Web Application Security in Chennai · OMR SaaS, PSU Banks & TNeGA

Chennai web-application-security work breaks across four buyer profiles with distinct application surfaces. OMR (Old Mahabalipuram Road) SaaS unicorns and product companies face OWASP ASVS Level 3 + SOC 2 Type II + ISO 27001:2022 enterprise procurement standards. PSU bank customer-facing applications (net-banking, mobile-banking, customer-portal, branch-portal) face RBI Master Direction on IT Governance plus DFS circular cyber clauses. Auto OEM customer portals (Hyundai, Renault-Nissan, BMW dealer-portals and customer-engagement-portals) face IT-services-customer-procurement-driven control catalogues plus DPDP §16 cross-border overlay. TNeGA / Tamil Nadu state-government citizen-portal applications face CERT-In + DPDP + TNeGA + Tamil-language documentation requirements. Macksofy's Chennai AppSec practice runs all four playbooks from the Mumbai-and-Hyderabad dual-anchor bench with a Chennai-resident senior consultant for multi-quarter PSU bank programmes.

OMR SaaS AppSec follows the Bengaluru pattern at platform-level — OWASP ASVS Level 3 default, manual-first methodology, multi-tenant authz at every role boundary, identity-federation testing (SAML / OIDC / OAuth 2.0 with Okta / Entra ID / AWS Cognito), cloud-native testing (IaC misconfiguration, CI/CD pipeline trust, AWS / GCP / Azure IAM-and-KMS), and OWASP Top 10 for LLM Applications (2025) for AI surfaces. The OMR buyer profile is increasingly international-customer-focused — US Fortune 500 and EU enterprise customer base — so dual-format reporting (CERT-In + SOC 2 CC + ISO 27001:2022 + HIPAA + GDPR overlay) is the default.

PSU bank customer-app AppSec is the Chennai-specific lane. The scope traverses the customer-facing application surface — net-banking, mobile-banking, customer-portal, branch-portal — calibrated to PSU bank reality (heterogeneous platform mix with Finacle + BaNCS coexisting, 4,000-15,000 branch nodes, legacy mainframe-RACF on the back-end). Test surface covers transaction-graph abuse (velocity-control bypass, OTP reuse, beneficiary-add race, reconciliation drift), authorisation-matrix exercise role-by-role (customer / branch-officer / supervisor / treasury / mainframe-RACF integration roles), KYC-impersonation paths and (where the PSU bank offers Aadhaar-enabled digital onboarding) UIDAI Authentication Regulations 2016 evidence. Every finding maps to RBI Master Direction Annex-1 clauses and the DFS circular submission-format.

Auto OEM customer-portal AppSec layers in the customer-engagement-portal scope unique to Chennai. Hyundai dealer-portal, Renault-Nissan customer-engagement-portal, BMW customer-config-portal, Daimler Trucks fleet-customer-portal each face IT-services-customer-procurement-driven control catalogues from the foreign-OEM parent. Test surface covers customer authentication, customer-data isolation (so a customer cannot see another customer's vehicle or service history), payment-flow abuse paths, service-request authorisation, dealer-portal-to-OEM-back-end trust chain, and (where connected-vehicle integration is in scope) the customer-vehicle-data-isolation evidence the European customer-procurement function asks for.

TNeGA citizen-portal AppSec is the fourth playbook layer. Tamil Nadu e-Governance Authority (TNeGA), Aavin Dairy, Tamil Nadu state PSU customer-portals, citizen-services-portals and the Aadhaar AUA / KUA-enabled service surfaces face CERT-In + DPDP + TNeGA-specific monitoring and Tamil-language data-handling requirements. State-government citizen-portal AppSec engagements include Tamil-language frontend testing, Aadhaar AUA / KUA replay-resistance evidence per UIDAI Authentication Regulations 2016, and DPDP §16 cross-border-transfer-control evidence where citizen data routes outside Tamil Nadu's data-residency boundary.

Identity is a cross-cutting concern. OMR SaaS clients run hybrid identity with Okta or Microsoft Entra ID as central IDP. PSU bank clients run on-premises AD with mainframe-RACF integration. Auto OEM customer portals federate with the foreign-OEM parent's identity stack (typically Azure AD or Okta). TNeGA citizen-portal scopes federate with the central UIDAI / Aadhaar AUA / KUA infrastructure. The AppSec engagement tests federation trust paths end-to-end per scope — SCIM, SAML, OIDC, OAuth 2.0, JWT, Conditional Access, MFA — and the privileged-access path discovery that always exists.

Procurement reality matters. OMR SaaS AppSec engagements close through the CTO and head of customer security in a single weekly sync. PSU bank customer-app AppSec closes through the GM-IT and CISO with the bank's board-IT-committee secretary copied. Auto OEM customer-portal AppSec closes through the IT head with the foreign-OEM-customer cyber-security function copied. TNeGA / state-government engagements close through the procuring department's IT head with TN-eGA panel routing and Tamil-language deliverable agreement. Engagement length is typically 3-4 weeks for OMR SaaS, 5-7 weeks for PSU bank customer-app, 4-5 weeks for auto OEM customer-portal, and 4-5 weeks for TNeGA scope with Tamil-language overhead.

Onsite cadence — Mumbai → MAA flight is 90 minutes; Hyderabad → MAA flight is 60 minutes; drive from MAA to OMR is 45 minutes, to Tidel Park 30 minutes, to Sriperumbudur 90 minutes. Same-day onsite arrival is feasible from either anchor. For sustained PSU bank programmes we maintain a Chennai-resident senior analyst with a local mobile.