Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

3/29/2018
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

US Election Swing States Score Low Marks in Cybersecurity

C and D grades for Florida, Michigan, New Hampshire, Nevada, and Ohio, SecurityScorecard assessment shows.

Florida, Michigan, New Hampshire, Nevada, and Ohio each earned either C or D averages in their cybersecurity posture, according to new data from a security ratings firm.

SecurityScorecard in its annual report on US, state, and local government-sector security studied the states' state of security in endpoint, IP reputation, network, and patching, and found them seriously lacking. Florida and Ohio earned a C grade overall; New Hampshire, Nevada, and an undisclosed city in Michigan each scored a D average; and one unnamed county in Florida scored a C, while one in Ohio earned a D.

The grading system is based on SecurityScorecard's benchmarking platform, which aggregates data from millions of sensors across the Internet that gather and analyze public-facing security postures of IP addresses and identifiable software versions and services, and then maps them to organizations, including browser versions and patching cadence. "We're looking at what a hacker would look it" online, says Alex Heid, chief research officer at SecurityScorecard. The firm analyzed the security posture of 655 government agencies, each of which had more than 100 public-facing IP addresses.

Among the systems spotted in the analysis were state and local voter registration systems, many of which run older legacy software that contains common Web vulnerabilities such as SQL injection and remote code execution bugs, Heid says. But even if a malicious hacker were to detect and hack into one of those systems, it wouldn't necessarily affect the voting process, he says, even if he or she changed some names and information, because those systems typically have backups and lots of redundancy.

"The bigger risk is an innocuous Web app compromise on a server that is then used to pivot to the rest of the network behind the firewall," Heid notes. "If the voter registration server is on the same server as the county court system payments," for example, that would be exposed, he says.

The states' grades are based on a snapshot in time for the government agencies' security postures and doesn't necessarily mean those states are poorly secured or that any states with A's are secure. "It's fluid and indicates how they are doing at that time," he says. "Everyone has vulnerabilities and exploitable conditions. It's measured based on how quickly they respond to those conditions."

The fact that New Hampshire barely passed with a D doesn't mean elections held there are more hackable, for example, so the grades don't mean much in terms of the security of the 2018 elections, he says.

Dam Webcam
Among the exposed systems SecurityScorecard's study found was a city power plant server sitting on the public Internet that was accessible via a Web browser. "You see the dam's Web cam, and there's a big red button that says 'open dam,'" he says. The company contacted the site so it could remedy the exposure, he says.

Overall, government agencies score lower than most other sectors in endpoint security, network security, and patching cadence, according to the findings.

"Government has a lower grade, similar to university systems. It's not that they are bad at security," but more that governmental organizations typically have older systems in place and require more layers of approvals or patching and other updates, he says.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry's most knowledgeable IT security experts. Check out the Interop ITX 2018 agenda here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27885
PUBLISHED: 2020-10-29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s pass...
CVE-2020-25646
PUBLISHED: 2020-10-29
A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
CVE-2020-26205
PUBLISHED: 2020-10-29
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
CVE-2020-14323
PUBLISHED: 2020-10-29
A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.
CVE-2020-27886
PUBLISHED: 2020-10-29
An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available function of the includes/functions.php file (which is called by login.php).