CERT-In 'high-severity' advisories asks industry, MSMEs to watch out for cyberattacks

The Indian Computer Emergency Response Team issued the two advisories on May 9 and May 10 respectively

India and Pakistan may have called a stop to military action on May 10 but the government is unlikely to let its guard down as far as cybersecurity is concerned.

As the two countries were locked in their worst fiercest clash in decades, the government’s top cybersecurity body issued two advisories, warning businesses across the country of increasing ransomware and other cyberattacks.

In two separate advisories on May 9 and 10, rated as “high severity”,  the Indian Computer Emergency Response Team (CERT-In) flagged an increase in cyber threats affecting both large enterprises and small businesses.

CERT-In also issued special instructions to financial institutions and critical sectors to strengthen their cyber defences, Moneycontrol also reported.

In its May 10 advisory, CERT-In noted a surge in ransomware attacks, denial-of-service disruptions, website defacements, data leaks, and malware activity.

These attacks, it said, often happen in clusters and are aimed at crippling critical infrastructure or stealing sensitive information.

The advisory for larger organisations strongly recommended adopting a “Zero Trust” architecture—where no device or user is trusted by default, even if they’re inside the network perimeter.

It also urged companies to ensure all devices and systems are up-to-date, enforce multi-factor authentication, and regularly monitor for suspicious activity.

Key suggestions included:

Scan open ports and known vulnerabilities

Isolate outdated systems

Encrypt sensitive data

Back up data offline and testing restoration protocols

Monitor third-party vendors for signs of compromise

A day earlier, on May 9, CERT-In issued another alert, this time tailored for the country's micro, small, and medium enterprises (MSMEs).

The advisory emphasised practical, cost-effective steps MSMEs can take such as enforcing strong passwords, applying software updates, and educating employees about phishing scams.

“Even simple steps like backing up data regularly and blocking suspicious email attachments can make a big difference,” the advisory said.