Key Takeaways
- CISA lacked a prepared incident response plan for a recent breach.
- The agency had to create a playbook during the incident.
- No sensitive customer data was compromised, according to CISA.
- Changes are being made to improve communication with security researchers.
Incident Overview
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently disclosed that it did not have a response plan in place when a cybersecurity incident occurred in May. This revelation came after a contractor inadvertently exposed sensitive keys and credentials for accessing U.S. government systems.
Response Challenges
In a postmortem report, CISA acknowledged that its personnel had to spend time developing a response playbook during the early stages of the incident. The agency emphasized the importance of having prepared playbooks for all anticipated scenarios to ensure a swift and organized response to security threats.
Details of the Breach
Independent cybersecurity journalist Brian Krebs reported that a security researcher from GitGuardian alerted him to numerous exposed passwords found in a publicly accessible GitHub repository. This repository had been uploaded by an employee of a CISA contractor. After Krebs contacted CISA, the agency acted to take the repository offline and revoked the exposed credentials to mitigate potential risks.
Improvements and Future Steps
CISA stated that no customer or mission data was compromised during the incident and expressed gratitude to the researcher and journalist who brought the issue to light. The agency also recognized that its channels for security researchers to report potential incidents were poorly defined and has since made adjustments to facilitate faster communication.
Leadership and Workforce Challenges
Since January 2025, CISA has been operating without a permanent director. The agency has also faced workforce reductions, including cuts and furloughs, affecting about a third of its staff since the beginning of the Trump administration.