And You Thought Hanging Chads Were Trouble?

In the day and age of electronic voting systems, and the debacles of hanging chads that followed in the US presidential election of 2000, there has been a fear that new electronic systems could have new types of flaws that could easily lead to voter errors or potential election rigging. Electronic voting systems are based on standard computing technology like Linux and Microsoft Windows. This makes them easy to deploy, cost effective, but also susceptible to many of the security vulnerabilities other businesses and governments attempt to mitigate every day. In addition, the applications installed on these operating systems can suffer from the same types of application flaws that any other business may face. The only saving grace about someone grossly compromising electronic voting systems is that they are state run, and all different. While a hack may work on one state, it may not work on others, and a coordinated attack against the majority of the states must occur, and be undetected, in order to be successful. Target attacks may prove fruitful for a single election but the risks are high for the attacker and must be carried out without any logs or evidence in order to be effective. Otherwise, it will be a disruption, and not much more than a news story.

Protecting Against Electronic Voter Hacking

For local and state governments trying to protect themselves against electronic voter hacking, governments should consider the best practices they use every day for regular information technology systems and apply them to the technology deployed for electronic voting:

• Accountability – Hold the manufacturer to a Service Level Agreement for remediating discovered vulnerabilities and system flaws.
• Vulnerability Assessments – conduct regular independent vulnerability assessments against the operating systems, applications, and web applications to prove they are secure.
• Report – Document the findings from assessments and penetration tests to track results and raise awareness to proper authorities.
• Remediation – Patch any security vulnerabilities that are the responsibility of the government and notify the manufacturer of their responsibilities.

Electronic voting systems are just regular computers with specialized applications. They are just like a vending machine or kiosk to check into a flight at the airport. Unfortunately, some of the connecting systems like voter registration are publicly on the internet and subject to the shortcomings and security flaws like any other application. The risks to disruption are real but the methods to fix them well documented in our information technology security best practices and procedures. All governments need to do is use and enforce them. For more on how BeyondTrust can help you achieve greater control and accountability over system privileges and vulnerabilities, contact us today.