US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals

CISA, the US agency in charge of protecting federal networks, admitted it had no response plan ready when a cybersecurity breach happened in May. A contractor had left sensitive keys and passwords exposed in a public GitHub repository. A security researcher found them and alerted a journalist, who then told CISA. Only then did the agency take the data offline and replace the exposed credentials.

CISA said in a report that its staff had to build a response playbook while the incident was still unfolding. The agency admitted this was not ideal and said organizations should prepare plans ahead of time. No customer or mission data was exposed, according to CISA. The agency thanked the researcher and journalist for their help. The exposed credentials could have let attackers access US government systems.

The agency meant to protect US systems had no plan when a real breach happened. This shows even the experts can be unprepared for cyber threats.