Sitemize üye olarak beğendiğiniz içerikleri favorilerinize ekleyebilir, kendi ürettiğiniz ya da internet üzerinde beğendiğiniz içerikleri sitemizin ziyaretçilerine içerik gönder seçeneği ile sunabilirsiniz.
Sitemize üye olarak beğendiğiniz içerikleri favorilerinize ekleyebilir, kendi ürettiğiniz ya da internet üzerinde beğendiğiniz içerikleri sitemizin ziyaretçilerine içerik gönder seçeneği ile sunabilirsiniz.
Üyelerimize Özel Tüm Opsiyonlardan Kayıt Olarak Faydalanabilirsiniz
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that it had to create an incident‑response playbook from scratch while dealing with a live data breach. The story broke after independent security journalist Brian Krebs received a tip in May from a researcher at GitGuardian, a cyber‑security firm that monitors public code repositories.
The GitGuardian analyst warned Krebs that a contractor employee working for CISA had unintentionally pushed a file containing a massive list of usernames and passwords to a publicly accessible GitHub repository. The exposed credentials numbered in the thousands and were instantly visible to anyone browsing the repo, creating a severe risk of credential stuffing and unauthorized system access.
Upon learning of the leak, Krebs alerted CISA officials, who convened an emergency response session. Agency leaders admitted that they did not have a pre‑written playbook for this specific scenario, forcing their incident‑response team to devise one on the spot. The ad‑hoc playbook covered immediate containment steps, forensic analysis of the leaked data, classification of affected assets, and a communication plan for internal stakeholders and the public.
CISA quickly worked with the contractor to remove the offending GitHub repository and to revoke the compromised credentials. The agency also began a broader sweep of its supply‑chain partners to ensure no other sensitive data had been inadvertently published.
The episode underscores the challenges of managing third‑party risk and the importance of strict data‑handling policies for government contractors. In response, CISA announced plans to tighten supplier audits, expand mandatory security training for all personnel, and institutionalize a formal incident‑response framework that can be activated without delay. The incident serves as a cautionary tale that even well‑intentioned internal actions can create significant security gaps if proper safeguards are not in place.
Source: TechCrunch
ETİKETLER
BENZER İÇERİKLER
OKUYUCU YORUMLARI
CISA Scrambles to Draft Incident Playbook Amid Live Data Leak
Yorum Yaz