New York, DHS launch election cyber exercises
Connecting state and local government leaders
State, local and federal officials hash out their responses to cybersecurity threat scenarios.
Officials from New York's state and county governments got together with with representatives of the federal Department of Homeland Security in Albany County for the first tabletop exercise focused on protecting New York's electoral systems against cyberattacks.
The May 31 meeting was not a physical test of election infrastructure but rather a discussion of how state and local officials respond to hypothetical cybersecurity incidents, according to John Conklin, the director of public information at New York Board of Elections. Six regional tabletop exercises conducted with state, local and federal stakeholders will help identify risks and develop necessary steps to safeguard the election process against a cyberattack, according to the governor's office.
The exercise was developed to identify weaknesses in cyber incident planning, preparedness and response through scenarios designed to undermine voter confidence, interfere with voting operations and affect the integrity of elections. Simulated cybersecurity incidents could include disruption of voter registration information systems and processes, interference with voting machines or the exploitation of board of elections business networks, state officials said.
The exercise was designed to assess the jurisdictions' "abilities to identify a cyber incident, manage a cyber incident, what they should be sharing in terms of procedures,” Conklin said in an interview after the meeting.
The local officials in Albany County were presented with scenarios featuring social media manipulation, a DDOS attack and a website hack.
“Personally, I was pleasantly surprised with a lot of the answers that were given and a lot of the things that countries were doing that we weren’t necessarily 100 percent confident they were doing,” Conklin said. The also proved to be doing a good job with scanning, monitoring logs and testing backups, he added.
Present at this first exercise were representatives from 13 different counties in the region, board officials, county government and IT officials, as well as staff from the DHS, FBI, state police, the governor’s cyber advisory board and the Center for Technology and Government at the University of Albany, Conklin said.
Several counties already work with the Multi-State Information Sharing and Analysis Center, which operates a 24/7 security operations center and provides incident response services to states, localities and tribes. New York plans to have counties join the MS-ISAC’s new sibling organization, the Elections Infrastructure Information Sharing and Analysis Center.
The New York Board of Elections received an additional $5 million in the state budget and $19.5 million from the federal government to improve cybersecurity prior to the November elections. That money is going toward upgraded intrusion detection and prevention, enhanced anti-malware software, enhanced monitoring of public-facing applications and the development of regulations and cyber hygiene standards for the county boards, Conklin said.
New York will hold five more tabletop exercises, with the last one scheduled for June 18. DHS will create an after-action report with the findings that will be released 30 days later.
These exercises show just how seriously every level of government is taking the threat, according to Bob Kolasky, the acting deputy under secretary of the National Protection and Programs Directorate at DHS.
“State and local officials in New York have taken a number of steps to improve the security of their elections,” Kolasky said in a statement, “and the Department of Homeland Security stands ready to support their efforts through exercises, information sharing, and by providing our technical cyber analysis and expertise.”
NEXT STORY: Security fundamentals: Vulnerability management