Central Board of Secondary Education (CBSE) brought in ethical hacker Nisarga Adhikary, 19, to tackle serious holes in its IT systems . Adhikary had flagged major security flaws in the student data portal last month . CBSE initially denied any breach,but soon had to rethink its cybersecurity approach .
Someone from the Indian Institute of Technology (IIT) team said,“Nisarga is sharp. He spotted key problems. We wanted to see how he did it.” Directors from IIT-Madras and IIT-Kanpur joined forces, spending two weeks at CBSE HQ in New Delhi,working round-the-clock to fix things.
Starting May 24, IIT experts zeroed in on two main systems: on-screen marking (OSM) portal by COEMPT Eduteck and the one for answer sheet applications. They found multiple weak points,including some that could've let outsiders access sensitive info.
One flaw allowed logins without credentials. Another gave unauthorized admin access to central server. A glitch let users extract student answer scripts. Fixing insecure code isn't easy — leads to more issues,said an IIT expert .
IIT team used “Red Team versus Blue Team” method to boost security . Blue Team from IIT-Madras and CBSE developers strengthened portals,while Red Team from IIT-Kanpur hunted for more gaps. After intense checks, Red Team found no new vulnerabilities.
To fix issues,IIT experts told COEMPT Eduteck to erase unsecured student data backups and move data to secure cloud storage. They also used AI tools to speed up flaw detection.
On June 2 and 3,CBSE hit by massive Denial of Service (DoS) attacks. Over 1.3 million logins in two minutes on June 2,climbing to 3 million next day. Despite this,new load management kept system stable.
Post-incident,Ministry of Education advised stronger cybersecurity when picking tech vendors . An official admitted last vendor was chosen without enough focus on security.
IIT teams wrapping up now. Re-evaluation portal launched June 2, OSM portal secured by June 5. A report with findings and advice will go to Education Ministry soon...what next for CBSE's tech future?
