CERT-In Empaneled
For Cyber Security Services

Eventus Security is a CERT-In-empaneled Information Security Auditing Organisation, with capabilities spanning vulnerability assessment, penetration testing, and security auditing. Eventus also provides incident readiness and response services as part of its broader cybersecurity capabilities.

ContactUs

”Cyber security incidents mandatorily to be reported by service providers, intermediaries, data centres, body corporate and Government organisations to CERT-In within 6 hours”

How Eventus SOC Supports CERT-In Readiness

The Indian Computer Emergency Response Team (CERT-In) issued new instructions on April 28, 2022, requiring that any cybersecurity problems be reported to CERT-In no later than six hours after the incident is identified. This new guidance will assist enterprises in improving their cybersecurity posture, enhancing the protection of vital national infrastructure, preventing reputational damage from cyberattacks, and avoiding service interruptions.

Breach Attack Simulation

Simulate realistic attack scenarios to assess the effectiveness of security controls, identify weaknesses, and strengthen the organisation's security posture.

Incident Response

Investigate and respond to cyber incidents through coordinated detection, containment, eradication, and recovery activities, helping organisations minimise impact and restore normal operations.

Attack Surface Managaement

Identify internet-facing assets, exposed services and vulnerabilities to reduce the organisation's attack surface and prioritise remediation of identified risks.

Threat Intelligence

Provide actionable insights into the evolving threat landscape, helping organisations identify relevant threats, indicators of compromise, and emerging attack techniques.

Threat Detection And Response

Provide centralised visibility into security events and network activity to help organisations detect threats, investigate suspicious activity and initiate timely response.

Threat Hunting and Investigation

Proactively identify and investigate sophisticated threats that may evade conventional security controls, helping organisations detect hidden or previously unknown malicious activity.

CERT-In Directive

The following must be followed by organisations in accordance with the CERT-In directives:

All ICT systems must have logs enabled and maintained securely.

Logs must be kept for 180 days.

Cyber Security incidents must be reported to CERT-In within six hours of noticing the incident.

Report incidents using the prescribed CERT-In reporting mechanism.

Utilize the Network Time Protocol from the National Informatics Centre to synchronise time.

Establish a SPOC for this activity and provide CERT-In with their contact information.

Make sure that cloud service providers, VPN providers, and VPS providers keep proper records for 5 years.

Reportable types of cyber security events

Targeted network/system probing of crucial systems

Compromise of important systems or data

Unauthorized use of computer systems and data

Website vandalism, intrusion, and unauthorised alterations, including the insertion of malicious code and links to other websites.

Malicious code attacks, including the dissemination of viruses, worms, trojan horses, bots, spyware, ransomware, and crypto miners

Attacks on network devices such routers and servers such as those hosting databases, mail, and DNS

Attacks involving spoofing, phishing, and identity theft

Attacks that cause a denial of service (DoS) or distributed denial of service (DDoS)

Attacks against operational technological systems, wireless networks, and vital infrastructure

Attacks against online services like e-government and e-commerce, etc.

Data breaches

Data leaks

Attacks on Internet of Things (IoT) devices and the networks, systems, software, and servers that support them

Accidents or assaults targeting electronic payment systems

Attacks made possible by nefarious smartphone apps

Phoney mobile apps

Accessing social media accounts without authorization

Attacks on cloud computing systems, servers, software, or apps, or other malicious or suspicious activity

Attacks or nefarious/suspicious activity affecting Big Data, blockchain, virtual assets, virtual asset exchanges, custodial wallets, robotics, 3D and 4D printing, additive manufacturing, or other systems, servers, networks, software, or applications

Attacks or nefarious/suspicious activity affecting AI and ML-related servers, software, and apps.