With the November 7 election looming, state and local governments are scrambling to secure their electoral systems.
Manipulation of electronic voting machines has always been a possibility. The only difference now is the relative ease of pulling it off. It took hackers at the recent DEFCON conference only 90 minutes to break into a voting machine.
The threat is no longer theoretical, either. Investigators recently found evidence of tampering with voting machines in 39 states, with reports suggesting that the problem may be even more widespread.
Many election officials are lulled into a false sense of security by the fact that voting machines are not usually connected directly to the internet. Unfortunately, that doesn’t account for the many network-enabled inputs into modern voting machines. The computers that program the ballots, tally votes, report results and audit voting, are all connected to open networks, making them just as vulnerable.
Those vulnerabilities are not usually the result of direct “brute force” hacking. They often find their way in through phishing emails or other subtle points of entry. Once these advanced persistent threats are inside a network, it is very difficult to find and eliminate them.
DNS Data Can Detect EMS Hack
This is where Domain Name System (DNS) can play a critical role in securing election infrastructure. Over 90% of malware uses DNS – its pervasive nature an ideal mechanism for infiltrating a network.
In attacks on voting systems, malware will search for the Election Management System (EMS) that sets parameters and formatting for ballots – the single point of entry for disconnected voting machines. A client facing DNS-based security system can identify these searches and trace their source. When suspicious queries are identified, DNS-based behavior policy can block all traffic from unauthorized computers.
The same holds true for tabulating and reporting results. When ballots are uploaded to a connected system, DNS security systems can identify and block any attempts to access, exfiltrate, or manipulate the information.
The security of voting systems is vital to the future of democratic government, yet the IT resources of state and local election commissions are woefully underprepared and underfunded. Few have dedicated network security personnel, let alone a method for vetting the security of voting machines themselves.
DNS-based security can serve as a vital cornerstone for a network defense security strategy that our electoral systems desperately need.
Critical conversations on critical infrastructure
Find out how your peers are managing their networks through profound change. Watch this series of live interactive discussions with IT pros & join the debate in Slack.
SUNBURST/Solorigate Situation Briefing
BlueCat leaders discuss how the malware attack via SolarWind’s Orion platform exploited DNS and how BlueCat Edge could have helped to detect it.
Yes, IT should see what developers do in the cloud
Errors and outages occur when admins lack visibility into DNS and IP allocation in the cloud. With Bluecat, central DDI visibility is within reach.
Customer situation brief on SUNBURST/Solorigate
Learn more about the attack via the SolarWinds Orion platform and how BlueCat products use DNS to help protect customers against compromises like it.
On the road to platform hardening, consider a STIG
Security Technical Implementation Guides standardize security configuration on networks, servers, and devices. BlueCat uses them and you can, too.