Ensuring election integrity: The overlooked last mile of securing voter data

With 99 percent of America’s votes counted by computers, security experts agree that our elections remain extremely vulnerable for a cyberattack. Fourteen states are still using fragile voting equipment consisting of digital endpoints that travel from storage to polling places. With some voting machines being so old that officials can’t even tell if they’ve been compromised or are susceptible to an attack, it’s beyond time for us to have confidence in election outcomes and correct results if problems are discovered.

In addition to age, many voting machines are touchscreen and paperless, a weakness that could allow hackers to rig U.S. elections without detection. More than a dozen states are vulnerable for the same reason, and this won’t change until machines produce physical copies of ballots for auditing to verify accurate vote counts. At the moment, there is no secondary way to audit votes and a paper trail is a straightforward solution to what has become a big problem.

To infiltrate the U.S. elections, it’s also simple to intercept the operating system signatures during the boot phase. Many of these brittle machines run on non-standard operating systems and applications with version-control being an afterthought. This can lead to exploitation that elevates privileges, alters information, and ultimately compromises even larger units of data. By manipulating one machine, a creative cybercriminal can access more resources, resourcing dripping with not only vote tallies, but personal information of voters themselves. Standardizing systems, once again, is a straightforward and relatively simple measure to safeguard elections and voters.

With that said, we are able to build a mature endpoint security program that can significantly mitigate the risk of an incident, preventing a larger breach or massive data loss. When it comes to the security of our elections, we can take strides in the right direction by focusing on prevention, detection, response, and improvement. We can all agree that election integrity is vital to a free and open society, and with that common devotion, here are a few suggested practices to help us keep to that commitment:

Set strict guidelines and policies

It’s important to make sure there is a clear set of usage policies that are strictly enforced with all voting equipment. To make security mandatory for all elections, we must enact policies and laws that confirm updates and patches are continuously installed. Keeping up with builds, versions, hotfixes, patches and updates is a significant part of any organization’s cyber hygiene, and it is the most effective metric for reducing risk. It gives a firm base rate against which you can accurately determine if something is truly anomalous.

Prioritize real-time evaluation

Organizations need visibility to evaluate and identify exposures before they become exploits, and we must do this in real-time. When we pinpoint indicators of exposure (IOEs), IT and security teams need to respond with confidence. That confidence is built on the understanding that what they’re seeing is the most accurate and timely picture. Ponemon found 425 hours are wasted each week by IT teams chasing false leads on potential risks and exposures. This not only creates bloated inefficiencies, but sucks the mental resources from the smartest people we need for mitigating risks: IT and security teams.

Build an incident-response playbook

Integrating cybercrime response into our voting practices should be kept as living documents that include initial response proposals as well as long-term plans. This is most effective when IT and security teams have the tools necessary to scale their powers of detection and speed of response. If a voting machine shows weaknesses or is reported lost or stolen, IT staff need to confirm the hygiene status—security controls, apps, agents, activity—of the device at the time of the event. In the case of missing election equipment, lock it down to render it useless until it is recovered. When endpoints go rogue or become invisible, we need to act fast, and with confidence. Without urgency, exposures to cybercrime only increases, and it increases reliably and predictably. But if we reassert the need for complete visibility, then we reduce the attack surface and thereby, reduce surprises.

Add resiliency to security solutions

Why are endpoints so commonly targeted? That’s easy, because each has a complex assembly of controls and policies to keep them in a secure state. Add in the fact that these devices seldom ‘check-in’ with corporate systems to verify the controls are active and up-to-date. When devices escape the dense nucleus, they get unstable. By the laws of probability, then, cybercriminals have a much greater likelihood of success when they set their sights on endpoints. It stands to reason that a laser-like focus on endpoint cyber hygiene would improve the security posture of voting equipment (being endpoints, themselves).

Critical controls and apps such as AV, encryption, communications, credential shields, and device management are easily broken and disabled, whether by accident or intent. First, see everything; keep every device within digital sight. Second, discover how automation can regenerate controls. Set your ideal of endpoint cyber hygiene and automate healing commands to transform your golden image to a diamond: hard, pure, resilient.

Ahead of this year’s midterm elections, fewer than half of U.S. states have submitted to the Department of Homeland Security an assessment of their exposure to vote hacking – we can change this number. Yes, getting started with endpoint security will not be simple, and it takes deliberate efforts to scrutinize programs to see whether folk wisdom or evidence is carrying the day. To secure the integrity of elections, we can start with these core practices. Unless we take courage to face our own failures of cyber hygiene, we will be in danger of losing the battle to safeguard a crucial aspect of democracy: the individual’s voice.