[{"_1":2,"_88":-5,"_89":-5},"loaderData",{"_3":4,"_26":27},"root",{"_5":6,"_17":10,"_18":19,"_20":21,"_22":10,"_23":-5,"_24":-5,"_25":10},"user",{"_7":8,"_9":10,"_11":10,"_12":-5,"_13":-5,"_14":15,"_16":-5},"roles",[],"isAuthenticated",false,"isPremium","planName","subscriptionStatus","featureFlags",{},"insightsBudget","isDevelopmentHost","userPreferences",{},"recaptchaSiteKey","6LcvOJcUAAAAAHsB-gPGfGktcRlKpH7OTIU_dMTD","isImpersonating","impersonation","affiliateStatus","isFreedomPortal","routes/v2/article/layout",{"_28":29,"_30":31},"notFound",true,"relatedArticles",[32,76],{"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},"mediaId",6261990,"mediaKeyId","3117253-1bbf4b929cc57c0a7580309c74354b13","parentId",3117253,"title","State cybersecurity chief outlines defenses, staffing needs and ransomware strategy","audioSeconds",535,"startMs",2073000,"endMs",2608000,"viewUrl","/Search/View?dp=1&key=3117253-1bbf4b929cc57c0a7580309c74354b13&start=2073&end=2608","thumbnailUrl","https://assets.pipeline.soar.com/3117253-1bbf4b929cc57c0a7580309c74354b13/thumbnail_2073000.jpg","articleUrl","/articles/6261990/Oregon/State-cybersecurity-chief-outlines-defenses-staffing-needs-and-ransomware-strategy","mediaUrl","https://secure.pipeline.soar.com/6261990-ffa84f68a1db9a1f4165f01c7b49254e/orig.mp4?Expires=1774931526&Signature=mwNGdcB1M64wH7SYgRGjL-wvN-rmOO~E1B~HUHsnWyfQ~ssK6n-wlEk4laPFuh4p2v-B25N0qeMqpvqqfjMNEXCozK-ShaGOManntHLTn9miiV2qXnuJ1lEU0ZdiKf5VD4L1-lk1mih66AnY1B05ul3pM47ksScgI0EsS92Q2rTEWX2EUYfLDfhCeREq4kiEbvyqKNih-SqwZ8Jc4GJd~mGFnU0Zd8QxfNYYs6KdFpd3CO0zXso-af5DrACNbo5p7g0gdwBCUW29WH-ZX6KXenM9JUyEpekGgpg1JIYfdFcE-07KXGH6HOsuUE~xw58VOr14lD9eDWQzZqf5jT4CSQ__&Key-Pair-Id=KUT5TJCACFTXG","author","Oregon State Legislature","date","2025-04-24T00:00:00Z","article","Ben Groszgeir, the State Chief Information Security Officer and Director of Cybersecurity Services in Enterprise Information Services, told the General Government Subcommittee that the state has built multiple defensive capabilities but still has staffing and coverage gaps that need funding.

Groszgeir said Enterprise Information Services’ cybersecurity organization includes about 64 FTEs across six service verticals and that the state security operations center (SOC) has roughly 12 people who “are looking at the glass” during a daytime 12-hour shift. He said the state is working toward fuller 24/7 active monitoring and asked the committee to consider funding for a managed 24/7 service so people — not only automated tools — can triage alerts overnight.

On threats and tactics: Groszgeir described four high-level attacker categories — nation-state actors, financially motivated ransomware groups, insider threats and criminal hackers — and said bad actors are adopting AI to scale automated attacks. “If you have an automated bot attempting [phishing], it could be in millions. And one of them will succeed,” he warned. He listed phishing and social engineering as the top recurring vectors and said the agency tracks credential compromise closely.

Ransomware and recovery: Groszgeir said state infrastructure uses immutable backups to avoid paying ransoms and to restore systems after incidents. “Ransom payments are not in our books,” he said, and described immutable, air-gapped backups at the state data center. He urged agencies to verify their own backups are recoverable and immutable.

Statistics and scope: In his briefing Groszgeir cited published industry statistics — for example, identity-related breaches and ransomware targeting are widespread — and said the state sees daily attempts. He noted that the majority of successful attacks target the United States and that attacks often occur at night when staffing is reduced.

Capacity, supply chain and priorities: Groszgeir raised supply-chain risk (third-party vendors and contractors) as a significant and ongoing concern and said the state is inventorying vendors and connectivity to identify risk and require attestations. He described other ongoing initiatives including enterprise identity and access management and work with Gartner on identity governance, endpoint management to bring 60,000+ endpoints into managed service and DDoS protections routed through cloud filtering.

Budget and staffing requests: Committee members asked whether existing staffing is sufficient. Groszgeir said the team needs additional funding to expand active human monitoring to 24/7 and to scale incident response capabilities. He noted challenges recruiting and retaining experienced cybersecurity analysts and said training and internships are part of his workforce plan.

Process and interagency boundaries: Groszgeir said his office has jurisdiction over most executive-branch agencies (about 81 agencies, boards and commissions) but that some offices — for example, the Secretary of State, elements of the Department of Justice, Treasury and the judiciary — maintain separate authority; he said they nonetheless coordinate on shared standards and sometimes serve on advisory groups.

The presentation was informational. Committee members thanked agency staff and said the budget committee will weigh the requests for expanded monitoring and identity governance work as it considers expenditures.","mediaType","Video","parentTitle","Joint Committee On Ways and Means Subcommittee On General Government 04/24/2025 8:00 AM","oneSentenceSummary","Ben Groszgeir, State Chief Information Security Officer, briefed the General Government Subcommittee on Oregon’s cybersecurity posture, describing the enterprise SOC, staffing levels, threats (including AI-assisted attacks), and the need for funding to reach full 24/7 monitoring and other initiatives.","taxTitle","General Government, Ways and Means, Joint, Committees, Legislative, Oregon","taxId",18636,"location","Oregon","headline","","shortSummary",{"_33":77,"_35":36,"_37":38,"_39":78,"_41":79,"_43":80,"_45":81,"_47":82,"_49":83,"_51":84,"_53":85,"_55":56,"_57":58,"_59":86,"_61":62,"_63":64,"_65":87,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6261994,"State IT officials outline AI action plan, stress human oversight and privacy",1760,71000,1831000,"/Search/View?dp=1&key=3117253-1bbf4b929cc57c0a7580309c74354b13&start=71&end=1831","https://assets.pipeline.soar.com/3117253-1bbf4b929cc57c0a7580309c74354b13/thumbnail_71000.jpg","/articles/6261994/Oregon/State-IT-officials-outline-AI-action-plan-stress-human-oversight-and-privacy","https://secure.pipeline.soar.com/6261994-8be0bbdd2a8acd72307dcbb1a6144172/orig.mp4?Expires=1774931526&Signature=IS9gIz-VjnljOlU8Fbq0WbMvO6mf-PK6cjDYmjHSjkbj6FVvSbGvRGfgrfugDa989QAz41dbvhECjBohnWER75JysF6E74YcVqKFWXtrf833-kyfNX-A9AJXM0zRMJzgSFpXsJs4WiTNTyITNdPm11HDXqF3UYrQK1p0ktRjekXRlbBcj7cDZ5hSA43oiEK3Sbems-eA6y2MuqBnD-rApBmtnRYfCdcAyFIMp3DSbHOHoAfCmv9WI02VQq539zaYwqf49g0e-J2SOF7XjzKQEuDIIahhvdpnX7zAugjKpRsMqYpxI1CAKC~Zq53TWGhH2eDkirp7qn935s-2e8yxIQ__&Key-Pair-Id=KUT5TJCACFTXG","State Chief Information Officer Terrence Woods told the General Government Subcommittee of Ways and Means that an executive order-driven AI task force produced a comprehensive action plan to guide how the executive branch uses artificial intelligence.

Woods said the document — “about 70 plus pages” — lays out recommendations including human oversight, data-ethics checks and privacy protections. “AI obviously needs data more than data needs AI,” Woods said, adding that the state’s approach will limit data access to what is necessary and minimize unnecessary exposure.

The action plan grew from a year-long task force that included representatives from the Department of Administrative Services’ Enterprise Information Services (DAS EIS), the governor’s office and legislative members. Woods said the plan is grounded in 12 guiding principles and five executive actions, and recommends publishing agency use cases, creating deployment documentation, and developing a reference architecture or blueprint for AI adoption. “We aim to foster a responsible AI ecosystem that enhances government efficiency, accountability, and public trust while upholding the highest standards of privacy and ethical integrity,” he said.

Why it matters: Committee members pressed officials on workforce impacts, oversight, environmental costs and intergovernmental coordination — issues that determine how, and how quickly, agencies can adopt AI. Representative Thuy Tran asked directly whether the state intends to replace employees; Woods replied that the governor’s direction is to use AI to enhance, not replace, the workforce. “We’re definitely not doing anything to try and replace humans or our workforce using artificial intelligence,” he said.

Key recommendations and safeguards in the plan include: public inventories of use cases, documentation and checklists for deployment; “human in the loop” governance; training for executive-branch staff and public-facing materials for counties, cities and residents; and stronger privacy leadership (Woods noted the state currently has a security officer and a data officer but not a chief privacy officer). Woods said some items in the plan will require funding to implement and that certain positions (for example, a chief AI officer or privacy officer) are dependent on position authority and budget approvals.

Comparisons and limits: Woods said the task force surveyed other states and found a range of approaches. “Some of them limit any artificial intelligence use case to $10,000,” he said, explaining those limits reflected other states’ risk appetites and a finding that roughly half of procurements do not meet expectations. He also said the state will restrict access from state-owned devices to high-risk external AI platforms — citing DeepSeek as an example of a platform the state would block from state equipment due to security concerns.

Interim guidance and next steps: Because agencies are seeking to use AI before the whole plan is completed, Woods said interim guidance was published last year and recently updated. Next steps he listed include updating that guidance, publishing the inventory of use cases as agencies submit them, minimum training requirements for the executive-branch workforce and continued cross-agency policy work.

Concerns raised: Committee members asked about environmental impacts of compute-heavy AI workloads (power and water usage), coordination with other states, and whether the plan accounted for sovereign nations and data sovereignty. Representative Chi Chi asked specifically about the plan’s environmental discussion; Woods said compute power and carbon footprint are addressed in the action plan. Representative Tran asked about training for staff to avoid accidental misuse; Woods confirmed workforce training is among the recommendations.

Process note: The briefing was informational; committee members did not take formal action on the plan during the session. Woods directed members to the presentations posted on OLISS and said the full action plan will be posted to OLIS on request.

The Subcommittee noted it would invite the CIO back for follow-up and to brief further on the implementation timeline and funding needs.","State Chief Information Officer Terrence Woods presented a 70+ page AI action plan to the General Government Subcommittee, emphasizing human oversight, data ethics, privacy and workforce training; officials said the plan is informational and will be rolled out with interim guidance and published use-case inventories on OLIS/OLISS.","actionData","errors"]

Article not found

State cybersecurity chief outlines defenses, staffing needs and ransomware strategy

State IT officials outline AI action plan, stress human oversight and privacy