driver for increased adoption of IT-based products and IT enabled services in Public services (Government to citizen services, citizen identification, public distribution systems), Healthcare (telemedicine, remote consultation, mobile clinics), Education (e-Learning, virtual classrooms, etc) and Financial services (mobile banking / payment gateways), etc. Such initiatives have enabled increased IT adoption in the country through sectoral reforms and National programmes which have led to creation of large scale IT infrastructure with corporate/private participation.
Ensuring a safe cyberspace is of paramount importance to Government of Tripura, which has implemented various Information and Communication Technology (ICT) based projects in Health, Education, Food & Civil Supplies, Transport, Revenue Departments for citizen centric service delivery. Also, State Wide Area Network has been extended up to Block level and ICT based services are offered by Common Service Centres spread across various parts of the State. Information and Communication Technology is one of the critical sectors that rides on and resides in the cyberspace. Within the next 20 years, these ICT sectors will advance in incomprehensible ways, and it becomes the responsibility of every State to be at the crest of this change. It is extremely important to send out a strong and clear message in this direction. Therefore, a robust cyber security policy is imperative to ensure that citizens are protected in the cyber space, the State is well equipped to meet the cyber security challenges, and a conducive atmosphere is created for investors.
4. Policy Objectives
4.1 To create a secure cyber ecosystem in the State, generate adequate trust & confidence in IT systems and transactions in cyberspace and thereby enhance adoption of IT in all sectors of the economy.
4.2 To create an assurance framework for design of security policies and for promotion and enabling actions for compliance to global security standards and best practices by way of conformity assessment (product, process, technology & people).
Page 4 of 6
4.3 To strengthen the Regulatory framework for ensuring a Secure Cyberspace ecosystem.
4.4 To create a workforce of professionals skilled in cyber security in the next 5 years through capacity building, skill development and training.
4.5 To provide fiscal benefits to businesses for adoption of standard security practices and processes.
4.6 To enable protection of information while in process, handling, storage & transit so as to safeguard privacy of citizen's data and for reducing economic losses due to cyber crime or data theft.
4.7 To enable effective prevention, investigation and prosecution of cyber crime and enhancement of law enforcement capabilities through appropriate legislative intervention.
4.8 To engage information security professionals / organisations to assist e-Governance initiatives and ensure conformance to security best practices.
5. Cyber Security Policy Guidelines The State of Tripura is committed to creating and sustaining a safe and resilient cyberspace to promote well-being of its citizens, protection and sustainability of its infrastructure, and creation of wealth through investment and growth in this sector.
The following points summarizes the vision to achieve a safe and resilient cyber space for Citizens at Tripura:
(i) Cyber Grievance Redressal Efforts:
The State of Tripura will plan for a specialized Cyber Crime Cell for investigating into complaints pertaining to offences under the Information Technology Act. The Cyber Crime cell is headed by an officer of the level of Deputy Superintendent of Police, supported by a team of 4 Inspectors. The government shall further strengthen this unit to simplify reporting, tackling and tracking progress on cybercrimes. This unit will be empowered to address issues pertaining financial cyber crimes, child pornography, woman harassment etc.
(ii) Cyber Forensics:
The State will establish a digital forensics lab to analyse and investigate cybercrime to assist in the recovery and preservation of digital evidence. A data recovery lab will be established to recover corrupted and deleted data that are not available for intended use as a result of cybercrime. In line with capacity building efforts, there will be a provision for developing data experts who can handle forensic and related requirements. A digital Page 5 of 6 evidence preservation facility will also be created to have a secure environment for retention of digital evidence.
(iii) Emergency Responses:
The government shall set up Computer Emergency Response Team-Tripura (CERT- TR), a nodal agency for the state to coordinate with institutions, organizations and companies. CERT-TR will contribute towards the State's efforts for a safer, stronger Internet for all citizens by responding to major incidents, analysing threats, and exchanging critical cyber security information with trusted partners. The primary mandate of CERT-TR would be to:
• Provide cyber security related actionable information to the Government, critical infrastructure agencies, private industries and general public through advisories.
• Provide cyber security protection through intrusion detection and prevention capabilities.
• Develop state's crisis management plan and implement the same in coordination with CERT-In, offering the following services to critical infrastructure clients.
• Assist the State in collaborative efforts to improve the cyber security posture of the State.
• Initiate proactive measures to increase awareness and understanding of information security and computer security issues.
• Act as a nodal agency to conduct security audits or assessments of State government and constituent IT infrastructure in the state, evolving security policy for the state. A dedicated officer at the nodal agency shall coordinate with stakeholders and drive the State's efforts. Further, a round the clock support facility will be established for emergency response and crisis management. Through a network of dedicated officers in every department, the support team shall continuously monitor the cyber situation in the State.
(iv) Establishment of Cyber Security Standard and practices:
The Government of Tripura will adopt the following Cyber Security Standards and Practices:
• Development and implementation of Information Security Standards.
• Develop Information Security Guidelines and Best Practices.
• Joint development of a State Cyber Crisis Management Plan to protect State information, assets and critical infrastructure.
Page 6 of 6 • Promotion of Open Standards: To ensure high levels of transparency and collaboration at various levels, the government shall promote use of open standards and data exchange.
• Procurement of Safe ICT Products by the State: Weak ICT products will increase vulnerability of our information systems to external attacks and data leaks.
The Government shall contact industry experts to frame guidelines for procurement of trustworthy products by the State.
(v) Establishment of the Role of Government at Cyber Space:
Being the primary stakeholder, the Government of Tripura shall spearhead the efforts to engage with citizens and businesses to help them fulfil their roles. The Government shall:
• Protect critical information infrastructure • Develop safe and secure e-Governance products, applications and services • Protect sensitive citizen data • Strengthen laws to effectively handle cyber crimes • Facilitate the development of secure ICT products • Advise public on safe practices to improve awareness • Collaborate with the private sector to grow the cadre of cyber security professionals • To promote and launch a comprehensive State awareness program on security of cyberspace.
• Constitute State Level Cyber Security Steering Committee for driving and monitoring the developments in Cyber Security.
• Annually audit Cyber Security to ensure that all computer systems and resources used by Govt. Departments follow basic standards of Cyber Security.
(vi) Prioritized approach for implementation:
To adopt a prioritized approach to implement the policy so as to address the most critical areas in the first instance.
(vii) Operationalisation of the Policy:
This policy shall be operationalised by way of detailed guidelines and plans of action at various levels such as state, department, as may be appropriate, to address the challenging requirements of security of the cyberspace.