Malware attack delayed CDSL settlements by 2 days, SEBI finds

This order addresses a malware attack on Central Depository Services (India) Limited (CDSL) that occurred on November 18, 2022, and examines alleged failures by CDSL and its senior IT officers to comply with SEBI’s cybersecurity regulations, specifically regarding the classification of critical assets and vulnerability testing.

Who it concerns: Central Depository Services (India) Limited (CDSL), Mr. Rajesh Nadkarni (then Chief Information Security Officer), and Mr. Amit Mahajan (then Chief Technology Officer).

What SEBI found or ordered

• SEBI alleged that CDSL failed to identify and classify the ADFS server as a critical asset, contrary to SEBI Circulars dated July 06, 2015 (as modified May 20, 2022).
• SEBI alleged that CDSL failed to include the ADFS server in vulnerability assessment and penetration testing (VAPT) and did not integrate it with Security Information and Event Management (SIEM) and Privileged Identity Management (PIM).
• The order cites alleged violations of the SEBI (Depositories and Participants) Regulations, 2018, and various SEBI circulars regarding cybersecurity and remote access.
• A Show Cause Notice was issued on October 24, 2024, alleging that CDSL disregarded the cyber-security framework on the pretext of COVID-19 hybrid working requirements.
• The order notes that CDSL admitted in January 2024 that it had not classified the affected ADFS server as critical.

Also in the document

• The malware attack caused a disruption where settlements scheduled for November 18, 2022, were delayed until November 20, 2022.
• The root cause was identified in the final Root Cause Analysis (RCA) report as an inadequately secured internet-accessible ADFS server.
• The order is an adjudication proceeding under Section 15-I of the SEBI Act and Section 19H of the Depositories Act, 1996.