The Indian Computer Emergency Response Team ("CERT-In") has issued a high-severity Advisory titled "Essential Measures for Industry for Safeguarding Business Operations against Cyber Security Threats" for industries to safeguard business operations and sensitive data. The Advisory underscores the increasing frequency and sophistication of cyberattacks including ransomware, DDoS incidents, website defacements, data breaches and malware infections that threaten the confidentiality, integrity and availability of business systems and services.
Key Highlights:
Accordingly, the industries need to implement the following safeguarding measures:
- Strengthen Authentication & Access
Control
- Enforce strong password policies with long, complex, and unique credentials for each service.
- Implement Multi-Factor Authentication (MFA) to secure accounts.
- Apply role-based access control (RBAC) to restrict employee permissions based on their responsibilities.
- Web Server & Infrastructure
Protection
- Scan all web servers and infrastructure for open ports and known vulnerabilities.
- Remove or isolate unmaintained old or unused web applications and systems,
- Deploy web application firewall.
- Implement robust Data Protection Plan
- Maintain regular offline backups to mitigate ransomware risks.
- Regularly test backup restoration procedures to ensure data recovery remains reliable.
- Develop an incident response plan
- Establish a structured response plan to effectively address breaches and cyber incidents
- Continuously analyse log files and network activity for failed login attempts, configuration behaviour.
- Conduct employee awareness and training
- Conduct regular cybersecurity training to educate employees about phishing, social engineering, and best practices. Simulate phishing attack exercises to improve user awareness.
- Organise routine cyber drills to simulate attacks and response measures.
- Supply chain monitoring
- Establish continuous monitoring of vendor and supplier activities.
- Zero trust architecture
- Implement a zero trust security model where no entity, whether inside or outside the organisation, is trusted by default.
- Enforce strict identity verification and authorisation for every network activity for failed login attempts, configuration changes, new device connections or other suspicious behaviour.
All suspicious cyber activity must be reported to CERT-In at incident@cert-in.org.in. Logs should be preserved in accordance with CERT-In's 28th April, 2022 Directive and submitted with the incident report.
Source: CERT-IN
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
