State officials report stepped-up cybersecurity defenses, flag continued risks

Cochair Manning convened the Joint Committee on Information Management and Technology on May 23 for the statutory biennial cybersecurity reports required under state law following the 2016 legislation that created this reporting duty. Presenters from the Oregon Judicial Department, the Legislature, the Secretary of State’s office, the Oregon State Treasury, the Department of Justice and the state cybersecurity office summarized current posture, recent investments and continuing gaps.

The statewide theme from agency officials was upgraded detection and layered defenses paired with user training, but continued exposure from legacy systems, decentralized identity management and unpredictable external funding. "Cyber attacks keep increasing every year," Shane Walker, chief information officer for the Oregon Legislature, told the committee, urging agencies to keep legacy systems patched and staff trained. "We built a layered security architecture" was how Dan Teams, chief information security officer for the Secretary of State, described that office’s approach to monitoring and blocking malicious activity.

Why it matters: state agencies operate hundreds of mission-critical systems that serve millions of Oregonians and process high-risk financial and personal data. Committee members pressed officials on whether the partially decentralized model — with constitutional offices and the judicial branch outside an executive centralized IT…