Cybersecurity experts flag audit gaps after SBI leak, eMudhra breach

Bengaluru: Both the SBI data leak and the eMudhra incident are a wake-up call for organisations to implement proper security audits. .Cybersecurity experts said security audits must go beyond compliance checklists, and companies should conduct independent audits, secure endpoints and validate cryptographic keys.."The SBI leak is a data breach, and the exposed data fields point (possibly) to loan-sourcing, outsourced or lead-management pipelines, where stolen vendor credentials, exposed APIs or misconfigured document repositories are the likely routes. .Cyber security agency CERT-In issues critical alert on AI Agents breaching Indian systems.In the case of eMudhra, its own key-generation process produced weak keys that anyone could calculate from public data. And its audit failure over 18 months failed to detect this serious vulnerability. In both cases, the weakest component an organisation overlooks became the entry point," Govind Rammurthy, CEO & Managing Director, eScan, a cybersecurity company, said..Organisations must regularly audit exposed servers, APIs, cloud storage and third-party integrations, enforce multi-factor authentication and monitor for unusual activity. Vendors, agents and outsourcing partners handling customer data must meet the same security standards as the organisation itself. A simple post-ceremony check would have caught eMudhra’s weak keys, yet they passed audits for 18 long months, he added..Ritu Mehrotra, Founder & CEO, Shunya Labs, said, "India cannot build a digital economy on infrastructure it does not control." As AI moves into banking, identity, healthcare and critical infrastructure, the stakes are getting exponentially higher.."Treat any unexpected call or message quoting your personal details as suspicious, however accurate those details are. Never share OTPs, PINs or passwords, and verify any request by calling the number printed on your card or passbook. Keep phones, browsers and apps updated, which also protects you against eMudhra certificate fraud, and report suspicious calls to the cybercrime helpline 1930," Rammurthy said..eMudhra private key breach limited to global TLS operations, MeitY says.Companies must ensure accountability across their entire ecosystem; this includes vendors, suppliers and outsourcing parties..CERT-In said best practices include updating Firefox, Firefox ESR, Chrome, supported Android components, and other affected browsers, applications, and operating systems to the latest security releases provided by their respective vendors.