Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/9/2017
03:50 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

DHS Designates Election Systems As Critical Infrastructure

The Department of Homeland Security has deemed the nation's voting system as part of its critical infrastructure, citing security reasons.

The US Department of Homeland Security (DHS) has designated the nation's election system as part of its critical infrastructure, a status change it has been debating for the past few months.

There are 16 critical infrastructure sectors and 20 subsectors. In a statement issued Jan. 6, DHS Secretary Jeh Johnson explained why the US voting system will become a subsector of the Government Facilities critical infrastructure division.

"Election infrastructure is vital to our national interests, and cyber attacks on this country are becoming more sophisticated, and bad cyber actors -- ranging from nation states, cyber criminals and hacktivists -- are becoming more sophisticated and dangerous," he said.

This infrastructure spans all systems used to manage elections, including storage facilities, polling locations, and voter registration databases. As critical infrastructure, these are eligible for prioritized security assistance from the DHS, if requested.

Further, voting systems will be part of US efforts to improve incident response capabilities, as well as streamlined access to both classified and unclassified information shared by critical infrastructure operators.

Information sharing is a key benefit in this case, says Travis Farral, director of security strategy at Anomali and former elections judge in Texas. The United States' infrastructure for tallying votes is decentralized, which is a "double-edged sword" in terms of security.

"It's harder for someone to attack a single authority," he says, because voting systems are different in each state. "But when trying to dictate security for varying apparatuses, it's difficult for the federal government to protect all that."

The elevation to critical infrastructure will enable local and state election organizations to quickly share information and connect with the DHS to receive updates related to elections, security events, or the geopolitical environment, Farral continues.

It’s a benefit to local municipalities where funding is low and officials want to ensure the integrity of elections. The critical infrastructure designation will give them multiple resources to stay connected and receive a coordinated, streamlined flow of information.

Johnson noted many state and local officials were against the designation, due to concerns about federal takeover of local election processes.

He explained how the designation "does not mean a federal takeover, regulation, oversight or intrusion concerning elections in this country. This designation does nothing to change the role state and local governments have in administering and running elections."

Farral echoes this, noting how the power of election processes still resides with each state. Greater steps would have to be taken in order to change how elections are run.

However, the future is unclear.

"This may not be where things end," he notes, acknowledging the uncertainty of a new president and administration. "It's possible there may be additional changes, or some legislation in Congress designed to make more changes." Individual states may implement their own changes to improve election security, he adds.

This news arrived at a critical time for US cybersecurity. On the same day it was issued, the US Office of the Director of National Intelligence released a report explaining Russia's role in conducting cyberattacks to interfere with the US election.

This likely wasn’t by chance. "This announcement was probably timed to coincide with the release of the report, but it's hard to say for certain," says Farral.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15572
PUBLISHED: 2020-07-15
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
CVE-2020-8178
PUBLISHED: 2020-07-15
Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.
CVE-2020-8203
PUBLISHED: 2020-07-15
Prototype pollution attack when using _.zipObjectDeep in lodash <= 4.17.15.
CVE-2020-13923
PUBLISHED: 2020-07-15
IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04
CVE-2020-15695
PUBLISHED: 2020-07-15
An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.