CISA looks to remedy ailments from big May credential leak

CISA looks to remedy ailments from big May credential leak

A major credential leak spurred the Cybersecurity and Infrastructure Security Agency to strengthen protections for its sensitive materials, improve how researchers can report agency vulnerabilities and develop plans for similar incidents, the agency said in a forensic report released Thursday. The blog post outlines CISA’s response to the leak that the researcher who discovered it in May called one of the worst he had ever seen, which also drew …

CISA details security lapses that led to GitHub leak of passwords, cloud access keys

The agency’s blog post came as lawmakers pressed the agency for answers.

AWS GovCloud Credential Leak Leads CISA to Share Critical Cyber Incident Lessons

The Cybersecurity and Infrastructure Security Agency (CISA) has disclosed details of an internal security incident involving exposed AWS GovCloud credentials, offering a transparent account of its own incident response to help other organizations strengthen their defenses. On Friday, May 15, CISA’s Office of the Chief Information Officer (OCIO) launched an internal investigation after an investigative […] The post AWS GovCloud Credential Leak Le…

US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals

Independent cybersecurity journalist Brian Krebs reported in May that a security researcher with cyber firm GitGuardian alerted him to reams of exposed passwords stored in a publicly accessible GitHub repository, which an employee of a CISA contractor had uploaded.

CISA credential leak prompts tighter security measures

Open the article to view the coverage from cybernoz.com

CISA Details "Lessons from a Cyber Incident" After AWS GovCloud Credentials Leak

CISA has published a candid after-action account revealing that a contractor accidentally exposed the agency’s own AWS GovCloud credentials and Infrastructure-as-Code repositories in a personal, public GitHub account, triggering an internal incident response and a rare public “lessons learned” disclosure from the federal cybersecurity agency itself. On Friday, May 15, CISA’s incident response began after an investigative reporter contacted the a…