The federal group in charge of protecting government networks recently admitted a surprising fact about its own planning. The US cybersecurity agency CISA had to build its incident playbook during the incident, the agency reveals in a new public report. Instead of having a ready plan to follow, the team figured out their response steps in real time when a data leak occurred.
A contractor exposed secret cloud keys on a public website
The problem started in May when a government contractor made a mistake. This individual uploaded sensitive passwords and cloud access keys to a public space on GitHub. Anyone browsing the internet could see the secret files meant for internal use only.
A security researcher noticed the leaked information and tried to warn the contractor. When no one answered, the researcher reached out to a tech reporter. The reporter then contacted the agency directly to let them know about the data hole.
The defense agency lacked a plan to handle the leak
Once the agency found out about the files, the team quickly took the page offline and canceled the leaked passwords. However, a recent report showed that the staff did not have a guide to handle this specific type of problem.
The group admitted it missed creating a playbook for cloud leaks. Because they lacked a prepared document, the team spent valuable time writing a response plan during the early stages of the event. They were building the rules while actively fighting the problem.
Officials promise better reporting channels for future security problems
The agency confirmed that no mission data was lost and thanked the researcher for the tip. The team also admitted that its contact methods for outside researchers were confusing. People trying to report problems did not have a fast way to reach the right desk.
To fix this issue, the group plans to simplify how outsiders can report security flaws. The agency now tells other organizations to build complete playbooks for every possible problem.
