FOLLOW-UP WITH CERT-IN: COOPERATIVE APPROACH TO

UNCLAS SECTION 01 OF 05 NEW DELHI 004255 SIPDIS SENSITIVE SIPDIS STATE FOR PM/PPA E.O. 12958: N/A TAGS: PREL PGOV KCIP TINT PINR IN SUBJECT: FOLLOW-UP WITH CERT-IN: COOPERATIVE APPROACH TO ADVOCATING CYBERSECURITY REF: A. NEW DELHI 1670 ¶B. 04 NEW DELHI 6953 ¶1. (SBU) Summary: PolOff on June 6 revisited India's Computer Emergency Response Team (CERT-In) for the third time, with SciCouns and EconOff accompanying. CERT-In is pursuing a multi-platform outreach program to cybersecurity experts in the public, private, and academic sectors. Although last year phishing attacks were the most prevalent incident CERT-In handled, web defacement has been a top-level concern in the Indian cyber-community for several years. CERT-In Director Dr. Gulshan Rai reiterated throughout the tour his focus on cooperative or "soft" cybersecurity with purely domestic Internet entities in commerce, government, and academia; however, regarding Indian Internet players whose headquarters are in the US (and who he believes are insufficiently accommodating to his requests for subscriber data),he advocates a rules-based or "hard" approach. CERT-In's training classes are typically full, but they have no plans to offer distance learning to expand their educational reach. Rai also described his workforce, and complained about factors common to the IT industry that force him to accommodate nearly 100% annual staff turnover. End Summary. CERT-In Briefing -------------- ¶2. (U) CERT-In Operations Director Anil Sagar narrated a ten-minute PowerPoint briefing of CERT-In operations. Highlights included: -- CERT-In focuses on protecting critical data infrastructure for the defense, financial, energy, transportation, and telecommunications sectors. -- CERT-In is working toward ISO/IEC 27001 information security management standards certification. It has drafted its informtion security management manual and expects certification by December 2006. -- CERT-In currently has no direct enforcement powers; if it chooses to follow up on computer security infractions committed by GOI entities, it must report up to the (Communications and Information Technology or C&IT) Ministry level. As regards the private sector, CERT-In is only empowered to issue voluntary cybersecurity guidelines, which Sagar described as "up to international standards." Outreach -------------- ¶3. (U) CERT-In connects with digital India through multiple vectors: -- Their web site www.cert-in.org.in generates an average of 460 hits/day from GOI, state governments, industry, and academia (including foreign institutions). Their web traffic is approximately 75% domestic and 25% from non-Indian sources. -- In the past 18 months, they recorded 60,000 downloads of security guidelines and white papers from the web site. A large (but not quantified) number of downloads are executed from academic institutions in India, the US, and the UK. -- Vulnerability Notes are e-mailed to a list of 550 data security professionals, including 125 CIOs. -- Their e-mail contact list (for training and special events) includes 800 Indian CIOs in critical sectors (defense, finance, energy, transportation, telecomms) and NEW DELHI 00004255 002 OF 005 sub-sectors (banking, insurance, fertilizer, oil, power, etc.). -- CERT-In is available for contact essentially 24/7 by phone, fax, and e-mail, though their graveyard shift is limited to one engineer at present. Breakdown of Incidents Handled by CERT-In -------------- ¶4. (U) Sagar continued that of the total number of incidents CERT-In engineers worked on in 2005, 40% involved phishing attacks. Of the remainder: -- 38% were virus/malicious code attacks -- 16% were network scanning/probing incidents -- 2% involved system misuse -- 2% were e-mail spoofing Web Defacements a Concern -------------- ¶5. (U) Sagar said that India's on-line community suffers from a significant amount of web defacements -- hacking to change the appearance of a corporate or governmend web site without also attacking back-end functions such as databases, e-commerce, etc. CERT-In has published two white papers on web defacement, both available through their web site. Highlights, including an analysis of data up to December 2004 as well as a simple graph of 2005 incidents, are: -- Total annual web defacements of Indian sites logged by CERT-In since 2003 are: 1687 (2003),1529 (2004),4705 (2005),899 (2006, first six months) -- Almost half of the web defacement complaints CERT-In received in 2004 were from .co.in domains; .gov.in domains accounted for one-quarter of defacements, followed by academia (.ac.in) with one-eighth. India's remaining seven domains, including .mil.in, shared equally in the remainder of defacements. -- Telecomms networks and Internet infrastructure were the most targeted sites in 2004. The prior white paper noted a prevalence of defacements in past years against sites related to the railways and to the Gujarat state government. -- The 2005 figures were 60% against .com domains and 10% against .org domains. Advocating a Soft Approach with Indian Firms ... -------------- --- ¶6. (SBU) Asked by EmbOffs several times about how and under what authority CERT-In can enforce cybersecurity on the private sector, Rai continually relied on a mantra of "we seek voluntary compliance." Rather then confront firms and make enemies, it is better to educate them and convince them it is in their (financial) interest to follow good cybersecurity practices, he maintained. Rai said he finds that that in many cases the private sector (which understands that breaches of data security translate into costly fixes and potentially lost clients) is generally more appreciative, more forward-leaning, and more accommodating than GOI offices. ¶7. (SBU) Rai also shared that CERT-In receives tip-offs from industry insiders, whistle-blowers within firms and departments, and through the media, of companies and agencies NEW DELHI 00004255 003 OF 005 not adhering to cybersecurity best practices or suffering attacks. He reported that 60% of the entities CERT-In follows up with comply with their requests for information; their second-round requests that include a warning of possible legal infractions that might require a CBI investigation generate additional compliance, though he hastened to add that CERT-In had never referred a case of non-compliance or an attack to Indian law enforcement. Rai told us he has lobbied for amendments to the IT Act (2000) that would grant CERT-In the authority to directly issue cybersecurity mandates. Frustrated with Procedural Inefficiency -------------- ¶8. (SBU) Rai's dander rose as he described his frustration over not being able to obtain Microsoft Hotmail and Yahoo personal subscriber data for e-mail accounts CERT-In has identified as having attacked CERT-In's own servers. He said that they have logged approximately 25 attacks against the facility this year, of which 10 were identified as US-origin, five Indian-origin, and the remainder spread among several other countries. Rai never singled out Pakistan as the origin of any attacks on CERT-In or other Indian servers, but he did note that some cyber-attackers located in one country hijack servers in another to launch attacks. ¶9. (SBU) Rai held to his position that the two companies should share the subscriber information directly with CERT-In despite EmbOffs' suggestion that the request -- if related to criminal activity -- could be pursued through law enforcement channels. "I keep asking the Indian headquarters for information, and they throw up their hands and say their US bosses won't let them help," he expounded, nearly choleric. When EconOff offered that US privacy rights were an important factor, Rai snapped, "They are criminals, why protect their privacy?" Training: SRO, No Plans for Distance Ed -------------- ¶10. (SBU) CERT-In continues to run 2-day seminars and workshops, though no more than one training event per month. Some events, such as a CIO-level seminar that included an ICAAN executive as a speaker, overcrowd the facility's 24-seat seminar room -- this event yielded a crowd of "around 40, standing room only." Rai said they sometimes replicate seminars and workshops at IIT/Bangalore, but CERT-In has no plans to introduce distance learning; the conference room boasts videoconferencing equipment, but not the classroom, which is in the next room over. (COMMENT: Although hands-on workshops, which use CERT-In's networked and pre-loaded computer workstations, may be impractical for distance learning, EmbOffs were struck that CERT-In did not offer seats to over-subscribed seminars through teleconferencing. End Comment.) Like IT Industry, Suffering High Turnover -------------- ¶11. (SBU) Rai and Sagar bemoaned CERT-In's high turnover rate of approximately 100% per year; Rai explained that employees' experience and connections are highly sought after by Delhi's growing private-sector IT industry, and that the director of Japan's CERT tried to hire away one of his employees. Rai also took a swipe at "changing cultural values" (read: Indian IT professionals act like their American counterparts). Young employees do not feel emotionally attached to their first job and can be easily snapped up by a better offer -- there is no social benefit to staying with one organization for years at a time, he NEW DELHI 00004255 004 OF 005 complained. Rai also noted that the security of the government sector is not as attractive as better salaries in the private sector, especially for IT professionals possessing portable skills. He added that Indian youth today willingly trade stability for mobility. Platform-Driven Work Teams -------------- ¶12. (SBU) CERT-In staff are organized into work groups based on the platforms the engineers specialize in (Windows, Linux, Oracle, etc.). Members of a work group may work any number of the following tasks within their platform expertise: -- Real-time or e-mail customer assistance -- Resource building, including internal training and accumulating security tools, patches, and network technology -- Event monitoring/incident handling and drafting/posting security alerts in response to newly discovered malware -- Collecting data -- Drafting/conducting training modules for CERT-In workshops -- Trend analysis -- Drafting white papers -- Reverse-engineering malicious code -- Conveying information to regional/international CERTs (AP Cert, CERT-CC) or coordinating/setting up Indian sector-specific CERTs 24 Hours a Day -------------- ¶13. (SBU) CERT-In currently employs 22 staff members divided into two main shifts, with a single person staffing the graveyard shift. Half the workforce are hired "from the market," while half are on deputation from other GOI departments. All have engineering or computer science degrees, including some MS and PhD holders. Rai told us the C&IT Ministry approved an increase up to 38 staff members, which would allow them to stand up a complete third shift. CERT-In augments its limited R&D manpower by enlisting help from IIT and IIS computer science departments. CERT-In's partnerships with Microsoft, Cisco, Computer Associates, and Red Hat are force multipliers that allow CERT-In to outsource some projects, and Rai is also pursuing tie-ups with Symantec, Sun, HP, Juniper, Intel, AMD, McAfee, TrendMicro and IBM. (COMMENT: Rai easily separated his positive view of Microsoft regarding its Security Cooperation Program from his frustration with Microsoft noted in Para 7. End Comment.) Security: Less Than Meets the Eye? -------------- ¶14. (SBU) Paying closer attention to CERT-In's security apparatus than in prior visits, we noticed several apparent lapses/inconsistencies: -- We noticed biometric fingerprint-readers at six-eight doorways; in approximately half the cases, the doors had been propped open. Only when Sagar entered the NOC was a fingerprint read required. -- The large number of CCTV cameras, badge-readers, and bio-metric sensors appear to be a security overkill -- NEW DELHI 00004255 005 OF 005 perhaps more for show than for security -- considering that the physical space CERT-In occupies could not easily accommodate more than 40-50 per shift, plus up to 25 visitors/seminar attendees. -- The X-Ray machine in the foyer still appears unused (Ref A). Cybersecurity Audits Fell by the Wayside -------------- ¶15. (SBU) To PolOff's question on whether the RBI ever mandated cybersecurity audits (Ref B),Rai said that the mandate had never materialized. Instead, CERT-In offers voluntary cybersecurity audits to the private sector, performed by their staff engineers. Breakdown of Hardware -------------- ¶16. (SBU) Further to Ref B, CERT-In's Network Operations Center (NOC) employs 10 Sun servers (two each labeled "Firewall" and "e-mail," six labeled "Web." The remainder of their servers are IBM. ¶17. (U) Visit New Delhi's Classified Website: (http://www.state.sgov.gov/p/sa/newdelhi/) MULFORD