Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:50 PM
Connect Directly

Election Security: Recovering from 2016, Looking Toward 2020

Researchers publish the results of a four-year investigation and discuss whether the US is ready to secure its largest elections.

Months away from another presidential election, many wonder whether the United States has the protections and processes in place to secure its most important elections. Research shows 2016 was a wake-up call of sorts, prompting federal, state, and local officials to work together.

Cisco Talos researchers began a long-term investigation into election security issues following the 2016 breach of the Democratic National Committee's servers. Four years of research are summarized in a new report, which encompasses the elements of US election infrastructure, the complex role of political theory, the progress made since 2016, and the work that still needs to be done to protect elections.

"The big thing was just how complicated the field of play is here," says Matt Olney, director of threat intelligence and interdiction with Cisco Talos. The factors in an election-focused attack range from the federal government, which has a limited role in elections but an outsize role in terms of intelligence and capabilities, to the local level, where people sign on to help with elections and find themselves in the crosshairs of advanced and highly targeted cyberattacks.

Researchers say the attackers' primary motivation is to undermine not only the core integrity of individual elections but the faith and trust people have in state institutions to fairly run them.

This is more than a technical problem, Olney says; it's a public perception problem. Officials also must consider how they can technically secure elections in a way that reinforces their community's faith that they're doing their job well. Adversaries understand how they can weaken the trust between people and government, reducing officials' ability to address issues.

"It's a play to reduce the ability for the US to react and affect work affairs," Olney explains.

In the report, Talos researchers detail various parts of election infrastructure and how officials should approach their security. Election management systems (EMSs), for one, coordinate the roles of the states and localities, and may include jury pool management, voter registration, ballot management, and election reporting. The EMS is a high-profile target for attackers because it's an accepted way for localities to change the voter registration database, the researchers report.

Voter registration databases — central databases holding registration information about voters — have been targeted in the past and are expected to be in the crosshairs going forward. 

The biggest improvement made between 2016 and 2020 is the growth of information sharing, says Olney. The Cybersecurity and Infrastructure Security Agency has taken on a role as a "security focal point" for the federal government. The agency has begun to offer phishing tests and vulnerability scanning; its staff members have flown to different states to provide support and share their understanding of security threats.

Information sharing goes both ways, Olney explains. The creation of the Election Infrastructure ISAC (EI-ISAC) "has been critical" in terms of pulling information into a centralized location to better understand the threats that states and localities are facing. EI-ISAC has deployed Albert intrusion detection and flow analysis systems to state and local authorities, the report states.

"The most important relationship, really, in election security is that state and local bond," he says. "Ultimately, the things that are being attacked are part of the state and local networks." Because states and localities cannot face state-sponsored actors alone, this collaboration, and the communication of efforts to voters, are essential to protect the integrity of US elections.

Related Content:



Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Ninja
7/20/2020 | 1:13:06 PM
Mail-In Voting, Pandemic, Postponement
While presently mail-in voting is only a reality for a subset of states doesn't it make sense that instead of endangering the lives of citizens of this country that we postpone the election until after this global crisis is resolved?

That or more heavily invest in alternative methods of voting that don't involve a physical presence.
User Rank: Guru
7/21/2020 | 9:16:49 AM
Re: Mail-In Voting, Pandemic, Postponement
As a Security expert I am well versed in Risk Analysis and the fact of the matter is that it is still more dangerous to drive a vehicle in the US than the risk of dying from COVID-19.  Prior posters suggest that mail-in ballots need to be required to keep people safe, that poster needs to realize that at this point there is little to nothing the government can do to keep everyone safe. COVID is out there and it now has a documented risk factor, it is everyone's personal responsibility to manage this risk for themselves.  Back to my initial statement we never forced mail-in ballots in the past because it was to dangerous to drive to the polls, so why would we now all of the sudden be worried about people going to the polls.  I guess in summary with all of the threats out there COVID is not the biggest threat in the world at this time.

User Rank: Strategist
7/20/2020 | 6:40:55 PM
Fair elections
Require ID cards to secure a punch ballot and ink stain finger of voter. Anything else invites voter fraud - just ask the Democrats in Chicago how easy it has been to cast fraudulent ballots for decades. The more digital the greater the fraud - it's that simple.
User Rank: Strategist
7/20/2020 | 6:43:19 PM
DNC server hack
Let's get the facts straight...just ask Seth Rich....oops we can't.
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-24
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
PUBLISHED: 2021-06-24
Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allowed to supply the pa...
PUBLISHED: 2021-06-24
SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.
PUBLISHED: 2021-06-24
Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service and p...
PUBLISHED: 2021-06-24
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.