News & Commentary

9/14/2018
10:30 AM
Jasson Casey
Jasson Casey
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
50%
50%

Cybersecurity Is Only 1 Part of Election Security

Protecting the 2018 election cycle means fixing the information infrastructure.

The DEF CON 2018 Voting Machine Hacking Village aimed to raise awareness in voting security through a full day of speakers and panel discussions along with a challenge for attendees to hack more than 30 pieces of voting equipment. A partnership with rOOtz Asylum offered youths between 8 and 16 years old an opportunity to hack replicas of the websites of secretaries of state to demonstrate that even hackers with limited years of experience can easily compromise critical systems. The goal was to break as many voting machine pieces as possible in order to draw attention to the vulnerabilities that will be present in the upcoming 2018 elections.

The focus on election equipment, however, ignores the greater danger caused by hacking into the diverse collection of sensitive information that flows through political campaigns and the electoral process, and using that to influence and sow distrust among voters. While changing a vote or voting results can be traced back to a particular stakeholder, changing people's understanding of facts is far more insidious.

What Security Risks Do Election Machines and Vendors Pose?
Election machines create two points of vulnerability. First, the voting machines provide a direct line to infiltrate and control votes, manipulating the election at its most basic level. Second, malicious actors can affect the integrity of the results just by planting the seed of potential tampering of election machines in the minds of voters, creating public distrust in the democratic process.

Third-party vendors typically are used to recording votes through one company, tally in another, and, possibly, aggregate in a third. Affecting the data integrity at any one of these vendors places the election results at risk.

What Is the "Election Ecosystem"?
The election ecosystem refers to state actors and the actual voter base along with think tanks, super PACs, political parties, election officials, lobbyists, and other invested groups. Voters rely on publicly available information to make their decisions, and this information needs to be secured.

The ecosystem presents a large attack surface and is a rich environment for exfiltrated data that could be used in an information campaign, such as compromising (in public) or coercing (in private) actors within the system.

What Types of Security Risks Exist within the Election Ecosystem?
Network security, DNS health, and patching cadence are the largest security concerns for governmental stakeholders.

Network Security
Many state and local governments leave their networks exposed to the Internet by not applying best practices to firewalls, intrusion-detection systems, packet-filtering routers, and advanced network threat-detection systems.

Endpoint Security
Exploit kits can be easily purchased on the Dark Web. They focus on outdated, insecure browser and operating systems to execute client-side exploitation attacks. While the federal government’s infrastructure budget increased, state and local governments remain underfunded. Most nongovernmental organizations continue to use outdated software to maintain compatibility with antiquated infrastructure, and the replacement cost for an entirely updated infrastructure outpaces their budget.

Patching Cadence
Most governmental stakeholders use outdated software and devices where patching updates may no longer be available. Additionally, underfunded IT departments get overwhelmed trying to maintain a regular patching cadence.

How Do Adversaries Use the Important Information They Siphoned?
They can use the information gained from specifically target individuals and organizations to coerce the campaign, or they release the information to swing public opinion to benefit their goals. Conspiracy theorists used John Podesta's spearphished emails to undermine his authority by spreading rumors across fake news sites and falsely connect high-ranking Democratic Party officials to a child-sex ring. Despite this theory being debunked, the information influenced the course of the election.

Even if the hacker’s candidate of-choice is not elected, the information's integrity becomes a distraction as authority figures are discredited, creating social and political instability. This pattern of information campaign sabotage is easily replicated. My last quarterly Center for Strategic International and Studies (CSIS) Cybersecurity fellows meeting was consumed with understanding where and when this will occur next. It is a leading conversation for security and policy professionals this year.

How Can We Protect the Election Ecosystem from the Biggest Risks?
Political information campaigns have existed for over 3,000 years. The cyber landscape makes espionage and information wars more efficient by removing physical proximity and access requirements. In Watergate, the malicious actors needed physical proximity and access to obtain the information. Today, they access information remotely, expanding the threat parameters.

Protecting the 2018 election cycle requires fixing the information infrastructure. Voters need to worry less about the election machines and more about the security of the organizations from where malicious actors obtain information. 

The vulnerabilities in state and local government security need to be addressed so that the indirect influence of hackers can be restrained. Additionally, nongovernmental organizations need help improving their cybersecurity posture.

However, none of the cybersecurity issues alone can protect the elections without finding a dampening solution for the use of social media as an accelerant to spread false information. Official government actors and private political stakeholders need to protect their data environments to begin rebuilding the trust that ensures election integrity.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jasson Casey serves as Chief Technology Officer at SecurityScorecard and leads the company's engineering efforts. Casey is an 18-year veteran of the telecom and computer networking industry. Most recently, he managed the engineering team for IronNet CyberSecurity, a security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
5 Reasons Why Threat Intelligence Doesn't Work
Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
Why the CISSP Remains Relevant to Cybersecurity After 28 Years
Steven Paul Romero, SANS Instructor and Sr. SCADA Network Engineer, Chevron,  11/6/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19205
PUBLISHED: 2018-11-12
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
CVE-2018-19206
PUBLISHED: 2018-11-12
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
CVE-2018-19207
PUBLISHED: 2018-11-12
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
CVE-2018-1786
PUBLISHED: 2018-11-12
IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.
CVE-2018-1798
PUBLISHED: 2018-11-12
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...