What election security funding means for state and local CIOs

For years, cybersecurity was considered an issue for IT teams and was often not prioritized when creating and executing policy. However, recent events have demonstrated the many ways that cyberattacks can impact a country’s critical infrastructure, bringing essential operations to a halt and even endangering citizens.

These attacks have come in the form of ransomware at schools and hospitals, data breaches at major financial institutions and large-scale distributed denial-of-service attacks that have knocked organizations of all types offline. As a result, politicians and government bodies have come to recognize the critical importance of cybersecurity in protecting national infrastructure.

As digital transformation increases technology use across public infrastructure, the attack surface continues to grow. Government CIOs and IT teams are working to deploy security measures that enable transformation, rather than slow it down. For instance, Fortinet’s latest Global Threat Landscape Report found that government agencies use, on average, 255 different applications a day on their networks.

Legislators and governing bodies have responded by issuing new regulations and introducing bills over the past several years that provide additional guidelines to enhance security and modernize technology across critical sectors. Funding and prioritizing these efforts, however, continues to be a challenge as technology growth and change progress at unprecedented speed.

Cyberthreats to voting systems

While federal, state and local entities race to secure increasingly vulnerable critical infrastructure, cybercriminals have also taken up a new target: voting systems. Reports that cybercriminals tampered with the 2016 election results have led to discussions about how to secure voting in districts across the country, especially as they increasingly transition to digital processes. Complicating this challenge further, U.S. voting procedures are controlled at the state level, meaning each state can choose how to collect, process and audit its data. As a result, no blanket regulation or update can improve voter security across the nation.  

As the 2018 midterm elections approach in November, it is essential that political leaders at the state and federal level ensure the adherence to security best practices from both a technical and process perspective. As usual, funding such efforts is often the largest barrier to addressing cybersecurity challenges, especially as these same organizations are burdened with critical infrastructure security projects already underway. To that end, the Elections Assistance Commission (EAC) is distributing $380 million across states, territories and the District of Columbia. The 2018 HAVA Election Security Fund is an extension of the Help America Vote Act and aims to provide state and local governments with money to improve the security of their voting processes.

While the federal government is providing these funds, state and local governments, which often have unique voting processes, will determine how to use this money. For many, putting these funds toward modernizing the technical infrastructure used in elections, administering upgrades and patches to systems and investing in cybersecurity training are a high priority. Several states, for example, have already announced plans to increase security, with Colorado launching comprehensive post-election audits, Arizona creating a cybersecurity team and Minnesota offering cybersecurity training to officials.

Though these funds will put states on a better trajectory to securing elections, ultimately, they will not be enough to solve all security weaknesses across each state. Therefore, state and local governments must make informed decisions about how to allocate their funds to best enhance election cybersecurity.

Top areas of focus for state and local cybersecurity spend 

To ensure they are allocating funds in the necessary places, state governments should consider conducting a cyber threat assessment. This evaluation assesses networks and devices to detect vulnerabilities, exploits, malware and botnets. Beyond security risks, a CTA also provides insight into throughput and bandwidth needs during prime hours. Such an assessment must include all technology, which means that state governments should evaluate both networked and non-networked devices as well as the transmission, collection, processing and storage of election data. A CTA is a valuable tool in determining which infrastructure elements should be prioritized for remediation, especially now as midterm elections quickly approach.

Based on the growth of unique exploits, ransomware, botnets and more, state and local governments should also focus on the following security capabilities and features as they seek to better secure elections in their district. 

Automation and machine learning. Cybercriminals are using automation and machine-learning tactics to make attacks faster and more targeted while IT teams and resources are stretched too thin to detect and contain threats before damage can be inflicted. State governments should likewise ensure they are investing in solutions that leverage automation and machine learning to keep up with the pace of recent attacks. Machine learning ensures that security efforts are informed by the latest threat intelligence through regular updates, helping the solution become more accurate at detecting attacks and predicting adverse outcomes. Automation then ensures that detected attacks are isolated and remediated in real time. As attacks become more sophisticated and morph to target specific vulnerabilities, these abilities will be necessary for securing elections.

Patching and updates. Before midterm elections, state and local governments should take the time to administer all necessary patches and updates across hardware, software and applications. Ignoring this security best practice leaves districts susceptible to even unsophisticated, basic cyberattacks.

Access management. To limit the compromise to voting systems, districts must ensure that only necessary parties have access to any elections-related records and devices. Strong access management, combined with secure network segmentation to isolate voting devices and data, will ensure that even those who have privileged access to the broader government network cannot view or alter votes or election records. This strategy is especially important as governments digitize more of their processes. Cybercriminals often target less secure access to state networks, perhaps through public transportation or public-school interfaces, as a means to breach the network and locate election data.

Access management authenticates those with access to sensitive information through features such as two-factor identification and token management, single sign-on and even biometrics. It can also provide separate access channels to secure and isolate guests and staff members' personal devices accessing network resources through those same access points. 

Intrusion detection and prevention. State and local governments must ensure that they have deployed adequate safeguards across the network, including firewalls and security information and event management (SIEM) solutions. Today’s best next-generation firewalls provide security beyond the perimeter, incorporating web application firewalls and internal segmentation firewalls to drive security deep into the network. This ensures government networks protect applications and secure networked resources across the distributed network, even into the cloud, while isolating and sensitive voter information as it moves across the network. These solutions are essential to ensuring critical voting data remains inaccessible even in the event of a successful network breach. SIEM solutions provide real-time visibility to detect and remediate attacks by collecting, correlating and analyzing event data gathered from devices distributed across the network. They then display and update that information in real time on a common, centralized management and analysis console, making it easier to detect anomalous behavior that might indicate an attack or breach.

Cybersecurity training. State and local governments should also consider investing in cybersecurity training for staff members and volunteers. Such training should explain cybersecurity best practices, how to identify voting machine tampering and how to maintain proper cyber hygiene. If staff members are aware of cyber risks and how they can be exploited to initiate breaches, they will be better equipped to detect malicious activity. Furthermore, this knowledge will help districts develop policies and processes with security in mind, such as logging out of systems when not in use, deleting accounts when an employee leaves, not clicking on links or opening emails from unknown senders or regularly updating software and applications. These standard best practices can go a long way towards securing the election process upon which an autonomous democracy depends.

Final thoughts

As cybercriminals target elections, governments at both the state and federal level are increasing defenses. The 2018 HAVA Security Fund provides a starting point for states to modernize and secure their voting systems and processes. However, these funds are limited and require careful consideration before they are spent. As state and local governments evaluate where to allocate these funds, they should keep the above considerations in mind to ensure they select those tools that will have the most significant impact.