A report released Thursday by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) states that a contractor accidentally leaked private cloud access keys and other sensitive credentials due to weak security controls while using a public GitHub code repository. The report was co-signed by CISA Acting Chief Information Officer Preston Werntz and Acting Chief Information Security Officer Brad Libbey.

The report states: "To independently create cloud infrastructure, the contractor uploaded copies of CISA's build and deployment repositories to their personal GitHub account." While preparing the repositories, the contractor also uploaded administrator credentials and build credentials for CISA's coding systems, as well as infrastructure-as-code (IaC) data containing private access keys for cloud services such as Amazon Web Services—that is, instruction sets used to manage cloud platform configurations.

Independent cybersecurity journalist Brian Krebs first reported the leak in mid-May, attributing responsibility to government contractor Nightwing. After the incident came to light, lawmakers immediately pressured CISA for an explanation. CISA's rare post-incident report aims to demonstrate to Congress, industry partners, and the public that its systems are secure and that it is advancing necessary process and technology improvements.

CISA said it first learned of the leak when Krebs contacted the agency for comment on his report, and subsequently took "swift and comprehensive action," including taking down the contractor's GitHub repository and disabling their access to CISA systems. Through analysis of log files, CISA confirmed that no authorized use of the leaked credentials was found and that "no customer or mission data was exposed."

The agency updated passwords in all development environments the contractor had accessed, not just the leaked ones; it also rotated the leaked cloud access keys, but acknowledged that the process took "longer than expected" due to "the complexity of CISA systems and interconnectivity with federal and industry partners." Additionally, CISA "adjusted allow and deny lists for code repositories" and blocked personnel from uploading data to public repositories to prevent future leaks.

Lessons learned from the leak

Much of the report describes how the incident highlighted CISA's strengths and weaknesses in response. CISA noted that comprehensive logging allowed it to rule out credential misuse and intrusion, but organizations still need to continuously improve log coverage and granularity. "To this end, CISA strategically identified additional logging opportunities during incident response and has implemented these enhancements to increase visibility."

The exposure of cloud access "secrets" (such as AWS security keys) reflected a clear lapse in CISA's security oversight, which the agency acknowledged. "No repository should contain secrets, but secrets still made their way into CISA's private repositories," CISA said. "CISA has rotated all secrets and developed an action plan to improve developer secrets management and strengthen monitoring for future secret exposure."

CISA has for years urged organizations to develop response plans for different types of incidents. However, despite this advocacy, CISA itself did not have a plan for a GitHub cloud leak. As a result, the agency said it "had to spend time developing a plan" in the early stages of the incident.

Furthermore, although CISA officials often emphasize how easy it is to report cybersecurity incidents to the agency, the public disclosure of this GitHub leak—which stemmed from the security researcher who discovered it being unable to contact CISA and turning to the media—highlighted CISA's shortcomings in establishing clear reporting channels. "To reduce ambiguity, CISA is refining its reporting channels so researchers can submit reports more easily and quickly," the agency said.

In detailing its response to the GitHub leak, CISA indicated it hopes other organizations will be equally candid when facing similar situations. "Cybersecurity incidents are not a matter of 'if' but 'when,'" CISA said. "It is critical for the entire cybersecurity community to address these issues openly to strengthen trust and promote transparency."