How the Exposure Occurred
The Cybersecurity and Infrastructure Security Agency (CISA) has released a detailed after action report on an incident where a contractor accidentally exposed AWS GovCloud credentials and Infrastructure as Code repositories in a personal public GitHub account. The breach was first discovered on May 15 when an investigative reporter contacted CISA after being tipped off by a security researcher who routinely scans public repositories for exposed secrets. The researcher continued sharing findings with the agency throughout the response.
Response and Remediation
CISA’s Office of the Chief Information Officer responded immediately by taking the public repository offline while preserving a forensic copy, shutting down the affected development environment, resetting associated credentials, and revoking the contractor’s system access. Investigators determined that the exposed material came from a personal repository where the contractor had copied the agency’s build and deployment code along with administrative credentials. Forensic log analysis confirmed that the leaked credentials were never used outside CISA’s environments and no customer or mission data was exposed. As a precaution, CISA rotated every credential across all environments where the contractor held administrative access and tightened controls on code repositories.
Key Lessons and Recommendations
CISA’s after action review identified several areas needing improvement including public repository controls, secrets management practices, incident playbook coverage for GitHub and cloud incidents, clearer reporting channels for external researchers, developer environment consolidation, and credential rotation speed. The agency emphasized that this incident highlights the human risk dimension where contractors and third parties handling infrastructure code require the same credential hygiene training and offboarding rigor as full time staff. CISA framed the disclosure around a philosophy that transparency builds trust and provides other organizations with actionable takeaways for strengthening credential management and repository governance.
Source: Cyber Security News
