- Engineer — Plan: Audit Certificate Transparency logs (crt.sh) for unauthorized certificates issued against any domains your organization owns in .gh, .sl, or .as TLDs; if hits found, treat as active compromise and revoke/reissue. Broader takeaway: review certificate pinning posture for critical services.
- SOC/IR — Learn: Registry-level compromise enabling HTTPS certificate fraud is a novel MITM vector worth understanding, but the summary provides no IOCs, TTPs, or detection signatures to act on today.
- Leader — Plan: Determine whether your organization operates services or depends on vendors using .gh, .sl, or .as domains; if so, commission a CT log audit this quarter and confirm no traffic was intercepted. No immediate board action needed unless exposure is confirmed.