Cloud Hosting

How government is delivering better election security

While hostile nation-states, domestic misinformation campaigns and concerns about mail-in voting make it harder to ensure the security and integrity of the 2020 election, plenty of progress has been made on the cybersecurity front since 2016, experts say.

"While there are no guarantees in cybersecurity, I can assure you that the security defenses we have in place for 2020 are vastly improved over those in place a short four years ago," said John Gilligan, president and CEO of the non-profit Center for Internet Security (CIS) during an Aug. 28 House Homeland Security Committee hearing.

Much of that work has been done around improving vulnerabilities that were not only known but often exploited by Russian hackers in 2016, such as probing (and in some cases compromising) voter registration databases, phishing vendors who develop election management or voting software and running covert information operations on social media platforms that went largely undiscovered until after Election Day.

According to updated statistics from the Cybersecurity and Infrastructure Security Agency, tools and technologies have been put in place to respond to those weaknesses and monitor for cybersecurity threats.

In partnership with CIS, the agency has helped to deploy 276 Albert sensors across all 50 states, the District of Columbia and at least 222 local election networks. The sensors act as intrusion detection systems, monitoring network traffic on voter registration systems and other election software for signs of malicious probing or attacks by hackers.

CISA has conducted 131 remote penetration tests and 59 onsite risk and vulnerability assessments for local election infrastructure, and approximately 263 election officials around the country are receiving weekly vulnerability scan reports. The agency has also helped train thousands of election officials through online security courses, delivered "last mile" election information to more than 5,500 localities and provided trend analysis about risk and vulnerabilities and the latest threats to election infrastructure to the election community.

In addition to tools like Albert sensors, Gilligan pointed to endpoint detection and response programs that have been implemented by some election jurisdictions as well as domain blocking and reporting tools that prevent elections offices and computers from connecting to known malicious websites as examples of protections in place today that were virtually non-existent before 2016.

One thing election officials weren't counting on this year was a pandemic that threatens to deter millions of registered voters from safely casting their ballots in person. While many states have adjusted by moving to dramatically expand absentee (or mail) voting, they must contend with a surge of new voters who are unfamiliar with the proper procedure and disinformation from politicians and unscrupulous actors seeking to cast doubt on the reliability of mail-in ballots.

Amber McReynolds, CEO of the non-profit National Vote at Home Institute, echoed claims from other experts that voting-by-mail is no less safe or secure than other forms of voting. To the extent that there are unique risk considerations, such as those highlighted by a July vulnerabilityassessmentdone by CISA, they can be mitigated in part or in whole through voter education and awareness campaigns, as well as technologies like ballot tracking systems or analog procedures like risk-limiting audits for paper-based ballots that provide election officials with a trove of data to track and verify individual votes.

"No election system is perfect, and this is why it's critical to continually review and improve systems by enhancing security access transparency, particularly in this unprecedented time," McReynolds said.

A longer version of this article was first posted to FCW, a sibling site to GCN.

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

See the original post:
How government is delivering better election security - GCN.com