CISA worker says 100-strong red team fired after DOGE cancelled contract

HELLFIRE

Usual preface, sharing strictly and solely from a security interest POV to the exclusion of everything else : https://www.theregister.com/2025/03/12/cisa_staff_layoffs/
From a security POV, what’s that old saying about penny-wise and pound-foolish?

… “On Friday, February 28, 2025, at 1600 hours, the government contract I supported with CISA (Dept of Homeland Security) was terminated due to DOGE," senior penetration tester Christopher Chenoweth wrote on LinkedIn. … DOGE’s “wall of receipts” listing contracts it has cancelled hasn’t been updated since March 5, but lists 86 deals axed at CISA’s parent, the Department of Homeland Security. The Register reviewed the list and can’t find one obviously related to penetration testing. Someone with Chenoweth’s experience – he’s a former Marine who’s worked in infosec for 20 years - shouldn’t struggle to find a new gig. Chenoweth wrote he’s now keen on “DOGE-resistant opportunities.” … Meanwhile, the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) – which is part of the government-funded Center for Internet Security organization and advised American election officials, and voting machine makers, about democracy-menacing cyber-threats – has seemingly shut down. “Due to the termination of funding by the Department of Homeland Security, the Center for Internet Security no longer supports the EI-ISAC,” its now-wiped website reads. …

Regards

egeezer

HELLFIRE
I would be interested to see what arrangements are being made to perform the functions of the cyber-security and information sharing of election related infrastructure.

digitalfutur

HELLFIRE One positive, or negative aspect, depending on one’s viewpoint, of the indiscriminate nature of the workforce reductions, is that if anything negative happens, the current administration will not be able to credibly blame others. Kinda hard to make that stick if there’s few or no experienced people left to manage the process.

A smart manager would have foreseen this, but one-dimensional thinking obviates such intelligence.

HELLFIRE

HELLFIRE From a security POV, what’s that old saying about penny-wise and pound-foolish?

Request MODS close this thread as the topic appears to be irretrievably lost. I thank everyone for their varied but civil inputs to date.

Regards

broknsymetry

SMH

Rook

CISA right now: 🙈 and hoping for the best.

broknsymetry

egeezer I think that is the problem - there isn’t any anymore.

Astyanax

I’d love to post something but I won’t. 😉

Kathy_9

From CISA’s website.

https://www.cisa.gov/news-events/news/statement-cisas-red-team

CISA’s Red Team is among the best in the world and remains laser focused on helping our federal and critical infrastructure partners identify and mitigate their most significant vulnerabilities and weaknesses. This has not changed.

Contrary to inaccurate reporting, CISA has not “laid off” our Red Team. CISA has taken action to terminate contracts where the agency has been able to find efficiencies and eliminate duplication of effort. As good stewards of the taxpayer dollar and in accordance with good fiscal governance practices, CISA regularly reviews contracts across the agency to ensure that we have the capabilities that we need and that we are allocating resources in ways that make the most impact. This was a contract action that did not impact the employment status of CISA personnel.

CISA’s Red Teams continue their work without interruption. The team works directly with network defenders, system administrators, and other technical staff to address strengths and weaknesses across critical infrastructure networks and systems. They continue to assist organizations in refining their detection, response, and hunt capabilities to protect the nation’s critical infrastructure from a range of threats.

InternetJeff

Kathy_9

Thanks for the “rest of the story”, as Paul Harvey would say.
👍

Rook

“Contrary to inaccurate reporting…”

What about the reporting was inaccurate?

In any case, I’m sure the Red Team members are getting job offers from Russia and China.

Edited Flag Eliminated

HELLFIRE

…and FWIW, TheRegister put this up with respects to CISA’s statement : https://www.theregister.com/2025/03/13/cisa_red_team_layoffs/

… Red teams play an important role in fortifying an organization’s defenses. Composed of ethical hackers, they simulate cyberattacks that could be carried out by real-world adversaries. Defenses are then shored up to prevent these scenarios. It’s a widely used and respected method of improving cyber resilience. Often conflated with penetration testing, red teaming is different. Penetration testing involves probing specific systems for vulnerabilities that could be exploited by attackers and potentially used to carry out the attacks red teams attempt to simulate. … Also confirmed this week to be shut down is the Multi-State Information Sharing and Analysis Center (MS-ISAC), which was similarly tasked with informing responses to threats against local and national elections. It was originally reported by a few select media outlets, but CISA confirmed this week that the news was indeed true. The revelations were naturally received poorly by the security community, which has spoken out against the cuts in droves. …

TheReg’s comments has these bangers of a response :

My first thought to this:

“Purple alert! Purple alert!”

“What’s a purple alert?”

“Well, it’s like not as bad as a red alert, but a bit worse than a blue alert – sort of a mauve alert.”

And when the consequences eventually hit the fan, more of a brown alert.

“Step up to red alert!”

“Sir, are you absolutely sure? It does mean changing the bulb…”

Barring further tangible and verifiable information, I’ll simply leave things at that…

Regards

assailant

So the “red team” was not actually fired after all.
Check.

egeezer

assailant
This link cited by Hellfire provides clarification regarding de-prioritizing and workforce elimination
https://therecord.media/cisa-cuts-10-million-isac-funding

HFB1217

assailant

Semantics
“Fired” or “Termination of Contract” or “Removing of Duplication” or “Just Let Go” it’s all the same results the staff no longer Exists,
So Termination or Elimination for whatever reason means the Staff Positions and their Functions no longer exist.

EDITED to correct my DUH comment and the Image

Rook

It’s weird that CISA can’t be trusted to put out an accurate statement, but is trusted with America’s Cyber Defense.

Maybe they were too busy updating their Kaspersky software and ordering new Huawei communications equipment?
😃

egeezer

As someone who is involved with critical infrastructure security, I’d also be interested to see what specific measures will be taken to increase critical infrastructure security and information sharing with public and private stakeholders. If there are redundancies in a system, they should be supplementary but not necessarily duplicative.

Any reduction or consolidation should be preceded by a transition plan that does not interrupt or degrade existing functions or capabilities. “Ready, fire, aim” will not result in positive outcomes.

HELLFIRE

egeezer “Ready, fire, aim” will not result in positive outcomes.

From a Security POV, I think we can all agree “you’re preaching to the choir here.”

Regards

egeezer

HELLFIRE
Those outside the security community may sing a different tune and have other priorities. That’s why it’s important to present recommendations based on security best practices in ways the layman can understand.

vaxvms

Asking for a friend… If the people who have been kicked in the butt are asked to return how much more will it cost the taxpayers to get them to return? Stepping outside the security interest POV… Will the ‘savings’ turn into a ‘loss’? Will DOGE include this in their reports?

egeezer

vaxvms
In a world where private sector jobs for qualified security professionals are in great demand, it would not be unreasonable for such an employee who was summarily fired without notice from an employer who displayed glee at the termination would choose not to go back to that employer.

I know if I were in such a position, the employer would not have a snowball’s chance in hell at getting me back at any price. Edit - add, my lovely bride would be on board with my decision 100% even if she had to work two jobs until I started work again with some other employer. 😃

Rook

I can’t imagine how re-hiring them would end up as a financial loss, even if the fired contractors are granted back-pay. The lost productivity would probably be the bigger problem.

vaxvms Will DOGE include this in their reports?

The Doge “reports” are so inaccurate right now they might as well be called propaganda: See How Elon Musk’s Team Inflated, Deleted and Rewrote Its Savings Claims

mmmdonuts

egeezer
Competent and qualified are in high demand because they are low in supply. Even a large dump from CISA is going yield a low percentage of candidates who meet the criteria.

egeezer

Rook
Those who are asked to return will be those most valuable to the mission. That would also be those most qualified in the security field, people with high level industry and GIAC certifications, experience, knowledge, and resumės that other employers would find valuable. Those people are highly marketable. I would not consider 100 or even 1000 layoffs of people at that level to be “flooding the market”.

Additionally, those who remain may likely be floating resumės for consideration after seeing the changes in employer attitudes and practices.

Astyanax

Rook

There’s just so much bureaucracy and waste to sift through it’s quicker and easier to just break everything at once taking down the good with the bad and picking back up and fixing the important pieces later to see what’s really needed. That’s what’s being done.