A9R23

Netw ork and Information
Security Standards
for
E-Governance
-An Approach Paper-
Government of India
Ministry of Communications and Information Technology
Department of Information Technology
National Informatics Centre
http://egovstandards.gov.in
Network and Information Security
Standards
Prepared by: T.M.Rao, Senior Technical Director
Reviewed by: Deputy Director General NIC
Approved by: Director General
No part of this document shall be reproduced without prior permission of

Director General, National Informatics Centre
NIC-WG1-EGOVSTDS-NIS - 2- Version 1.0

Table of Contents
Amendment Log .........................................................................................................................4

1. Introduction ......................................................................................................................5
1.1 BACKGROUND.................................................................................................................... 5
1.2 PURPOSE........................................................................................................................... 6
1.3 SCOPE............................................................................................................................... 6
2. Need for Standards.........................................................................................................6
3. Areas of Network and Information Security Standards........................................7
4. National and International Initiatives on Standards ..............................................8
4.1 ISO ........................................................................................................................................ 8
4.2 BIS ......................................................................................................................................... 8
4.3 STATE GOVERNMENTS ............................................................................................................ 9
5. Abbreviations ...................................................................................................................9

Amendment Log
Version Date Change Brief Description Sections

No. Number Changed
1.0 22-12-05 NA First Version All

1. Introduction
With the introduction of computers, the need for automated tools for
protecting files and other information stored on computers became evident. The
information security is essential for a shared system, such as a time sharing
system, and the need is even more acute for systems that can be accessed over
public telephone or data network. The second major change that affected
security is the introduction of distributed systems and the use of networks and
communication facilities for carrying data between terminal user and computer
and between computer and computer. Network security measures are needed to
protect data during their transmission because virtually all business, Government
and academic organizations are interconnected their systems with a collection of
networks referred as Internet.
A new approach to the standards based e-Governance that simultaneously

provides for the security and availability of network resources is the need of the
hour. This approach keeps information safe, yet available whenever, wherever
and to whomever the needs dictate. The Network and Information security
standards need to be put in place for prevention of intrusions, detecting and
removing malicious code, managing the organizations security systems, ensuring
the service continuity with proper disaster management, data protection with data
back up and recovery procedures and many more.
1.1 Background
Recognizing the critical role that standards play in the rapid growth of e-
Governance, the Department of Information Technology (DIT), has constituted an
“Apex Body on Standards in DIT”, vide its notification No. 14 (3)04-EGD dated
7th September 2005, among other things, to design the broad policy framework

for setting as well as development of standards for the e-Governance initiatives
in India.
Network and Information security is one of the key priority area identified under
the National e-Governance Programme (NeGP).National Informatics Centre
(NIC) has been entrusted with this major task of the formulation of standards.
Working groups are being set up for each of the above area of Standards.
Originating white papers on all desired standards to serve, as discussion papers
for Working Groups to develop standards need to be prepared at the first
instance.
1.2 Purpose
To act as a base document that can be submitted to the working group to

deliberate and come out with white papers on Network and Information
Standards for e_Governance.
1.3 Scope
The scope of this document is to introduce the Network and Information security
needs of e_Governance and to identify the various areas of Network and
Information Security where standards need to be put in place.
2. Need for Standards
With the e-Governance initiatives taken up in a large scale both at Central and
State Government level, it is essential to have a broad national level policy
framework of standards to ensure seamless integration and inter operability of
applications and services in a secured manner across the country. The Policy

framework is essential in a global scenario like India where the Government
services are being offered to the citizens by the State Governments
independently on various State subjects that need to be in line with the Central
Government initiatives. For example, State Governments are setting up SWAN
that need to be established on global standards to integrate with national level
NICNET which is again reaching up to block level shortly.
3. Areas of Network and Information Security

Standards
Following are some of the areas of Network and Information Security where
Standards need to be put in place in the context of e_Governance.
?? Data protection and Retention

?? Back up and Recovery (Including Disaster Recovery and Service
Continuity)
?? Security Appliances (Firewalls, VPN Gateways, Content filtering,
Wi-Fi and more)
?? Electronic Mail
?? SPAM Prevention
?? Anti Virus
?? Password Selection
?? Early Warning Systems (Intrusion Prevention)
?? Computer Emergency Response Teams (CERT)
?? Digital Signature
?? Electronic Commerce

4. National and International Initiatives on
Standards
Following are some of the agencies working towards defining standards in the
area of Network and Information Security.
4.1 ISO
ISO/IEC 17799:2005 establishes guidelines and general principles for initiating,

implementing, maintaining, and improving information security management in an
organization. The objectives outlined provide general guidance on the commonly
accepted goals of information security management. ISO/IEC 17799:2005
contains best practices of control objectives and controls in the following areas of
information security management:
Security policy; organization of information security; asset management; human

resources security; physical and environmental security; communications and
operations management; access control; information systems acquisition;
development and maintenance; information security incident management;
business continuity management.
4.2 BIS
BIS is engaged in formulation of Indian Standards for the sector Electronics and
Information Technology supervised by a division counsel in which Network and
Information Security is a part. BIS publishes detailed Work Programme for each
of the Division Council once in a year. The Work Programme, besides giving
scope of Division Council and Sectional Committees, contains committee wise
position of standards published and draft standards (like preliminary, wide
circulation and finalized draft standards) at different stages of preparation. The
copies of Work Programme (and also of wide circulation drafts for comments
during the wide circulation period) can be obtained from the Director of the
concerned Technical Divisions, Bureau of Indian Standards, New Delhi.

4.3 State Governments
Some State Governments like Andhra Pradesh have released their own IT policy
documents with the help of consultants in which the Network and Information
Security standards and IT architecture form a part.
5. Abbreviations
Abbreviation Description
BIS Bureau of Indian Standards

DIT Department of Information Technology
e_Governance E Governance
IEC Institute of Electronics Communications
ISO International Standards Organization
IT Information Technology
NIC National Informatics Centre
NICNET NIC Network
SWAN State Wide Area Network
VPN Virtual Private Network

A9R23

Uploaded by

Copyright:

Available Formats

A9R23

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

A9R23

Uploaded by

Copyright:

Available Formats

Netw ork and Information

Prepared by: T.M.Rao, Senior Technical Director

Reviewed by: Deputy Director General NIC

Approved by: Director General

No part of this document shall be reproduced without prior permission of

NIC-WG1-EGOVSTDS-NIS - 2- Version 1.0

Amendment Log .........................................................................................................................4

NIC-WG1-EGOVSTDS-NIS - 3- Version 1.0

Version Date Change Brief Description Sections

1.0 22-12-05 NA First Version All

NIC-WG1-EGOVSTDS-NIS - 4- Version 1.0

A new approach to the standards based e-Governance that simultaneously

NIC-WG1-EGOVSTDS-NIS - 5- Version 1.0

To act as a base document that can be submitted to the working group to

2. Need for Standards

NIC-WG1-EGOVSTDS-NIS - 6- Version 1.0

3. Areas of Network and Information Security

?? Data protection and Retention

NIC-WG1-EGOVSTDS-NIS - 7- Version 1.0

ISO/IEC 17799:2005 establishes guidelines and general principles for initiating,

Security policy; organization of information security; asset management; human

NIC-WG1-EGOVSTDS-NIS - 8- Version 1.0

BIS Bureau of Indian Standards

NIC-WG1-EGOVSTDS-NIS - 9- Version 1.0

You might also like