State auditors find cybersecurity risks at Oregon Department of Consumer and Business Services
Inspite of prior warnings, a point out company overseeing crucial features these kinds of as implementing employee protection has failed to acquire primary cybersecurity steps intended to hold sensitive details and facts know-how units secure, state auditors mentioned Tuesday.
Auditors from the Oregon Secretary of State’s business uncovered the Office of Consumer and Enterprise Services requires to do a greater position examining stability threats and getting steps to cut down people threats, need to make guaranteed 3rd-bash pursuits are safe and doc its procedures and processes for maintaining information and facts and devices safe.
The shopper- and small business-oriented agency is a large, with around 900 comprehensive-time workforce. It has a selection of responsibilities, from imposing worker protection via OSHA to overseeing the condition internet site where you can buy a overall health coverage system.
Comparable troubles found for the duration of the audit have been observed in advance of: in 2016, by condition auditors, and in 2018, by a department of the state’s govt IT business overseeing cybersecurity. At the time, these results ended up shared with the company in private studies.
Without the need of plenty of personnel assigned to safety duties, auditors explained, “most essential actions are executed on an ad-hoc foundation,” which probably hinders the company from finding and responding to stability incidents.
Amid the results, auditors reported that the company doesn’t “actively manage” hardware products or program. That means undesirable actors could permit unauthorized units to access the department’s network or put in unauthorized application.
“The safety of Oregon’s information and facts resources should be a major precedence for all state agencies,” Secretary of Condition Shemia Fagan explained in a statement, including that the company “should choose quick action to deal with the findings outlined in this report.”
Andrew Stolfi, director of the Division of Consumer and Enterprise Solutions, claimed he welcomed the conclusions. Stolfi was appointed director in April 2020 and is also the state’s insurance commissioner, a function he’s held considering the fact that 2018.
Stolfi reported he is forming a committee to meet up with with employees at the company and retain track of the agency’s compliance with a approach to reply to the audit results.
“DCBS is entirely dedicated to continuing to enhance its stability stance, secure point out systems and info, and minimize possibility,” Stolfi said.
The company has not experienced any cybersecurity incidents that have led to details breaches or “significant technique outages” in the earlier five yrs, Stolfi mentioned.
In February 2014, many news outlets documented DCBS was investigating leaks of personal information at Cover Oregon, the state’s troubled wellbeing coverage marketplace, which folded later that calendar year.