Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

9/14/2018
10:30 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
50%
50%

Cybersecurity Is Only 1 Part of Election Security

Protecting the 2018 election cycle means fixing the information infrastructure.

The DEF CON 2018 Voting Machine Hacking Village aimed to raise awareness in voting security through a full day of speakers and panel discussions along with a challenge for attendees to hack more than 30 pieces of voting equipment. A partnership with rOOtz Asylum offered youths between 8 and 16 years old an opportunity to hack replicas of the websites of secretaries of state to demonstrate that even hackers with limited years of experience can easily compromise critical systems. The goal was to break as many voting machine pieces as possible in order to draw attention to the vulnerabilities that will be present in the upcoming 2018 elections.

The focus on election equipment, however, ignores the greater danger caused by hacking into the diverse collection of sensitive information that flows through political campaigns and the electoral process, and using that to influence and sow distrust among voters. While changing a vote or voting results can be traced back to a particular stakeholder, changing people's understanding of facts is far more insidious.

What Security Risks Do Election Machines and Vendors Pose?
Election machines create two points of vulnerability. First, the voting machines provide a direct line to infiltrate and control votes, manipulating the election at its most basic level. Second, malicious actors can affect the integrity of the results just by planting the seed of potential tampering of election machines in the minds of voters, creating public distrust in the democratic process.

Third-party vendors typically are used to recording votes through one company, tally in another, and, possibly, aggregate in a third. Affecting the data integrity at any one of these vendors places the election results at risk.

What Is the "Election Ecosystem"?
The election ecosystem refers to state actors and the actual voter base along with think tanks, super PACs, political parties, election officials, lobbyists, and other invested groups. Voters rely on publicly available information to make their decisions, and this information needs to be secured.

The ecosystem presents a large attack surface and is a rich environment for exfiltrated data that could be used in an information campaign, such as compromising (in public) or coercing (in private) actors within the system.

What Types of Security Risks Exist within the Election Ecosystem?
Network security, DNS health, and patching cadence are the largest security concerns for governmental stakeholders.

Network Security
Many state and local governments leave their networks exposed to the Internet by not applying best practices to firewalls, intrusion-detection systems, packet-filtering routers, and advanced network threat-detection systems.

Endpoint Security
Exploit kits can be easily purchased on the Dark Web. They focus on outdated, insecure browser and operating systems to execute client-side exploitation attacks. While the federal government’s infrastructure budget increased, state and local governments remain underfunded. Most nongovernmental organizations continue to use outdated software to maintain compatibility with antiquated infrastructure, and the replacement cost for an entirely updated infrastructure outpaces their budget.

Patching Cadence
Most governmental stakeholders use outdated software and devices where patching updates may no longer be available. Additionally, underfunded IT departments get overwhelmed trying to maintain a regular patching cadence.

How Do Adversaries Use the Important Information They Siphoned?
They can use the information gained from specifically target individuals and organizations to coerce the campaign, or they release the information to swing public opinion to benefit their goals. Conspiracy theorists used John Podesta's spearphished emails to undermine his authority by spreading rumors across fake news sites and falsely connect high-ranking Democratic Party officials to a child-sex ring. Despite this theory being debunked, the information influenced the course of the election.

Even if the hacker’s candidate of-choice is not elected, the information's integrity becomes a distraction as authority figures are discredited, creating social and political instability. This pattern of information campaign sabotage is easily replicated. My last quarterly Center for Strategic International and Studies (CSIS) Cybersecurity fellows meeting was consumed with understanding where and when this will occur next. It is a leading conversation for security and policy professionals this year.

How Can We Protect the Election Ecosystem from the Biggest Risks?
Political information campaigns have existed for over 3,000 years. The cyber landscape makes espionage and information wars more efficient by removing physical proximity and access requirements. In Watergate, the malicious actors needed physical proximity and access to obtain the information. Today, they access information remotely, expanding the threat parameters.

Protecting the 2018 election cycle requires fixing the information infrastructure. Voters need to worry less about the election machines and more about the security of the organizations from where malicious actors obtain information. 

The vulnerabilities in state and local government security need to be addressed so that the indirect influence of hackers can be restrained. Additionally, nongovernmental organizations need help improving their cybersecurity posture.

However, none of the cybersecurity issues alone can protect the elections without finding a dampening solution for the use of social media as an accelerant to spread false information. Official government actors and private political stakeholders need to protect their data environments to begin rebuilding the trust that ensures election integrity.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jasson Casey is the CTO of Beyond Identity, a passwordless identity management provider. He also serves as a Fellow in CyberSecurity with the Center for Strategic and International Studies (CSIS) and the National Security Institute (NSI). Previously, Jasson was CTO of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30174
PUBLISHED: 2021-05-11
RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.
CVE-2021-32544
PUBLISHED: 2021-05-11
Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks.
CVE-2021-32563
PUBLISHED: 2021-05-11
An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
CVE-2020-23369
PUBLISHED: 2021-05-10
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
CVE-2020-23370
PUBLISHED: 2021-05-10
In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML.