Security Policy

Security Policy

1. Website Security Policy

• Consulate General of India, Hong Kong & Macau https://cgihk.gov.in/ has been placed in protected zones with implementation of firewalls, anti-DDoS, VPN and IDS (Intrusion Detection System) and high availability solutions.
• This website has been audited for known application level vulnerabilities and all the known vulnerability has been addressed.
• Hardening of servers has been completed as per the guideline of Cyber Security division before the launch of the website of Consulate General of India, Hong Kong & Macau.
• Access to web servers is restricted both physically and through the network as far as possible.
• Logs at different locations are maintained for authorized physical access of servers.
• Web servers are configured behind IDS, IPS, and system firewalls.
• All the development work is done in a separate development environment and is well tested on the staging server before updating it on the production server.
• Production deployment is done via SSH and VPN through a single point after thorough testing.
• The content contributed by/from remote locations is duly authenticated & is not published on the production server directly. Any content contributed will go through the moderation process before final publishing to the production server.
• All contents of the web pages are checked for intentional or unintentional malicious content before final upload to web server pages.
• Audit and Log of all activities involving the operating system, access to the system, and access to applications are maintained and archived. All rejected accesses are logged and listed in exception reports for further scrutiny.
• Monitoring Team performs monthly checks to ensure the site is running correctly and has no unauthorized changes or links and that no unauthorized links have been established.
• All newly released system software patches; bug fixes and upgrades are expediently and regularly reviewed and installed on the web server.
• On Production web servers, Internet browsing, mail and any other desktop applications are disabled. Only server administration related tasks are performed.
• Server passwords are changed 3 months once and are shared only between team manager & admin.
• Ardhas Technology India Pvt. Ltd. has been designated as Administrator and shall be responsible for implementing this policy for each of the web servers. The administrator shall also coordinate with the Audit Team for required auditing of the server(s).
• Consulate General of India, Hong Kong & Macau application has been re-audited for the application-level vulnerability after major modification in application development [Not applicable at first launch].
• Consulate General of India, Hong Kong & Macau application has also been subjected to an automated risk assessment performed through vulnerability identification software before and after the launch and all the known vulnerabilities have been addressed.

Notice and Disclosures

Consulate General of India, Hong Kong & Macau will not sell, trade, nor disclose the personally identifiable information of its website users to any unauthorized third parties

Data Quality and Access

Consulate General of India, Hong Kong & Macau website takes all steps possible to ensure that the data on the website is accurate. If something is found to be inaccurate Consulate General of India, Hong Kong & Macau Website will make every effort to correct said information as quickly as possible. If it is found to be an inaccuracy with the entire system Consulate General of India, Hong Kong & Macau Website will work swiftly to correct the problem so that your web experience is as trouble-free as possible. Any change to your user account will not be reflected on the website until the following business day. The information contained on the Consulate General of India, Hong Kong & Macau website is subject to change without prior advance notice.

While using the Consulate General of India, Hong Kong & Macau website certain information such as your IP Address and time spent on pages may be collected. This non-personal information is collected to monitor any unauthorized use or access to the Consulate General of India, Hong Kong & Macau Website. Anyone caught attempting to harm, steal information from, or otherwise damage the Consulate General of India, Hong Kong & Macau website will be prosecuted to the full extent of the law.

Application Security Audit

The application has been security audited for the known application-level vulnerabilities as per Top 10 OWASP and the application security vulnerabilities have been addressed before the launch of the Portal.

The website is audited by Cert-in empanelled agency periodically. The periodicity is one year from the date of issue of certificate or additional changes in the dynamic content carried out whichever is earlier. A periodic check on the requirement of a security certificate is recommended to the web information manager in case there are changes in the functionality or any other environmental changes.