Venafi, a leading provider of machine identity protection, has announced the results of a study on the security of election infrastructure.
According to the study, 93% of security professionals are concerned about cyberattacks targeting election infrastructure and data. A total of 81% believe cybercriminals will target election data as it is transmitted by machines, software and hardware applications, from local polling stations to central aggregation points.
“Last year, attendees at DEF CON managed to find and take advantage of vulnerabilities in five different voting machine types within 24 hours,” said Jeff Hudson, CEO of Venafi. “While these findings were disturbing, conference attendees only examined a small portion of election infrastructure. It’s clear to nearly all security professionals that the back-end systems that transmit, aggregate, tabulate, validate and store election data are at least as vulnerable to cyberattacks as voting machines.”
Additional findings from the study include:
- A total of 95% believe election systems – including voting machines, software and back-end systems – should be considered critical infrastructure
- When asked what areas of election infrastructure were most vulnerable to cyber attackers:
- A total of 54% say voting machines that collect election data
- A total of 52% say encrypted communications between polling stations and back-end election systems
- A total of 50% say systems that store voter registration data
- Only 2% are very confident in their local, state and federal governments’ abilities to detect cyberattacks targeting election infrastructure. In addition, only 3% are very confident in their local, state and federal governments’ abilities to block them
- A total of 64% believe vulnerabilities and exploits connected with election systems are available to cyberattackers on the Dark Web
Earlier this month, a grand jury issued a detailed indictment on international interference during the 2016 US presidential election. Details in the indictment indicate that nation-state actors utilised encrypted tunnels to target vulnerabilities in election infrastructure, along with other attack methods. Attacks that hide in encrypted tunnels are difficult to detect and block without a comprehensive machine identity protection program in place.
“Security professionals clearly think that machine-to-machine communication in the electoral process is a high value asset for attackers targeting election results,” said Kevin Bocek, Vice President of Security Strategy and Threat Intelligence for Venafi. “This is just one reason why governments around the world need to make the security of all encrypted, machine-to-machine communication their top concern.”
Conducted by Dimensional Research in July 2018, the study included responses from 411 IT security professionals in the US, UK and Australia.
