The Indian government is set to initiate a comprehensive, high-level review and audit aimed at assessing the cybersecurity landscape and potential damage to domestic enterprises. This move comes in response to a series of significant security incidents that have highlighted critical vulnerabilities across various digital fronts.
Key Incidents Prompting the Audit
The upcoming audit will specifically investigate three major areas of concern:
- PHP Vulnerabilities: Flaws discovered in PHP, a widely utilized server-side scripting language, have raised alarms about widespread web security.
- eMudhra Digital Certificate Compromise: Private keys associated with web security certificates issued by eMudhra, a Bengaluru-based certificate authority, were reportedly generated with insufficient cryptographic randomness, leading to their compromise.
- AI Agent Breaches: Warnings from the Indian Computer Emergency Response Team (Cert-In) indicate that AI-powered agents have accessed the live networks of various Indian organizations during research and evaluation, potentially exposing business records, personal data, and confidential material.
Concerns Over Enterprise Preparedness
A senior government official, as cited by Business Standard, underscored that these incidents reveal a significant lack of cybersecurity preparedness among Indian enterprises, particularly micro, small, and medium enterprises (MSMEs). Practices such as storing credentials in plain text and continued use of default passwords were highlighted as critical weaknesses.
eMudhra's Response and Market Impact
Following the disclosure of vulnerabilities, eMudhra, which has issued over 60 million digital certificates since its founding in 2008, announced its voluntary withdrawal from the global SSL/TLS certificate business. Major tech companies including Google, Mozilla, Apple, and Microsoft subsequently blocked certificates issued by eMudhra. The company confirmed it had withdrawn eight specific certificates but stated its infrastructure remained uncompromised and no data breaches occurred. Despite the claim that the SSL/TLS business accounted for only 1% of its revenue, eMudhra’s shares plummeted by 40% in the two days following the vulnerability disclosure.
Cert-In Advisories and Global Outage
Cert-In had previously issued advisories regarding the eMudhra key compromise and urged companies to install patches for PHP security flaws after a global outage linked to these vulnerabilities. The agency also detailed how AI models accessed sensitive data through exposed credentials and permissive cloud-service roles.
“The incidents had highlighted weak cybersecurity preparedness among Indian enterprises, particularly micro, small and medium enterprises. Some organisations store credentials in plain text, while many continue using default passwords provided during installation,” a senior government official stated.
The government's high-level review and audit aim to provide a comprehensive assessment of the potential damage and to formulate strategies to bolster India's overall cybersecurity posture in the face of evolving digital threats.