Audit rips California’s cybersecurity watchdog over lack of oversight

SACRAMENTO, Calif. (CN) — Despite recent high-profile data breaches and years of warnings about lacking cybersecurity systems, California remains woefully behind on ensuring state agencies are protecting critical public information from hackers, a new audit warns.

A lack of oversight and transparency continue to plague the California Department of Technology which, according to state auditors, can’t confirm whether some of the agencies under its purview are up to date on information security standards.

“The department does not have a complete status of the state’s information security,” states the report issued Tuesday. “It has been slow to assess the information security development of high-risk entities through its oversight life cycle and has failed to proactively expand its capacity to do so.”

The report titled “State High-Risk Update Information Security — The California Department of Technology’s Inadequate Oversight Limits the State’s Ability to Ensure Information Security” comes as California remains a popular target of hackers and fraudsters.

Cyberattacks on California agencies have grown increasingly common during the pandemic.  

In 2020, criminals targeted University of California, San Francisco, epidemiologists working on Covid-19 cures and threatened to release records it had stolen from the university’s servers. To fend off the ransomware attack and regain the researchers’ data, the university sent the hackers $1.1 million worth of bitcoin.

Months later, an employee at the State Controller’s Office clicked on a malicious email link and unknowingly exposed reports containing names, addresses and Social Security numbers of Californians seeking to recover unclaimed property. The so-called “spear phishing attack” gave the intruders access to the employee’s emails for over 24 hours and uncovered the information of at least 9,000 people, the state later acknowledged.

State auditors have long been concerned about the Golden State’s susceptibility to cyberattacks, issuing six high-risk audits of the department and other agencies over the last decade.  

For example, in 2015 after finding 73 of 77 agencies surveyed weren’t compliant with security standards, then-state auditor Elaine Howle warned the “weaknesses” were jeopardizing Californians’ Social Security numbers, income tax and health records.

Over six years later, acting state auditor Michael Tilden has similar concerns.

In the 36-page report, Tilden found the tech department hasn’t been keeping up with security audits of the agencies it oversees. While individual agencies are ultimately responsible for their own information security, the department is supposed to assign security grades and put together a broad overview for the governor and Legislature.

Tilden claims the department last year neglected one of its most important objectives: compiling a comprehensive assessment and getting failing agencies up to par.

“Because the department was slow to complete compliance audits, it only calculated 18 of the 39 maturity metric scores it should have determined by June 2021,” Tilden said. “The information the department does have shows that reporting entities continue to perform below recommended standards, and have not improved over the last several years.”

The department, which oversees IT security for 108 agencies that report to the governor’s office, vehemently disagreed with Tuesday’s blistering assessment. In a response letter, the watchdog claimed the audit contains “misleading” data and “factual inaccuracies.”

Vitaliy Panych, the department’s chief IT officer, said responding to the pandemic took priority over the compliance audits in some instances and added the department recently launched a new “roadmap” to boost agencies’ cybersecurity levels.

“In the wake of the pandemic the cybersecurity threat landscape nearly quadrupled in the sophistication of attacks by nation-state adversaries and criminal rings targeting every layer of our critical infrastructure,” Panych said. “The department anticipated this threat, immediately scaled up and supported technology-based pandemic response and remote work enablement.”

A department spokesperson echoed Panych's response in an email, saying extra attention was required to help the state's pandemic fight.

"While we share the auditor’s prioritization of this issue broadly, we disagree somewhat with the auditor’s findings," the spokesperson wrote. "We believe we correctly prioritized cybersecurity response to mitigate threats we face in real-time to treat higher risks over cybersecurity compliance audit measures."

Meanwhile, Tilden defended the audit’s findings, saying the department couldn’t prove it postponed security audits due to the pandemic.

The audit also accuses the department of keeping lawmakers in the dark about the state’s cybersecurity troubles. Auditors found the department’s reports and presentations to legislators weren’t always thorough enough.  

“The Legislature lacks perspective on the significant weaknesses that exist in the state’s information security and thus cannot take appropriate steps to hold the department and reporting entities accountable,” the audit continues.

The audit recommends lawmakers force the department to submit an annual statewide IT security report, as well as mandate agencies not under the department’s umbrella issue their own individual updates to legislative committees. Furthermore, auditors say the department should make compliance audits a higher priority and clarify guidance for the increasing number of agencies shifting to telework.

Of the 20 state agencies surveyed that allow employees to work from home on their own devices, auditors found 15 didn’t require training on how to properly configure and secure the devices. More glaringly, eight agencies acknowledged they don’t have official telework policies.

Follow @@NickCahill_5