Credential Exposure and Critical Infrastructure Cybersecurity

Action: Recent reporting indicates that CISA-related credentials and sensitive materials were exposed through a publicly accessible cloud-based platform associated with a contractor.¹ While CISA has not stated that the exposure compromised sensitive data,² Congress has requested briefings on the incident.³ The reported exposure should prompt companies that own, operate, supply, or support critical infrastructure to review their cybersecurity governance, contractor oversight, cloud controls, software-development practices, and supply-chain resilience.

Trusted Insights for What’s Ahead^®

• CISA has identified 16 critical infrastructure sectors whose disruption, incapacitation, or destruction could undermine national security, economic stability, privacy, or public health.⁴
• Because most US critical infrastructure is owned, operated, supplied, or constructed by private companies, cybersecurity in these sectors is principally a business and governance responsibility, even as government agencies provide threat intelligence, standards, technical assistance, coordination, and incident response support.⁵
• The cost of cyber risk continues to rise for companies and the broader economy. Malicious cyber activity costs the US economy tens of billions of dollars annually, and global cybercrime costs are projected to continue rising sharply particularly with the rise of AI tools that can speed attacks.⁶ These risks are especially significant in critical infrastructure sectors because of the importance to business operations and the broader economy.
• Cyber risks can arise through multiple points across an operating environment, including contractors, code repositories, cloud credentials, development, and supplier practices. Critical infrastructure sectors often rely on complex networks of firms that may lack mature cyber defenses. Attackers frequently target these weaker links to gain access to higher-value systems, making supply-chain cybersecurity central to resilience.
• What this means for business
  • Particularly as cybersecurity needs have expanded to include all AI risks, businesses should manage cybersecurity as a core enterprise risk, with board and senior executive oversight tied to the current threat environment.
  • The specifics of the credential exposure should prompt review of credential and cloud. Organizations should audit repositories and developer tools for exposed passwords, API keys, cloud credentials, certificates, tokens, and other secrets; prohibit credentials from being stored in insecure ways; and promptly revoke or rotate exposed credentials.
  • Importantly, cybersecurity governance should extend to the entire ecosystem:  contractors, vendors, and supply chain partners. Critical infrastructure operators should review third-party access to sensitive systems, apply least-privilege access and multifactor authentication, require minimum security standards for critical vendors, and include suppliers and contractors in remediation plans.