Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:50 PM
Connect Directly

Election Security: Recovering from 2016, Looking Toward 2020

Researchers publish the results of a four-year investigation and discuss whether the US is ready to secure its largest elections.

Months away from another presidential election, many wonder whether the United States has the protections and processes in place to secure its most important elections. Research shows 2016 was a wake-up call of sorts, prompting federal, state, and local officials to work together.

Cisco Talos researchers began a long-term investigation into election security issues following the 2016 breach of the Democratic National Committee's servers. Four years of research are summarized in a new report, which encompasses the elements of US election infrastructure, the complex role of political theory, the progress made since 2016, and the work that still needs to be done to protect elections.

"The big thing was just how complicated the field of play is here," says Matt Olney, director of threat intelligence and interdiction with Cisco Talos. The factors in an election-focused attack range from the federal government, which has a limited role in elections but an outsize role in terms of intelligence and capabilities, to the local level, where people sign on to help with elections and find themselves in the crosshairs of advanced and highly targeted cyberattacks.

Researchers say the attackers' primary motivation is to undermine not only the core integrity of individual elections but the faith and trust people have in state institutions to fairly run them.

This is more than a technical problem, Olney says; it's a public perception problem. Officials also must consider how they can technically secure elections in a way that reinforces their community's faith that they're doing their job well. Adversaries understand how they can weaken the trust between people and government, reducing officials' ability to address issues.

"It's a play to reduce the ability for the US to react and affect work affairs," Olney explains.

In the report, Talos researchers detail various parts of election infrastructure and how officials should approach their security. Election management systems (EMSs), for one, coordinate the roles of the states and localities, and may include jury pool management, voter registration, ballot management, and election reporting. The EMS is a high-profile target for attackers because it's an accepted way for localities to change the voter registration database, the researchers report.

Voter registration databases — central databases holding registration information about voters — have been targeted in the past and are expected to be in the crosshairs going forward. 

The biggest improvement made between 2016 and 2020 is the growth of information sharing, says Olney. The Cybersecurity and Infrastructure Security Agency has taken on a role as a "security focal point" for the federal government. The agency has begun to offer phishing tests and vulnerability scanning; its staff members have flown to different states to provide support and share their understanding of security threats.

Information sharing goes both ways, Olney explains. The creation of the Election Infrastructure ISAC (EI-ISAC) "has been critical" in terms of pulling information into a centralized location to better understand the threats that states and localities are facing. EI-ISAC has deployed Albert intrusion detection and flow analysis systems to state and local authorities, the report states.

"The most important relationship, really, in election security is that state and local bond," he says. "Ultimately, the things that are being attacked are part of the state and local networks." Because states and localities cannot face state-sponsored actors alone, this collaboration, and the communication of efforts to voters, are essential to protect the integrity of US elections.

Related Content:



Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Guru
7/21/2020 | 9:16:49 AM
Re: Mail-In Voting, Pandemic, Postponement
As a Security expert I am well versed in Risk Analysis and the fact of the matter is that it is still more dangerous to drive a vehicle in the US than the risk of dying from COVID-19.  Prior posters suggest that mail-in ballots need to be required to keep people safe, that poster needs to realize that at this point there is little to nothing the government can do to keep everyone safe. COVID is out there and it now has a documented risk factor, it is everyone's personal responsibility to manage this risk for themselves.  Back to my initial statement we never forced mail-in ballots in the past because it was to dangerous to drive to the polls, so why would we now all of the sudden be worried about people going to the polls.  I guess in summary with all of the threats out there COVID is not the biggest threat in the world at this time.

User Rank: Strategist
7/20/2020 | 6:43:19 PM
DNC server hack
Let's get the facts straight...just ask Seth Rich....oops we can't.
User Rank: Strategist
7/20/2020 | 6:40:55 PM
Fair elections
Require ID cards to secure a punch ballot and ink stain finger of voter. Anything else invites voter fraud - just ask the Democrats in Chicago how easy it has been to cast fraudulent ballots for decades. The more digital the greater the fraud - it's that simple.
User Rank: Ninja
7/20/2020 | 1:13:06 PM
Mail-In Voting, Pandemic, Postponement
While presently mail-in voting is only a reality for a subset of states doesn't it make sense that instead of endangering the lives of citizens of this country that we postpone the election until after this global crisis is resolved?

That or more heavily invest in alternative methods of voting that don't involve a physical presence.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.