In Elections, Cybersecurity Extends Beyond Voting Machines | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

For states and counties alike, election cybersecurity is a year-round responsibility.In Multnomah County, Ore., a network outage could disrupt voter services and affect the high-speed mail sorters that are a key part of the vote-by-mail system — if it happened.But the county, which had 592,000 registered voters as of Oct. 23, hasn’t had an election-related cybersecurity incident, Elections Director Tim Scott said.When Scott joined Multnomah County Elections in 2008, staff still sorted returned ballots by hand and scanned envelope barcodes one at a time. High-speed sorters now scan the barcodes and capture digital images of signatures. The county added automatic signature verification during the pandemic, when it needed to process ballots with fewer workers. A portion of signatures are automatically verified, Scott said, while the rest are reviewed by workers.The county’s central IT team provides election office cybersecurity, training and targeted phishing campaigns that test staff throughout the year, Scott said. The most serious cyber risk, he said, would be a phishing attack that breached the county network, which connects his office to the statewide voter system. Losing access to that system would disrupt customer service and other operations.But — there is a limit on who has email access. There are 15 full-time, year-round employees and anywhere from 100 to 200 on-call election workers. Only about 2 percent of the latter have access to email, Scott said, and everyone receives cybersecurity training.“We have found that most of the jobs do not require email, and that cuts down a really big attack vector,” he said. “But we are managing those logins very carefully with some special logins just for them, which limit their access to most county applications. And really, all they need to do is to be able to get online so they can connect to the statewide voter registration system.”Election offices face many of the same cyber threats and constraints as other local government agencies while operating under heightened public scrutiny, said Geoff Hale, a visiting fellow for election security at the Center for Democracy and Technology. He spent a decade with the U.S. Department of Homeland Security working in elections and cybersecurity.Election offices also manage physical security for people and polling locations, Hale said, while limited resources can force difficult choices.“Do you use [funds] to put a better lock on the door, or do you use it to implement [multifactor authentication] MFA? Those are hard decisions to make at times,” he said.Election offices have ways to keep operating if systems fail. If electronic poll books are unavailable, workers can use paper poll books; if voter data is inaccessible, they can turn to provisional ballots. Election-night reporting can still be done manually. And paper ballot records provide a way to audit, recount or hand-count votes if needed.States vary on how election authority is organized.The Ohio Secretary of State’s Office, for example, oversees election administration across the state’s 88 counties, each of which has a local board of elections. Ohio’s authority to issue binding directives gives it a way to set cybersecurity standards and help put those standards into practice. The office implemented several cybersecurity measures for elections, including mandated phishing training. There is also a state cyber defense team that includes four regional liaisons, each serving 22 counties, with the goal of responding to major incidents within an hour.“Ohio gets to say, ‘Here’s the standard you have to uphold,’ and I think that’s a powerful agenda-setting tool,” Hale said.State cyber navigator programs can pool expertise and training across counties, he said, helping local officials prioritize security work and avoid gaps between well-resourced and under-resourced jurisdictions.“You don’t want the haves and the have-nots when it comes to security,” Hale said.

window.fbAsyncInit = function() {
FB.init({

appId : ‘314190606794339’,

xfbml : true,
version : ‘v2.9’
});
};

(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = “https://connect.facebook.net/en_US/sdk.js”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));

——————————————————-
Click Here For The Original Source.

Related