Securing Voting Infrastructure before the Mid-Term Elections

© 2018 Denim Group – All Rights Reserved
Building a world where technology is trusted.
Securing Voting Infrastructure before the
Mid-Term Elections
John B. Dickson, CISSP
@johnbdickson

My Background
• Ex-Air Force Intel & Cyber Officer
• 20+ Year Security Professional
• Denim Group Principal
• Blogger Dark Reading Columnist
• Political Science Major

Denim Group | Company Background
• Trusted advisor on all matters of software risk
• External application & network assessments of voter registration
systems
• Threat modeling to identify areas of needed security improvement
• Managed security services
• Developed

Webinar Overview
• Mid-Term Election Cycle
• The Nature of the Nation State Threat
• Conventional Wisdom on Election Security
• Threat Modeling – Thinking Like an Attacker
• Shoring up the Election Infrastructure for the Mid-Terms
• Questions & Answers

Mid-Term Election Cycle

What Happened in 2016?

“We assess Moscow will apply lessons learned from its Putin-
ordered campaign aimed at the US presidential election to
future influence efforts worldwide, including against US allies
and their election processes.”
Source: Assessing Russian Activities and Intentions in Recent US Elections,
Intelligence Community Assessment, January 2017

• $380 million from Federal Government
• Might be an opportunity to apply lessons learned in 2016 and
perfect 2020 attack strategies
• 35 Senate seats, 435 House seats, 36 Governors offices
involved in this election cycle
• DHS Support
• Building partnership
• Sharing information
• Making available tools

Election Infrastructure
• Voter registration databases and associated IT
systems
• IT infrastructure and systems used to manage
elections
• Voting systems and associated infrastructure
• Storage facilities for election and voting system
infrastructure
• Polling places, to include early voting locations
• Source: DHS, https://www.dhs.gov/topic/election-security

“Voting systems and associated infrastructure”

Election Infrastructure does not include:
• Political action committees
• Campaigns
• Or any other non-state or local government election
related group
• Source: DHS, https://www.dhs.gov/topic/election-security

Yet….
• Campaigns

The Nature of the Nation
State Threat

Nature of a Nation State Threat
• Different types of threat actors
• Nation states, organized crime, hackavists
• Near unlimited resources and unparalleled technical
capabilities
• Typically combined with social engineering, disinformation,
and espionage
• Goals: state secrets, intellectual property, defense
technologies, undermining Western institutions

Nature of the Russian State Threat
• Influence Election Outcomes
• Undermine Faith in the US Democratic Process
• Undermine Faith in US institutions
• Undermine US-led Democratic Order
• SOW discord between US and its Traditional Allies

Conventional Wisdom of
Election Security

Conventional Wisdom of Election Security
• Election Security = Voting Machine Security

Threat Modeling =
Thinking Like an Attacker

Threat Modeling – Thinking Like an Attacker
Source: Department of Homeland Security Election Infrastructure Security Resource Guide

Threat Modeling – Thinking Like an Attacker
• A structured approach to analyzing an application
(or system) to identify, measure, and address the
cyber security risks associated with an application
• Reviewing Risk
• Impact (damage potential)
• Possibility of attack
• Ease of Exploit

IoT Threat Model
22

Shoring up the Election
Infrastructure for the Mid-
Terms

Potential Strategies
• Conduct vulnerability testing of known ”static”
voting resources like voter registration systems
• Provide rigorous training to election staff to identify
social engineering attempts
• Conduct anti-phishing training for key election
officials
• Review reporting entry point susceptibility to
Distributed Denial of Service (DDoS)

Potential Strategies
• Consider 2-factor authentication and other e-mail
defenses for state election officials
• Train election judges and local officials to identify and
report cyber attacks
• Review recovery plans for target ransomware attacks
• Educate campaigns on basics of cyber security
• Formalize relations with local press for to ID
disinformation activities

Final Thoughts
• View your systems from the perspective of an
attacker
• Identify and remediate most “Critical” and “High”
vulnerabilities that put your state at risk
• Leverage outside resources (EAC, NASS, MS-
ISAC, consultants etc.)

John B. Dickson, CISSP
@johnbdickson
www.denimgroup.com
Questions and Answers

Securing Voting Infrastructure before the Mid-Term Elections

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Securing Voting Infrastructure before the Mid-Term Elections

Similaire à Securing Voting Infrastructure before the Mid-Term Elections (20)

Plus de Denim Group

Plus de Denim Group (20)

Dernier

Dernier (20)

Securing Voting Infrastructure before the Mid-Term Elections