California confirms Vitaliy Panych as statewide CISO

Vitaliy Panych, who’s spent the last two years as California’s acting chief information security officer, was officially appointed to the CISO role this week by Gov. Gavin Newsom.

Panych told StateScoop he was recruited by the California Department of Technology in early 2019 to serve as deputy to then-CISO Peter Liebert, ensuring the state could enjoy continuity of security operations should Liebert resign. Liebert did resign that May, pushing Panych, who’d previously served as an agency chief information security and privacy officer at the California Department of Corrections and Rehabilitation, into the top role.

Vitaliy Panych

Having led the state’s cybersecurity operations through the pandemic, Panych said he has several major initiatives in mind heading into 2021. One of the largest, he said, will be expanding the capabilities of the California Cybersecurity Integration Center, which the state’s technology department operates in conjunction with several law enforcement and emergency services agencies. The center serves as a centralized threat intelligence hub, collecting and disseminating threat indicators and other information that can be used to repel cyberattacks.

In short, the center’s purpose is to ensure the state is “prepared for the worst,” Panych said.

“We really are setting ourselves up to be operationalized in that area so we can respond at any given time and be smart about it and cohesive about it so we’re not fighting an emergency of the moment,” he said. “We’ve actually had to put that into practice over the last six months as we’re operationalizing the team.”

Panych also said the state plans to enhance the center’s capabilities and expand its scope to assist more local government agencies throughout California in the coming year.

Panych said his department is also working on automating more of the state’s security, both for processes, like applications and system development, and for security compliance. He said the state develops a tremendous amount of code — almost one application every other day — and automating security audits on that code before it goes into production will make the state more secure.

For security compliance, he said, the state has traditionally relied upon manual “point-in-time” reviews of agencies’ controls and processes. But California is now shifting to continuous, real-time scanning of agencies’ networks, which can reduce the time they’re exposed to potential threats when vulnerabilities are detected.

“To date we’re conducting continuous monitoring over the networks of almost 140 departments,” he said. “We’re also onboarding most of those departments to monitor their internal networks.”