Full Report
Not everyone opposed the move, however, even as the board reviews the major Salt Typhoon telecom breach. The post Removal of Cyber Safety Review Board members sparks alarm from cyber pros, key lawmaker appeared first on CyberScoop.
Analysis Summary
This incident report focuses on the organizational and political fallout surrounding the Cyber Safety Review Board (CSRB), rather than a specific technical breach timeline. The primary event is the administrative action taken by the new DHS leadership against the board's membership, which is contextualized by the ongoing *Salt Typhoon* investigation.
# Incident Report: DHS Dissolves Cyber Safety Review Board Memberships Amid Salt Typhoon Review
## Executive Summary
The acting DHS Secretary issued a memorandum immediately terminating all memberships on departmental advisory committees, including the Cyber Safety Review Board (CSRB), which is currently investigating the "Salt Typhoon" telecom breach. This administrative action sparked alarm among cybersecurity professionals and key lawmakers concerned about the continuity and impartiality of the critical *Salt Typhoon* investigation, although some political support existed for the administration's prerogative to appoint new members.
## Incident Details
- Discovery Date: January 22, 2025 (Date of Memorandum issuance related to the administrative action)
- Incident Date: January 20/21, 2025 (Implied start date of the administrative action under the new administration)
- Affected Organization: Department of Homeland Security (DHS), specifically the Cyber Safety Review Board (CSRB) and the CISA Cybersecurity Advisory Committee.
- Sector: Government/Cybersecurity Regulation/Oversight
- Country: USA
## Timeline of Events
### Initial Access
- **Date/Time:** Monday (Date of memorandum issuance)
- **Vector:** Administrative Order via Memorandum.
- **Details:** Acting DHS Secretary Benjamine Huffman issued a memo terminating all current memberships on DHS advisory committees, effective immediately.
### Lateral Movement
*Not applicable as this is an administrative/political event, not a network intrusion.*
### Data Exfiltration/Impact
- The primary impact is the cessation or severe delay of the CSRB's ongoing review of the massive **Salt Typhoon** telecommunications breach.
- Fears raised regarding the politicization of the board and the potential for losing prior findings (e.g., the prior critical report on Microsoft's handling of a Chinese hacker breach).
### Detection & Response
- **How it was discovered:** News reports and public statements by lawmakers and cyber professionals reacting to the Monday memorandum.
- **Response actions taken:** Outgoing members were informed they could reapply for their positions under the new roster. Lawmakers expressed concern and called for the investigation to proceed expeditiously.
## Attack Methodology
This summary interprets the administrative action as the "attack" vector against the board structure itself:
- **Initial Access:** Executive/Administrative Authority (DHS Secretary Huffman memorandum).
- **Persistence:** The future structure and composition of the board are now uncertain, pending reappointments.
- **Privilege Escalation:** Not applicable in technical sense, but represents an assertion of executive authority over an oversight body.
- **Defense Evasion:** The swift nature of the termination bypassed typical consensus-building processes.
- **Credential Access:** Not applicable.
- **Discovery:** Not applicable.
- **Lateral Movement:** Not applicable.
- **Collection:** Not applicable.
- **Exfiltration:** Not applicable.
- **Impact:** Disruption and potential delay of a critical national security investigation (*Salt Typhoon*).
## Impact Assessment
- **Financial:** Not quantified in the source material.
- **Data Breach:** The *potential* impact stems from the delayed review of the **Salt Typhoon** breach involving major telecommunications companies.
- **Operational:** Disruption to the functioning and mandate of the CSRB.
- **Reputational:** Concerns raised by cyber pros and legislators about the stability and impartiality of federal cybersecurity review mechanisms.
## Indicators of Compromise
*Not applicable; this pertains to organizational change, not technical compromise.*
## Response Actions
- **Containment measures:** N/A (No technical incident).
- **Eradication steps:** Outgoing members were removed from their positions.
- **Recovery actions:** Outgoing members notified they could reapply for new seats, implying a restart or restructuring process.
## Lessons Learned
- **Key takeaways:** Administrative shifts, particularly under new leadership, can rapidly dismantle or restructure advisory bodies tasked with sensitive national security reviews.
- **What could have been done better:** Critics argue better stewardship would have involved preserving the existing, experienced CSRB membership to ensure rapid completion of the *Salt Typhoon* review.
## Recommendations
- **Prevention measures for similar incidents:** Ensure clear continuity protocols are established for critical incident review boards to prevent politically motivated disruption during sensitive ongoing investigations.
- **Policy Recommendation:** Legislative bodies emphasize the importance of maintaining experienced, non-partisan membership for bodies investigating critical infrastructure compromises like *Salt Typhoon*.