CISA’s Ware resigns; is Director Krebs next out the door?

The Cybersecurity and Infrastructure Security Agency (CISA) in the Department of Homeland Security appears to be in the midst of a house cleaning.

Bryan Ware, the assistant director of the cybersecurity division at CISA, unexpectedly resigned today. And now Reuters is reporting that Chris Krebs, the director of CISA, expects to be fired by the White House today as part of a purge of political appointees who are considered not loyal to President Donald Trump.

Reuters also is reporting that the White House asked Ware to resign.

In a note to staff, obtained by Federal News Network, Ware wrote that his last day would be Nov. 13.

“It’s too soon,” he wrote. “We have done so much in the little time I’ve been here, and there is so much more to do! While I did not fully accomplish what I’d hoped, I have confidence in you, our plan and our mission. I know you will continue to execute, take risks and continue setting the course for our nation’s cyber defense.”

Emails to CISA asking for comment on Ware and Krebs were not immediately returned.

Sen. Mark Warner (D-Va.) said in a Tweet, “Chris Krebs has done a great job protecting our elections. He is one of the few people in this administration respected by everyone on both sides of the aisle. There is no possible justification to remove him from office. None.

Sen. Ron Wyden (D-Ore.) also praised Krebs in a Tweet.

“Under Chris Krebs’ leadership, CISA has been a trusted source of election security information. If Donald Trump fires him, it will suggest Trump is preparing to spread lies about the election from a government agency,” Wyden wrote.

The news about Krebs possible departure surprised several CISA sources.

One source said, “Loyalty to Krebs within CISA is extremely high, not sure I can offer an equivalent in all my years in government. He will be missed in ways not typical in our transient environment.”

The same source said Ware was well regarded too.

“Bryan was key as he told CISA that we are moving to the cloud. The key will be who follows Ware, and can that person keep the momentum of modernizing our capabilities,” the source, who requested anonymity because they didn’t get permission to talk to the press.

Another source said there had been some rumors or belief internally that Krebs may soon be on the way out, either by choice or otherwise. The source, who also requested anonymity, said Krebs and Matt Travis, the deputy director of CISA, had been “making a mad dash” to reorganize the agency over the last few weeks.

During his tenure, Ware, who joined the administration in December, said he’s proud of several accomplishments including the Cybersecurity Directorate 2025 strategy, which outlined short and near term goals. Ware said in June interview with Federal News Network that the changes happening to federal networks requires new approaches to security.

“Many of the ways that we’ve traditionally thought of our job where we put sensors out and what those sensors look like, and how we secure things is not as aligned with the way that enterprise IT and the mission are moving in the future. There’s a number of components of that long term strategy. One of those is to get to the place where CISA has as close to complete visibility as we can have of everything that’s happening in the .gov, but also we need visibility and what’s going on in industry and state, local, because our adversaries don’t really stay in just one camp or the other. We need a push for visibility and you think about the origins of CDM, departments and agencies got more visibility. Since it got reports and now we’re in an environment where we need to be quicker than that, we need to have more near real-time visibility and so adjusting the way the tools work, the way that the relationships work to get to the place where we can see that threat across the entire landscape and do a better job of delivering the appropriate control responses advisories, whatever that might be.”

Ware also highlighted the success of cyber shared services under the Quality Service Management Office (QSMO) and how CISA changed its hunt and incident response efforts to ensure training and bring in more innovation to scale their services.

“I am grateful for the opportunity to serve, though my time with you was limited,” he wrote. “I admire your drive, your perseverance and your commitment to the mission—it is critical.”

Cyberscoop first reported Ware’s departure.

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.