Security policy
The NISE website has been deployed within protected security zones and is secured through the implementation of firewalls, Intrusion Detection Systems (IDS), and high-availability solutions. Prior to the launch of the website, simulated penetration testing was conducted to identify potential security weaknesses. Periodic penetration testing is also carried out at least once a year to ensure continued security and resilience. The website was audited for known application-level vulnerabilities before its launch, and all identified vulnerabilities were addressed. In addition, the servers hosting the website were hardened in accordance with the guidelines issued by the Cyber Security Division.
Access to the web servers hosting the NISE website is restricted through both physical and network-based controls to the extent possible. Logs of authorized physical access to the website servers are maintained at two separate locations. The web servers are configured behind IDS and Intrusion Prevention System (IPS) solutions and are further protected by system-level firewalls. All development activities are carried out in a separate development environment and are thoroughly tested on a staging server before being deployed to the production environment. Following successful testing and approval, applications are transferred to the production server through SSH and VPN using a controlled single-point access mechanism.
Content received or contributed from remote locations is duly authenticated and is not published directly on the production server. All such content is required to undergo an appropriate moderation and verification process before final publication. Additionally, all web page content is examined for any intentional or unintentional malicious elements before being uploaded to the web server. Comprehensive audit logs of activities involving the operating system, system access, and application access are maintained and archived. Rejected access attempts and services are also logged and included in exception reports for further review and scrutiny.
The Website Team of the IT Division, NISE, monitors the website on a daily basis to ensure that all web pages are operational, no unauthorized modifications have been made, and no unauthorized links have been added. Newly released system software patches, bug fixes, and upgrades are reviewed and installed on the web servers regularly and without undue delay. Internet browsing, email services, and other desktop applications are disabled on production web servers, and these systems are used exclusively for server administration and related operational activities.
Server passwords are changed every three months and are securely shared between the designated authorized personnel, namely the IT Head, NISE, and the System Administrator, IT Division, NISE. The IT Head, NISE, and the System Administrator, IT Division, NISE, are designated as the administrators responsible for the NISE website and for ensuring implementation of this security policy across all web servers. The designated administrators are also responsible for coordinating with the Audit Team for conducting the required audits of the servers.
Following any major modification to the application or significant development activity, the NISE website is re-audited for application-level vulnerabilities, where applicable. The website was audited prior to its launch and was found to comply with the applicable requirements and provisions specified in the policies issued by the Cyber Security Group. In addition, the NISE website undergoes automated risk assessments using vulnerability identification tools both before and after deployment. Any known vulnerabilities identified through these assessments are reviewed and appropriately addressed to maintain the security, integrity, and availability of the website.
Notice and Disclosures
NISE website will not sell, trade, or disclose the personally identifiable information of its website users to any unauthorized third parties.
Data Quality and Access
NISE takes all reasonable measures to ensure that the information published on its website is accurate, reliable, and up to date. If any inaccurate or incorrect information is identified during the review of the website, NISE will make every effort to rectify the information at the earliest possible opportunity. In the event that an error or inaccuracy is identified in the website system as a whole, appropriate corrective measures will be taken promptly to minimize any disruption and ensure a smooth user experience.
Changes made to a user account may not be reflected on the website until the following business day. NISE reserves the right to modify, update, or revise the information available on the website at any time without prior notice.
While accessing and using the NISE website, certain non-personal information, such as the user's Internet Protocol (IP) address and the amount of time spent on individual web pages, may be automatically collected. Such information is used primarily for monitoring, security, and identifying any unauthorized access or use of the website.
Any individual found attempting to disrupt, damage, misuse, gain unauthorized access to, or unlawfully obtain information from the NISE website may be subject to appropriate legal action and prosecution in accordance with applicable laws.
Application Security Audit
The NISE website uses a Content Management System (CMS) to dynamically display information based on user requests. Prior to the launch of the website, the application underwent a comprehensive security audit to identify known application-level vulnerabilities in accordance with applicable CERT-In guidelines, NIC guidelines, OWASP standards, and other recognized security best practices. All identified security vulnerabilities were appropriately addressed before the website was made available to users.
The NISE website shall be periodically audited by an agency empaneled by CERT-In to ensure continued compliance with applicable security requirements. The security audit shall be conducted once every year from the date of issuance of the security certificate or earlier, where significant changes are made to the dynamic content or functionality of the website. In addition, a periodic assessment of the requirement for a renewed or updated security certificate is recommended to the Web Information Manager whenever there are substantial changes in the website's functionality, infrastructure, or operating environment.
Server Audit
The application and database servers hosting the NISE website and its associated databases have undergone appropriate security audits. The servers have been hardened in accordance with applicable security guidelines, and access is restricted through both physical and network-based controls to the extent practicable. Logs of authorized physical access to the NISE server infrastructure are maintained for monitoring and audit purposes.
The servers are deployed behind an application firewall to protect them from direct exposure to external users and unauthorized access attempts. All application development activities are carried out in a separate development environment and are thoroughly tested on a staging server before deployment to the production environment. Website content hosted on the NISE Data Centre servers is uploaded through secure SSH and VPN connections using a controlled single-point access mechanism.
All content is reviewed and approved by the designated approval authority prior to publication on the website. In addition, web page content is examined for any intentional or unintentional malicious elements before being uploaded to the production environment. Comprehensive audit trails and logs of activities related to the operating system, system access, and application access are maintained and securely archived. All rejected access attempts and services are also logged and recorded in exception reports for further review and investigation.
System software patches, bug fixes, and security updates are regularly reviewed and deployed in a timely manner to maintain the security and stability of the server environment. Antivirus software is installed on the servers and is regularly updated through online updates to provide continued protection against malware and other security threats.
Data Security
NISE takes security very seriously and has therefore taken every precaution to secure users’ information. In order to secure the user’s information, NISE has implemented several security measures to prevent loss, theft, or misuse of any user data.
Website Access Rights
The NISE website is accessible to users in India and abroad, and necessary firewall rules have been applied in the system. The WIM, in consultation with the IT Division, periodically identifies the countries from which the website is required to be accessible, keeping in view the mitigation of cyber-attacks, and the firewall rules are updated accordingly.
Website Architecture
The NISE website (nise.res.in) is the bilingual (English/Hindi) public portal of the National Institute of Solar Energy, an autonomous institute of the Ministry of New and Renewable Energy (MNRE). It publishes institutional information, department pages, reports, notices, tenders and careers. It is also the gateway to eight separate service portals hosted on subdomains.
