Auditors find cybersecurity risks at Department of Consumer and Business Services
Despite prior warnings, a state agency overseeing key functions such as enforcing worker safety has failed to take basic cybersecurity measures meant to keep sensitive information and information technology systems secure, state auditors said Tuesday.
Auditors from the Oregon Secretary of State’s office found the Department of Consumer and Business Services needs to do a better job assessing security risks and taking steps to reduce those risks, should make sure third-party activities are secure and document its policies and procedures for keeping information and systems secure.
DCBS is a large state agency, with roughly 900 full-time employees. It has a range of responsibilities, from enforcing worker safety through OSHA to overseeing the state website where you can buy a health insurance plan.
Similar problems discovered during the audit have been found before: in 2016, by state auditors, and in 2018, by a branch of the state’s executive IT office overseeing cybersecurity. At the time, those findings were shared with the agency in confidential reports.
Without enough staff assigned to security tasks, auditors said, “most critical activities are performed on an ad-hoc basis,” which potentially hinders the agency from finding and responding to security incidents.
Among the findings, auditors said that the agency doesn’t “actively manage” hardware devices or software. That means unauthorized devices could be accessing the department’s network, or unauthorized software could be installed.
“The security of Oregon’s information resources should be a top priority for all state agencies,” Secretary of State Shemia Fagan said in a statement, adding that the agency “should take immediate action to address the findings outlined in this report.”
Andrew Stolfi, director of the Department of Consumer and Business Services, said he welcomed the findings in a response to the audit. Stolfi was appointed director in April 2020, and is also the state's insurance commissioner, a role he's held since 2018.
Stolfi said he was forming a committee to meet with workers at the agency and keep track of the agency’s compliance with a plan to respond to the audit findings.
“DCBS is fully committed to continuing to improve its security stance, protect state systems and data, and reduce risk,” Stolfi said.
The agency hasn’t had any cybersecurity incidents that have led to data breaches or “significant system outages” in the past five years, Stolfi said.
In February 2014, the Statesman Journal reported DCBS was investigating leaks of personal information at Cover Oregon, the state’s troubled health insurance marketplace, which folded later that year.
Claire Withycombe is a reporter at the Statesman Journal. Contact her at cwithycombe@statesmanjournal.com, 503-910-3821 or follow on Twitter @kcwithycombe
Support local journalism by subscribing to the Statesman Journal.
This article originally appeared on Salem Statesman Journal: Oregon consumer, business agency faces security risks, audit finds
