Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

9/14/2018
10:30 AM
Jasson Casey
Jasson Casey
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
50%
50%

Cybersecurity Is Only 1 Part of Election Security

Protecting the 2018 election cycle means fixing the information infrastructure.

The DEF CON 2018 Voting Machine Hacking Village aimed to raise awareness in voting security through a full day of speakers and panel discussions along with a challenge for attendees to hack more than 30 pieces of voting equipment. A partnership with rOOtz Asylum offered youths between 8 and 16 years old an opportunity to hack replicas of the websites of secretaries of state to demonstrate that even hackers with limited years of experience can easily compromise critical systems. The goal was to break as many voting machine pieces as possible in order to draw attention to the vulnerabilities that will be present in the upcoming 2018 elections.

The focus on election equipment, however, ignores the greater danger caused by hacking into the diverse collection of sensitive information that flows through political campaigns and the electoral process, and using that to influence and sow distrust among voters. While changing a vote or voting results can be traced back to a particular stakeholder, changing people's understanding of facts is far more insidious.

What Security Risks Do Election Machines and Vendors Pose?
Election machines create two points of vulnerability. First, the voting machines provide a direct line to infiltrate and control votes, manipulating the election at its most basic level. Second, malicious actors can affect the integrity of the results just by planting the seed of potential tampering of election machines in the minds of voters, creating public distrust in the democratic process.

Third-party vendors typically are used to recording votes through one company, tally in another, and, possibly, aggregate in a third. Affecting the data integrity at any one of these vendors places the election results at risk.

What Is the "Election Ecosystem"?
The election ecosystem refers to state actors and the actual voter base along with think tanks, super PACs, political parties, election officials, lobbyists, and other invested groups. Voters rely on publicly available information to make their decisions, and this information needs to be secured.

The ecosystem presents a large attack surface and is a rich environment for exfiltrated data that could be used in an information campaign, such as compromising (in public) or coercing (in private) actors within the system.

What Types of Security Risks Exist within the Election Ecosystem?
Network security, DNS health, and patching cadence are the largest security concerns for governmental stakeholders.

Network Security
Many state and local governments leave their networks exposed to the Internet by not applying best practices to firewalls, intrusion-detection systems, packet-filtering routers, and advanced network threat-detection systems.

Endpoint Security
Exploit kits can be easily purchased on the Dark Web. They focus on outdated, insecure browser and operating systems to execute client-side exploitation attacks. While the federal government’s infrastructure budget increased, state and local governments remain underfunded. Most nongovernmental organizations continue to use outdated software to maintain compatibility with antiquated infrastructure, and the replacement cost for an entirely updated infrastructure outpaces their budget.

Patching Cadence
Most governmental stakeholders use outdated software and devices where patching updates may no longer be available. Additionally, underfunded IT departments get overwhelmed trying to maintain a regular patching cadence.

How Do Adversaries Use the Important Information They Siphoned?
They can use the information gained from specifically target individuals and organizations to coerce the campaign, or they release the information to swing public opinion to benefit their goals. Conspiracy theorists used John Podesta's spearphished emails to undermine his authority by spreading rumors across fake news sites and falsely connect high-ranking Democratic Party officials to a child-sex ring. Despite this theory being debunked, the information influenced the course of the election.

Even if the hacker’s candidate of-choice is not elected, the information's integrity becomes a distraction as authority figures are discredited, creating social and political instability. This pattern of information campaign sabotage is easily replicated. My last quarterly Center for Strategic International and Studies (CSIS) Cybersecurity fellows meeting was consumed with understanding where and when this will occur next. It is a leading conversation for security and policy professionals this year.

How Can We Protect the Election Ecosystem from the Biggest Risks?
Political information campaigns have existed for over 3,000 years. The cyber landscape makes espionage and information wars more efficient by removing physical proximity and access requirements. In Watergate, the malicious actors needed physical proximity and access to obtain the information. Today, they access information remotely, expanding the threat parameters.

Protecting the 2018 election cycle requires fixing the information infrastructure. Voters need to worry less about the election machines and more about the security of the organizations from where malicious actors obtain information. 

The vulnerabilities in state and local government security need to be addressed so that the indirect influence of hackers can be restrained. Additionally, nongovernmental organizations need help improving their cybersecurity posture.

However, none of the cybersecurity issues alone can protect the elections without finding a dampening solution for the use of social media as an accelerant to spread false information. Official government actors and private political stakeholders need to protect their data environments to begin rebuilding the trust that ensures election integrity.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jasson Casey serves as Chief Technology Officer at SecurityScorecard and leads the company's engineering efforts. Casey is an 18-year veteran of the telecom and computer networking industry. Most recently, he managed the engineering team for IronNet CyberSecurity, a security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9405
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
CVE-2020-9406
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVE-2020-9407
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
CVE-2020-9398
PUBLISHED: 2020-02-25
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2015-5201
PUBLISHED: 2020-02-25
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows r...