Cybersecurity in Elections Infrastructure: Risks and Mitigations https://www.cisecurity.org/elections-resources/ Dr. Michael Garcia, Director of Elections Best Practices 14 June 2018

A word about CIS CIS is a technical organization Address the how over the what Backed up by experience and resources CIS history and programs underpin best practices and recommendations Focused on the entire ecosystem Looks at – and provides best practices – from start to finish

Center for Internet Security

The threat environment There have always been threats to elections There’s been a steady progression toward IT-related attacks over the last two decades 2016: a more concerted effort, but just an increase in what had already been occurring

Motivation Attackers have one or more goals Information theft, espionage, sabotage Sabotage: destruction, defamation, or blackmail of targets Motivation can be BOTH changing votes AND reputation damage to democracy itself In cybersecurity, risks drive investments Must assess risk and keep a broad view Adversaries will look for a weakness anywhere; so must we strengthen defenses everywhere

A Handbook for Elections Infrastructure Security View and download at: https://www.cisecurity.org/elections-resources/ Order free hardcopies at: https://learn.cisecurity.org/ei-handbook

The starting point The most substantial risks are to components that have network connections For cybersecurity folks, this puts us in known waters Bigger than paper ballots or RLAs Jumping on a moving train means continual improvement Constrained resources means mitigating risk at the margin Focus on the best way to spend the next dollar, regardless of where it is

Handbook Structure Three parts Introduction of elections and risk An architecture of elections systems and their risks Technical best practices Includes recommendations on contracting and procurement, auditing, and incident planning Contains 88 best practices in the form of security controls

Part 1: Introduction Typical stuff: scope, audience, environment Also info about conducting a risk assessment Introduces three classes of connectivity Network connected systems Indirectly connected systems Systems that are not connected Bonus! Transmission risks

Part 2: Architecture and Risk Generalized architecture Describe each component, its risks, and its connectedness

Part 3: Mitigating Risk Summarize and mitigate risks Best practices have Asset class: device, process, software, user Priority: high, medium Known security controls Estimates of Potential resistance, upfront cost, ongoing maintenance cost Resources to help implementation Links to online resources, NIST guidance, tools

Possible uses of the handbook Using as a baseline in developing training and assessment tools Drawing connections between non-technical understanding of risk and technical approaches to mitigation Prioritizing additional security work Showing how investments have been used and future investment will be used Conducting an assessment of current practices

What’s next? Self-assessment tool against handbook Pilot phase underway, full launch in July Training for independent assessors In early development, hoping to begin training in fall Procurement guidebook Based on handbook, provides sound approaches to procurement as well as model contract clauses

Thank you! Mike Garcia Mike.Garcia@cisecurity.org www.cisecurity.org/elections-resources