CISA Says Exposed AWS GovCloud Keys Were Not Used Outside Agency
Summary
CISA says privileged AWS GovCloud keys exposed in a public GitHub repository were not used outside the agency and exposed no customer or mission data; it has strengthened secret handling and incident response.
Key points
- CISA said a contractor exposed privileged AWS GovCloud keys in a public GitHub repository; the agency learned of the leak on May 15.
- CISA took the repository and its developer environment offline and revoked the responsible person’s access.
- CISA’s log analysis found the credentials were not used outside the agency, and no customer or mission data was exposed.
- CISA rotated its secrets and plans to use endpoint detection and response capabilities to monitor uploads to public repositories.
- The agency plans to improve secrets management, make it easier to report CISA-specific vulnerabilities, and prepare incident playbooks in advance.
- Security researcher Guillaume Valadon praised CISA’s evaluation and its plans to improve researcher reporting.
Article Details
- Victim Organization
- Cybersecurity and Infrastructure Security Agency (CISA)
- Incident Type
- Exposure of privileged AWS GovCloud credentials in a public GitHub repository
- Data Types Exposed
- Privileged AWS GovCloud credentials
- Operational Impact
- CISA took the repository and its developer environment offline, revoked the responsible person's access, and rotated its secrets. CISA said the credentials were not used outside the agency and no customer or mission data was exposed.
- Claim Status
- confirmed
People
Brad LibbeyCISA acting chief information security officer who co-wrote the agency's account of its incident response.Guillaume ValadonGitGuardian security researcher who discovered the credential leak and commented on CISA's incident evaluation.Preston WerntzCISA acting chief information officer who co-wrote the agency's account of its incident response.
Vendors
Products
AWS GovCloudCISA released a forensic report on a major credential leak involving privileged Amazon AWS GovCloud keys exposed in a public GitHub repository, saying no customer or mission data was compromised.GitHubCISA released a forensic report on a major credential leak involving privileged Amazon AWS GovCloud keys exposed in a public GitHub repository, saying no customer or mission data was compromised.