INTRODUCTION

Information Communication Technology (ICT) has become ubiquitous amongst government ministries and departments across the country. The adoption and use of ICT has increased the attack surface and threat perception to government, due to lack of proper cyber security practices followed on the ground.

This guideline has been complied with the objective to ensure a sanitized and secure framework in the Ministries. CISO is required to sensitize the government employees, contractual/outsourced manpower and build awareness from a cyber security perspective as per the Cyber security guidelines for Government Employees.

The ownership of Compliance of this guideline rests with the CISO of each Ministry/Department.

Cyber Security Guidelines For Government Employees

1. SCOPE AND TARGET AUDIENCE

The following guidelines are to be adhered to by all government employees, including outsourced/contractual/temporary employees, who work for government Ministry/Department.

2. DESKTOP/LAPTOP AND PRINTER SECURITY AT OFFICE

1. Use only Standard User (non-administrator) account for accessing the computer/laptops for regular work. Admin access to be given to users with approval of CISO only.
2. Set BIOS Password for booting.
3. Ensure that the Operating System and BIOS firmware are updated with the latest updates/patches.
4. Set Operating System updates to auto-updated from a trusted source.
5. Ensure that the Antivirus client installed on your systems are updated with the latest virus definitions, signatures and patches.
6. Only Applications/software’s, which are part of the allowed list authorized by CISO, shall be used; any application/software which is not part of the authorized list approved by CISO, shall not be used.
7. Always lock/log off from the desktop when not in use.
8. Shutdown the desktop before leaving the office.
9. Keep printer’s software updated with the latest updates/patches.
10. Setup unique pass codes for shared printers.
11. Internet access to the printer should not be allowed.
12. Printer to be configured to disallow storing of print history.
13. Enable Desktop Firewall for controlling information access.
14. Keep the GPS, Bluetooth, NFC and other sensors disabled on the desktops /laptops and mobile phones. They may be enabled only when required.
15. Use a Hardware VPN Token for connecting to any IT Assets located in Data Centre.
16. Do not write passwords, IP addresses, network diagrams or other sensitive information on any unsecured material (ex: sticky/post-it notes, plain paper pinned or posted on users table etc.).
17. Do not use any external mobile App based scanner services (ex: Cam scanner) for scanning internal government documents.
18. Use of all pirated Operating systems and other software/applications that are not part of the authorized list of software’s should be immediately deleted.

3. PASSWORD MANAGEMENT

1. Use complex passwords with a minimum length of 8 characters, using a combination of capital letters, small letters, numbers and special characters.
2. Change passwords at least once in 30 days.
3. Use Multi-Factor Authentication, wherever available.
4. Don’t use the same password in multiple services/websites/apps.
5. Don’t save passwords in the browser or in any unprotected documents.
6. Don’t write down any passwords, IP addresses, network diagrams or other sensitive information on any unsecured material (ex: sticky/post-it notes, plain paper pinned or posted on your table).
7. Don’t share system passwords or printer pass code or Wi-Fi passwords with any unauthorized persons.

4. INTERNET BROWSING SECURITY

1. While accessing Government applications/services, email services or banking/payment related services or any other important application/services, always use Private Browsing/Incognito Mode in your browser.
2. While accessing sites where user login is required, always type the site’s domain name/URL, manually on the browser’s address bar, rather than clicking on any link.
3. Use the latest version of the internet browser and ensure that the browser is updated with the latest updates/patches.
4. Don’t store any usernames and passwords on the internet browser.
5. Don’t store any payment related information on the internet browser.
6. Don’t use any 3rd party anonymization services (ex: Nord VPN, Express VPN, Tor, Proxies etc).
7. Don’t use any 3rd party toolbars (ex: download manager, weather tool bar, ask me tool bar etc.) in your internet browser.
8. Don’t download any unauthorized or pirated content /software from the internet (ex: pirated - movies, songs, e-books, software’s).
9. Don’t use your official systems for installing or playing any Games.
10. Observe caution while opening any shortened URLs (ex: tinyurl.com/ab534/). Many malwares and phishing sites abuse URL shortener services. Such links may lead to a phishing/malware webpage, which could compromise your device.

5. MOBILE SECURITY

1. Ensure that the mobile operating system is updated with the
   latest available updates/patches.
2. Don’t root or jailbreak your mobile device. Rooting or Jail breaking process disables many in-built security protections and could leave your device vulnerable to security threats.
3. Keep the Wi-Fi, GPS, Bluetooth, NFC and other sensors disabled on the mobile phones. They may be enabled only when required.
4. Download Apps from official app stores of Google (for android) and apple (for iOS).
5. Before downloading an App, check the popularity of the app and read the user reviews.
6. Observe caution before downloading any apps which has a bad reputation or less user base etc.
7. While participating in any sensitive discussions, switch-off the mobile phone or leave the mobile in a secured area outside the discussion room.
8. Don’t accept any unknown request for Bluetooth pairing or file sharing.
9. Before installing an App, to carefully read and understand the device permissions required by the App along with the purpose of each permission.
10. In case of any disparity between the permissions requested and the functionality provided by an app, users to be advised not to install the App (Ex: A calculator app requesting GPS and Bluetooth permission).
11. Note down the unique 15-digit IMEI number of the mobile device and keep it offline. It can be useful for reporting in case of physical loss of mobile device.
12. Use auto lock to automatically lock the phone or keypad lock protected by pass code/ security patterns to restrict access to your mobile phone.
13. Use the feature of Mobile Tracking which automatically sends messages to two preselected phone numbers of your choice which could help if the mobile phone is lost/ stolen.
14. Take regular offline backup of your phone and external/internal memory card.
15. Before transferring the data to Mobile from computer, the data should be scanned with Antivirus having the latest updates.
16. Observe caution while opening any links shared through SMS or social media etc., where the links are preceded by exciting offers/discounts etc., or may claim to provide details about any latest news. Such links may lead to a phishing/malware webpage, which could compromise your device.
17. Report lost or stolen devices immediately to the nearest Police Station and concerned service provider.
18. Disable automatic downloads in your phone.
19. Always keep an updated antivirus security solution installed.

6. EMAIL SECURITY

1. Ensure that Kavach Multi-Factor Authentication is configured on the NIC Email Account.
2. Download kavach app from valid mobile app stores only. Do not download from any website.
3. Do not share the email password or Kavach OTP with any unauthorized persons.
4. Don’t use any unauthorized/external email services for official communication.
5. Don’t click/open any link or attachment contained in mails sent by unknown sender.
6. Regularly review the past login activities on NIC’s Email service by clicking on the "login history” tab. If any discrepancy is observed in the login history, then the same should be immediately reported to NIC-CERT.
7. Use PGP or digital certificate to encrypt e-mails that contains important information.
8. Observe caution with documents containing macros while downloading attachments, always select the “disable macros” option and ensure that protected mode is enabled on your office productivity applications like MS Office.

7. REMOVABLE MEDIA SECURITY

1. Perform a low format of the removable media before the firsttime usage.
2. Perform a secure wipe to delete the contents of the removable media.
3. Scan the removable media with Antivirus software before accessing it.
4. Encrypt the files /folders on the removable media.
5. Always protect your documents with strong password.
6. Don’t plug-in the removable media on any unauthorized devices.

8. SOCIAL MEDIA SECURITY

1. Limit and control the use/exposure of personal information while accessing social media and networking sites.
2. Always check the authenticity of the person before accepting a request as friend/contact.
3. Use Multi-Factor authentication to secure the social media accounts.
4. Do not click on the links or files sent by any unknown contact/user.
5. Do not publish or post or share any internal government documents or information on social media.
6. Do not publish or post or share any unverified information through social media.
7. Do not give share the @gov.in/@nic.in email address on any social media platform.
8. It is recommended to use NIC’s Sandes App instead of any 3^rd party messaging app, for official communication.

9. SECURITY ADVISORY AND INCIDENT REPORTING

1. Adhere to the security advisories published by NIC-CERT (https://nic-cert.nic.in/advisories.jsp ) and CERT-In (https://www.cert-in.org.in).
2. Report any cyber security incident, including suspicious mails and phishing mails to NIC-CERT (incident@nic-cert.nic.in) and CERT-In (incident@cert.org.in).

10. CYBER SECURITY RESOURCES

The following resources may be referred for more details regarding the cyber security related notifications/information published by Government of India:

11. COMPLIANCE

All government employees, including temporary, contractual/outsourced resources are required to strictly adhere to the guidelines mentioned in this document. Any non-compliance may be acted upon by the respective CISOs/Department heads.