Đang tải bảng tin…
Krebs on Security0 Hot0 bình luận4 phút đọc
Lessons Learned from CISA’s Recent GitHub Leak – Krebs on Security
CISA published a postmortem on a data leak where a contractor exposed 844 MB of sensitive credentials — including AWS GovCloud keys and plaintext passwords — in a public GitHub repository for nearly six months. GitGuardian sent nine automated alerts that went unanswered before KrebsOnSecurity intervened. Key lessons include: maintaining mature key rotation capabilities, establishing clear incident reporting channels separate from product vulnerability disclosure, and continuously scanning public code repositories for exposed secrets rather than relying on periodic audits. CISA's zero-trust logging helped confirm no customer data was accessed. GitGuardian's Guillaume Valadon praised CISA's transparency, calling it the first time a national cybersecurity agency publicly advocated for secrets scanning and simplified researcher relations.
Nguồn: https://krebsonsecurity.com/2026/07/lessons-learned-from-cisas-recent-github-leak. 8 Sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
