CISA admits: the incident response plan was drafted while the investigation was already underway

The US Cybersecurity and Infrastructure Security Agency (CISA) has admitted that it had to create an incident response plan in the middle of an unfolding incident, rather than ahead of time.

The trigger was a story broken in May by Brian Krebs, an independent journalist specializing in cybersecurity. According to his reporting, a researcher at the company GitGuardian discovered a large number of plaintext passwords in a publicly accessible repository on GitHub.

The repository, as it turned out, had been uploaded by an employee of one of CISA's contractors. In other words, the leak of sensitive data occurred not through the agency's own actions, but via a third-party organization that had access to its infrastructure or processes.

The agency's response

CISA confirmed the incident and acknowledged that, at the time it was discovered, the agency had no ready-made protocol for handling such situations. The corresponding response plan was developed in parallel with the investigation into the leak itself.

This admission is notable because CISA is a federal agency whose direct mission is to help other organizations defend against cyber threats and to develop standards for incident response. A situation in which the agency itself proved unprepared for its own incident points to gaps in internal processes, despite its status as an industry expert.

The contractor incident raises a broader question about oversight of third-party organizations that have access to the sensitive systems and data of government agencies. Publishing passwords in an open repository on GitHub is a common mistake seen among developers and companies around the world, but its consequences become especially significant when it involves an organization responsible for national cybersecurity.

Details about which specific systems or services could have been affected by the exposed passwords, as well as the concrete measures CISA took after the incident, have not yet been disclosed.

Source: TechCrunch