There has been a lot written in recent years about election security and ensuring the integrity of voting systems. While voting machines are important, so too are non-voting election technologies, which was the topic of a session at the RSA Conference in San Francisco.
Aaron Wilson, Senior Director of Election Security at the Center for Internet Security (CIS), explained that non-voting election systems include things that support elections. Those systems include electronic poll books, election night reporting systems, voter registration systems, and electronic ballot delivery.
"There is a lot to that attack surface, but there are not a lot of standards and regulations," Wilson said.
The Center for Internet Security has developed a guide to help secure those non-voting election systems that has 160 best practices to help reduce risk and improve confidence. The overall goal, according to Wilson, isn't necessarily that every election official will do all the steps, but rather they will have a guide that provides questions to ask vendors and IT staff.
Core Recommendations
There are three key areas that Wilson suggested election officials should look at. The first is dealing with Denial of Service (DoS) risks.
"Denial of Service is concerning because you know exactly when to wage the attack against an election system," he said. "If you can take a service down in a moment of critical need it can have significant impact."
Ransomware is also a risk that election officials need to defend against. Wilson said that both DoS and ransomware attacks are essentially about availability and denying access to assets.
The third key area is something Wilson referred to as unauthorized data modification. That's a critical area for non-voting election system integrity, as an unauthorized change can throw an election into doubt.
Among the key recommendations that Wilson provided to reduce the risk of unauthorized data modification are the following:
- Deployment of automated software patch management tools
- Using best practices for securely handling input and output
- Verifying data on backup media
- Deployment of application layer filtering
- Enforcement of access controls to data
Verifying Election Technology
Going a step beyond best practices, there is also an ongoing need to verify that systems are in fact operating as intended on a continuous basis. That's where the RABET-V: Rapid Architecture-Based Election Technology Verification framework comes into play.
"RABET-V is an election technology verification process that supports rapid product changes by design," Wilson said.
The RABET-V effort was launched in February 2020 as a pilot program and is available as an open source effort on github.
"It provides a consistent basis from which approval authorities can draw information, resulting in quicker decisions and reduced, amortized overall cost," Wilson concluded.