|
Cybersecurity organisation CyberPeace has urged internet users to update their browsers and devices, avoid bypassing security warnings and enable two-factor authentication following the e-Mudhra certificate security incident, while advising enterprises to replace affected digital certificates before Google's planned root certificate removal on October 27.
In its safety advisory, CyberPeace warned that the incident could expose users to risks such as website impersonation and phishing, and stressed the need for individuals and organisations to take preventive measures. The organisation advised users to install pending updates for browsers, including Chrome, Firefox, Edge and Safari, as well as Android and iOS devices. It also urged users to close webpages displaying warnings such as "Your connection is not private", particularly when accessing banking, government and payment services. CyberPeace said users should verify website addresses carefully and access essential services through official applications or saved bookmarks rather than links received in messages. It also recommended enabling two-factor authentication and cautioned against sharing one-time passwords (OTPs), PINs and passwords. Warning of possible scams exploiting public concern over the incident, the organisation said users should avoid links or tools claiming to fix the e-Mudhra issue. It advised those who lose money to cyber fraud to call helpline 1930 or report the incident through the National Cyber Crime Reporting Portal. For enterprises, CyberPeace recommended identifying all digital certificates linked to the emSign ECC Root CA - G3, including those used by websites, payment gateways, application programming interfaces, virtual private networks and cloud infrastructure. Vineet Kumar, Founder and Global President of CyberPeace, in a conversation with ANI, said the incident underscored the need for stronger technical verification and proactive monitoring of digital trust infrastructure. He said the weakness in the certificate keys could potentially enable attackers to create fraudulent certificates and impersonate legitimate websites, although no breach of e-Mudhra's infrastructure had been reported at the time of the interview. Kumar also stressed that organisations must replace affected certificates promptly while ensuring that security measures do not disrupt legitimate online services. "Regulations, compliances on paper do not always translate into security in practice," Kumar told ANI, calling for independent technical verification rather than reliance on compliance certificates alone. It advised organisations to replace affected Transport Layer Security (TLS) certificates with certificates issued under a different, trusted hierarchy before the October 27 deadline, warning that delays could lead to compatibility issues and disruption of online services. The organisation also stressed that businesses must check servers, mobile applications, containers, network appliances and Internet of Things devices, as some systems maintain independent certificate trust lists and may not receive browser updates automatically. CyberPeace further recommended monitoring Certificate Transparency logs for unauthorised certificates, maintaining an updated certificate inventory, automating renewals and preparing emergency replacement plans. It cautioned organisations against disabling certificate validation to restore services, saying such a step could create security vulnerabilities, and stressed that certificate replacement must be planned to ensure continuity of essential online services. CyberPeace is a global non-profit organisation headquartered in India, working at the intersection of cybersecurity, policy, and peacebuilding. It envisions a safe, resilient, and inclusive cyberspace for all. (ANI)
|
