{"id":10531,"date":"2020-07-30T08:00:48","date_gmt":"2020-07-30T08:00:48","guid":{"rendered":"https:\/\/bengalnewstimes.com\/?p=10531"},"modified":"2020-07-30T08:00:48","modified_gmt":"2020-07-30T08:00:48","slug":"india-found-cyber-security-lapses-at-npci-in-2019-says-government-document","status":"publish","type":"post","link":"https:\/\/bengalnewstimes.com\/?p=10531","title":{"rendered":"India found cyber security lapses at NPCI in 2019, says government document"},"content":{"rendered":"<p><\/p>\n<div>\n<div class=\"article-image\">\n<figure><img loading=\"lazy\" decoding=\"async\" class=\"lazy lazy-hidden wp-image-2039575 size-full\" data-lazy-type=\"image\" src=\"https:\/\/images.financialexpress.com\/2020\/07\/cyber-security.jpg\" alt=\"NPCI,\u00a0cyber security,\u00a0Narendra Modi, digital payments system,\u00a0National Cyber Security,\u00a0cyberattacks,NPCI database,\u00a0RuPay, latets news on cyber security\" width=\"660\" height=\"440\" srcset=\"\" sizes=\"auto, (max-width: 660px) 100vw, 660px\"\/><noscript><img loading=\"lazy\" decoding=\"async\" class=\"lazy lazy-hidden wp-image-2039575 size-full\" data-lazy-type=\"image\" src=\"https:\/\/images.financialexpress.com\/2020\/07\/cyber-security.jpg\" alt=\"NPCI,\u00a0cyber security,\u00a0Narendra Modi, digital payments system,\u00a0National Cyber Security,\u00a0cyberattacks,NPCI database,\u00a0RuPay, latets news on cyber security\" width=\"660\" height=\"440\" srcset=\"\" sizes=\"auto, (max-width: 660px) 100vw, 660px\"\/><noscript><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-2039575 size-full\" src=\"https:\/\/images.financialexpress.com\/2020\/07\/cyber-security.jpg\" alt=\"NPCI,\u00a0cyber security,\u00a0Narendra Modi, digital payments system,\u00a0National Cyber Security,\u00a0cyberattacks,NPCI database,\u00a0RuPay, latets news on cyber security\" width=\"660\" height=\"440\" srcset=\"https:\/\/images.financialexpress.com\/2020\/07\/cyber-security.jpg 660w, https:\/\/images.financialexpress.com\/2020\/07\/cyber-security-300x200.jpg 300w, https:\/\/images.financialexpress.com\/2020\/07\/cyber-security-620x413.jpg 620w, https:\/\/images.financialexpress.com\/2020\/07\/cyber-security-401x267.jpg 401w, https:\/\/images.financialexpress.com\/2020\/07\/cyber-security-440x293.jpg 440w, https:\/\/images.financialexpress.com\/2020\/07\/cyber-security-80x54.jpg 80w, https:\/\/images.financialexpress.com\/2020\/07\/cyber-security-313x209.jpg 313w\" sizes=\"auto, (max-width: 660px) 100vw, 660px\"\/><\/noscript><\/noscript><span class=\"article-caption\">The audit was undertaken to provide Modi\u2019s National Security Council with an overview of the NPCI\u2019s defences against cyberattacks. (Reuters photo)<\/span><\/figure>\n<\/div>\n<p>A government audit of India\u2019s flagship payments processor last year found more than 40 security vulnerabilities including several it called \u201ccritical\u201d and \u201chigh\u201d risk, according to an internal government document seen by Reuters. The audit, which took place over four months to February 2019, highlighted a lack of encryption of personal data at the National Payments Corporation of India (NPCI) which forms the backbone of the country\u2019s digital payments system and operates the RuPay card network championed by Prime Minister <a target=\"_blank\" href=\"https:\/\/www.financialexpress.com\/tag\/narendra-modi\/\" rel=\"noopener noreferrer\">Narendra Modi<\/a>.<\/p>\n<p>The March 2019 government document cited the storing of 16-digit card numbers and other personal information such as customer names, account numbers and national identity numbers in \u201cplain text\u201d in some databases, leaving the data unprotected if the system was breached. The audit has not previously been reported.<\/p>\n<p>The NPCI said in a statement to Reuters it is regularly audited in the interests of security and senior management reviews all findings, which are then \u201cremediated to (the) satisfaction of the auditors\u201d. This includes the findings cited by Reuters, it said.<\/p>\n<p>India\u2019s National Cyber Security Coordinator, Rajesh Pant, whose office coordinated the audit, also said in a statement to Reuters that \u201call observations raised in last year\u2019s report have been confirmed as resolved by the NPCI\u201d.<br \/>Pant added audits are best practice for the mitigation of cyberattacks and are conducted on a periodic basis by all enterprises.<\/p>\n<p>The audit was undertaken to provide Modi\u2019s National Security Council with an overview of the NPCI\u2019s defences against cyberattacks. Modi\u2019s office and the finance ministry did not respond to a Reuters request for comment.<br \/>The audit\u2019s findings underscore the data-security challenges faced by the NPCI which processes billions of dollars daily via services that include inter-bank fund transfers, ATM transactions and digital payments.<\/p>\n<p>In India and beyond, financial institutions are under immense pressure to mount effective defences to protect their customers as the number of malicious cyberattacks grow and hackers become more sophisticated. Set up in 2008, the NPCI is a not-for-profit company which as of March 2019 counted 56 banks as its shareholders, including the <a target=\"_blank\" href=\"https:\/\/www.financialexpress.com\/market\/stock-market\/state-bank-of-india-stock-price\/\" rel=\"noopener noreferrer\">State Bank of India<\/a>, Citibank and HSBC .<\/p>\n<p>RuPay, in particular, has been enthusiastically endorsed by Modi who has likened its use to a national duty. It has grown to account for almost two-thirds of nearly 900 million debit and credit cards issued in India as of October, according to NPCI and central bank data.<\/p>\n<p><strong>GOVERNANCE CONCERNS<\/strong><\/p>\n<p>The audit followed a Reserve Bank of India (<a target=\"_blank\" href=\"https:\/\/www.financialexpress.com\/tag\/rbi\/\" rel=\"noopener noreferrer\">RBI<\/a>) inspection report on the NPCI in July 2017 that found lapses in its internal auditing practices, operational risks and improper whistleblower policies. There was \u201clack of awareness of risks and risk culture in the institution,\u201d according to a mostly redacted version of the 37-page report that was obtained by Reuters via the Right to Information Act (RTI) last year.<\/p>\n<p>The 2019 government document about the audit also noted: \u201cThere is a strong need for proper governance.\u201d The RBI conducted another inspection between November and December 2019. A 33-page report on that audit included its assessment of NPCI\u2019s governance and operational and credit risks. But most of the report, also obtained by Reuters via the RTI Act, was redacted by the central bank which cited the need to protect India\u2019s and the NPCI\u2019s economic interests.<\/p>\n<p>The NPCI in its statement did not comment specifically on the RBI reports, but said all observations cited by Reuters were remediated. The RBI did not comment on the reports.<\/p>\n<p><strong>ISSUES CITED<\/strong><\/p>\n<p>The March 2019 government document said a variety of card numbers were unencrypted within the NPCI database for the country\u2019s network of almost 250,000 ATMs, while unencrypted RuPay card numbers could also be seen in the organisation\u2019s server logs.<\/p>\n<p>It recommended that sensitive data, customer data and personal identity information be \u201cproperly encrypted\/masked in the database and logs\u201d. NPCI said in its statement to Reuters that it stores card data in line with standards set by the PCI Security Standards Council, and has been subject to audits authorised by the council. \u201cNo non-conformities have been observed and we are fully compliant to these standards,\u201d the statement said.<\/p>\n<p>Other high risk issues in RuPay and other NPCI applications cited by the government audit included so-called \u201cbuffer overflow\u201d vulnerability, a memory safety issue that can allow hackers to take advantage of coding mistakes.<\/p>\n<p>Operating systems used by the NPCI were not \u201cup to date\u201d and one of its mail servers had inadequate anti-malware functionality, it also said.<\/p>\n<p>The audit was conducted by a team of 10 to 12 people at NPCI\u2019s Mumbai headquarters and offices in two other cities, a person familiar with the matter said, declining to be identified.<\/p>\n<div class=\"common-bottom-text\">\n<p>Get live <a href=\"https:\/\/www.financialexpress.com\/market\/stock-market\/\" target=\"_blank\" rel=\"noopener noreferrer\">Stock Prices<\/a> from <a href=\"https:\/\/www.financialexpress.com\/market\/stock-market\/s-p-bse-sensex-stock-price\/\" target=\"_blank\" rel=\"noopener noreferrer\">BSE<\/a>, <a href=\"https:\/\/www.financialexpress.com\/market\/stock-market\/nifty-50-stock-price\/\" target=\"_blank\" rel=\"noopener noreferrer\">NSE<\/a>, <a href=\"https:\/\/www.financialexpress.com\/investing-abroad\/\" target=\"_blank\" rel=\"noopener noreferrer\">US Market<\/a> and latest NAV, portfolio of <a href=\"https:\/\/www.financialexpress.com\/mutual-funds-india\/\" target=\"_blank\" rel=\"noopener noreferrer\">Mutual Funds<\/a>, calculate your tax by <a href=\"https:\/\/www.financialexpress.com\/income-tax-calculator\/\" target=\"_blank\" rel=\"noopener noreferrer\">Income Tax Calculator<\/a>, know market\u2019s <a href=\"https:\/\/www.financialexpress.com\/market\/stock-market\/nse-top-gainers\/\" target=\"_blank\" rel=\"noopener noreferrer\">Top Gainers<\/a>, <a href=\"https:\/\/www.financialexpress.com\/market\/stock-market\/nse-top-losers\/\" target=\"_blank\" rel=\"noopener noreferrer\">Top Losers<\/a> &amp; <a href=\"https:\/\/www.financialexpress.com\/mutual-funds-india\/equity-funds\/\" target=\"_blank\" rel=\"noopener noreferrer\">Best Equity Funds<\/a>. Like us on <a href=\"https:\/\/www.facebook.com\/thefinancialexpress\" target=\"_blank\" rel=\"noopener noreferrer\">Facebook<\/a> and follow us on <a href=\"https:\/\/twitter.com\/FinancialXpress\" target=\"_blank\" rel=\"noopener noreferrer\">Twitter<\/a>.<\/p>\n<p class=\"telegram-text\"><img loading=\"lazy\" decoding=\"async\" class=\"telegrma_img\" src=\"https:\/\/images.financialexpress.com\/2020\/04\/telegram.png\" alt=\"\" width=\"24\" height=\"24\" style=\"margin: 0px 5px 4px 0px; float: left;\"\/>Financial Express is now on Telegram. <a href=\"https:\/\/t.me\/TheFinancialExpressOnline\" target=\"_blank\" rel=\"noopener noreferrer\">Click here to join our channel<\/a> and stay updated with the latest Biz news and updates.<\/p>\n<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><a href=\\\"https:\/\/www.financialexpress.com\/industry\/banking-finance\/india-found-cyber-security-lapses-at-npci-in-2019-says-government-document\/2039552\/\\\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The audit was undertaken to provide Modi\u2019s National Security Council with an overview of the NPCI\u2019s defences against cyberattacks. (Reuters photo) A government audit of India\u2019s flagship payments processor last year found more than 40 security vulnerabilities including several it called \u201ccritical\u201d and \u201chigh\u201d risk, according to an internal government [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":10532,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","footnotes":""},"categories":[36],"tags":[],"class_list":["post-10531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-banking-business"],"jetpack_featured_media_url":"https:\/\/bengalnewstimes.com\/wp-content\/uploads\/2020\/07\/cyber-security.jpg","_links":{"self":[{"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=\/wp\/v2\/posts\/10531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10531"}],"version-history":[{"count":0,"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=\/wp\/v2\/posts\/10531\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=\/wp\/v2\/media\/10532"}],"wp:attachment":[{"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bengalnewstimes.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}