5 Ways to Reduce Election Security Risks

The vulnerabilities uncovered in the 2016 election cycle effectively undermined voter integrity and public trust. As we head into the first federal election cycle since then, state and local government election officials must move above and beyond just providing free, fair and accessible voting: They also must ensure the cybersecurity of our election processes.

Tackling this challenge can be daunting, especially given that many election officials must operate with a tight budget. If you are one of those officials, you may be thinking, what is the best way to identify and reduce election security risks? Well, there are five key areas on which you should focus:

Know What You’re Working With

The first step is asset management. It is vital that you understand all of the elements involved in the election process, including the technologies used, their interconnection, and the way the data is classified. This includes vote-capture devices and voting booth security, as well as the systems that handle voter registration, poll book creation, elections management systems and results reporting, along with the underlying databases, interfaces and supporting infrastructure.

Know Your Dance Partners

Another priority is third-party management. IT infrastructure is increasingly dependent on third-party service providers for maintaining the infrastructure backbone, supplying hardware, security and configuration management. Elections infrastructure is no different—however, the sensitive nature and focus of these systems make it important that you have a thorough understanding of the supply chain and all of the parties that are involved.

Know Your Adversaries

Focus on threat intelligence. Election security is not just about the integrity of the physical votes—it is about restoring the American people’s faith in the election process. Today’s cyber environment demands that you look outside of the typical threat intelligence feeds to gather information from nontraditional sources to understand the big picture. Disinformation spread via social media can be just as harmful to election security as an actual breach. Additionally, threat vectors such as ransomware, denial-of-service attacks, phishing campaigns and credential harvesting are getting increasingly sophisticated.

Plan, Practice, and Plan Again

Incident responsiveness is key. You should prepare as if “it’s not if, but when” a cyberattack will occur. The difference between a front-page headline and a nonincident is having a robust response plan and process in place—and that takes careful planning and practice.

Get the Big Picture

Cyber analytics are a must. As an election official, you oversee assets across a geographically diverse area, each with a different level of security. Once you understand all of your assets, use analytics to visualize the data and prioritize your risk response. Gathering all of the disparate assets into a single dashboard allows you to monitor and mitigate the risk through a single view of the situation.

As state and local governments ramp up efforts to secure voting infrastructure for the 2018 and 2020 elections, the challenges of securing a breadth of systems and processes is clearly a big job. Many free resources are available to help you tackle these issue such as the National Institute of Standards and Technology Cybersecurity Framework or Center for Internet Security Elections Handbook.  However, the steps outlined above will ensure that you stay well ahead of potential election security breaches, which is the best way to restore and protect the integrity of the American election process. For more information, download our election security white paper.

Dave Simprini is a principal with Grant Thornton Public Sector.