Election Security Newsletter Sign Up Page
Subscribe to the Monthly Election Security Newsletter
In This Issue
- See the latest election attacks in the Interactive Election Incident Map
- CyberDefenses's Perspective: Training could make all the difference.
- Learn what CIO's are learning as they jump into election security.
- See what CISA is doing to ramp up election security ahead of 2020.
- White House-mandated election security reports are in. What is in them?
- There is heightened focus on securing voting systems ahead of 2020. Learn more.
- What do state election officials want from the feds to secure elections? Find out.
- CyberDefenses Blog: Criminals Are Using County Websites to Stage Attacks.
- Sign up for the CyberDefenses Academy Election Security Training sessions.
- Find out which events should be on your calendar.
Interactive Election Incident Map
In this interactive map, we capture information about the latest election cybersecurity incidents as they occur. Stay informed of the most recent attack locations and methods so you're armed with knowledge that can help you protect your data and systems.
Training Has a Powerful Effect on Election Security
by Brian Engle, CISO and Director of Advisory Services
Cybersecurity attackers work pretty much like we all do – finding the easiest way to get the job done. You can have the most sophisticated security measures in place and use the most sophisticated technology, configured correctly and adherent to all regulations and policies, but if your team is not security-savvy, attackers will easily find the easiest path through the weakest link.
In too many cases, an election business can be compromised when an attacker tricks a volunteer or a staff member into sharing important information, such as their login credentials to a critical system. Once this happens, it’s game over. The threat actor now has a way to bypass every meticulously implemented defense.
Unfortunately, the methods of going through human gatekeepers to infiltrate parts of the election business are becoming even more sophisticated. Using social engineering like a well-orchestrated phone call or carefully crafted and convincing phishing emails attackers lure unsuspecting workers to open doors without even realizing it’s happened.
The adage that we can only control what we can control holds true in this case, and while it can be disheartening and discouraging, it also offers some hope too. We may not be able to control the actions of other people, but we can arm them through education, provide them with knowledge, and influence positive behaviors.
Elevating the importance of election security education and training can go a long way in improving election security. When the entire election team understands their role as gatekeepers in keeping the election technology, environment and process protected against cyber criminals, they form a powerful line of defense.
Here are some of the key things you can focus on when shaping your team’s security understanding:
- Knowing what motivates attackers
Understanding what cyber criminals want to achieve can help election staffers and volunteers inherently know what needs to be protected.
- Combine curiosity and skepticism in delivering friendly customer service
Our staff members aim to be as helpful as possible. It's what makes them good at their jobs, and sadly what attackers rely on. Teach your team to ask questions and use curiosity to make sure attackers have to work harder to trick us. Friendly push back and asking "why" can sometimes be the best defense for social engineering attacks.
- Being familiar with your Incident Response Plan
Ensure that everyone knows how to identify an attack, how to report it and how the entire organization will respond, including communicating to the media and public.
This is only a partial list, but it is a start in the right direction. Security can’t be isolated to technology, and responsibility can’t remain with only a few people. It takes the whole team of human gatekeepers to stop the attackers we face. Security must be part of everyone’s job responsibilities because attackers can target anyone.
CIOs Recruited for Election Security Find a Familiar Challenge, NASCIO President Says - State Scoop
Improving the cybersecurity of state election systems has until recently been primarily the domain of secretaries of state, election directors and officials from the U.S. Department of Homeland Security. But chief information officers are increasingly playing a role in election security, Delaware CIO James Collins said at a National Governors Association conference.
CISA Says Its Ramping Up Election Security Efforts for 2020 - FCW
Cybersecurity and Infrastructure Security Agency Director Chris Krebs hosted a conference call with reporters less than 24 hours after The Daily Beast published a story that quoted multiple anonymous DHS officials who said two CISA task forces focused on coordinating the department's response to foreign influence in U.S. elections were significantly downsized shortly after the mid-terms."
White House-Mandated Election Security Report Complete - Politico
DOJ and DHS wrapped a report on whether midterm election hacking occurred as required under an executive order. The report must detail how any foreign attacks on election infrastructure might or might not have affected outcomes, parties or candidates. It also must include recommendations on “remedial” actions.
House Panel Focuses on Securing Voting Systems Ahead of 2020 - Meritalk
With the 2020 election cycle already underway, election security has been a hot-button issue both for the Federal government as well as states and localities across the country. The subcommittee heard from both academic experts and state election leaders who shared their thoughts on struggles facing the U.S. election systems and ways the country can shore up election system cybersecurity.
State Election Officials Seek More Security Money, Fewer Mandates - FCW
State election officials want Congress to deliver more funding for election security with fewer strings attached. At the National Association for Secretaries of State annual winter conference, Alabama Secretary of State John Merrill asked authors of the Secure Elections Act to be open to the idea of block granting federal funds for equipment upgrades "through applications from the states who know our states, our counties and our communities best."
2020 Election: URL Hijacking Could Be a Serious Issue
by Monty St John, Director of Cyber Intelligence, CyberDefenses
Staging attacks on county websites is a perfect example of a way to employ 90% truth, but 10% lie to affect an election. What if the URL for the site your voters are visiting is one almost indiscernable character off from the official site address? Would your voters notice? Cyber criminals are betting that they won't notice and can replicate your site almost exactly with a few strategic, misleading facts sprinkled in to confuse voters and achieve results like weakening voter turnout
April 24 - 25
Virginia Beach, VA
April 24 - 28
Round Rock, TX
May 1 - 2