It’s a pivotal moment in US history. We’re coming together on long-overdue civil reforms, battling injustice and a deadly pandemic, while restarting our economy. Soon we’ll come together to decide our nation’s future leaders. At a time when truth is called into question, it’s vital to secure our election so we trust its outcomes. Cyberattacks on election systems could undermine confidence just when we need it the most. The voter registration database (VRDB) is the heart of most election systems, and MITRE recently published the most important security steps to protect them. Join our lively discussion to learn: The nature of election systems and why they’re difficult to secure MITRE’s focus on VRDBs and five key cyber recommendations How Cisco Security can help you take action on MITRE’s advice today

1. Steve Caimi, Cisco Security
July 2020
Securing the Heart of our
Election Systems
#Protect2020

2. Abstract
It’s a pivotal moment in US history.
We’re coming together on long-overdue civil reforms,
battling injustice and a deadly pandemic, while restarting
our economy. Soon we’ll come together to decide our
nation’s future leaders. At a time when truth is called into
question, it’s vital to secure our election so we trust its
outcomes.
Cyberattacks on election systems could undermine
confidence just when we need it the most.
The voter registration database (VRDB) is the heart of most
election systems, and MITRE recently published the most
important security steps to protect them.
Today we’ll explore:
‣ The nature of election systems and why they’re difficult to
secure
‣ MITRE’s focus on VRDBs and five key cybersecurity
recommendations
‣ How Cisco Security can help you take action on MITRE’s
advice today

3. Poll 1Your time is valuable. Why did you join our webinar today?
1. I am responsible for election security in my role
2. I am not responsible for election security, but interested in the topic

4. Agenda
1. The most important things
2. The system and the pieces
3. What makes security so hard
4. MITRE’s recommendations
5. Solutions to start using now

5. Agenda
1. The most important things
2. The system and the pieces
3. What makes securing it so hard
4. MITRE’s recommendations
5. Solutions to start using now

6. Back in 1933
FDR took the US
off the gold standard

7. 7© 2020 Cisco and/or its affiliates. All rights reserved.
The most
important
things
Faith
Confidence
Trust

8. Many things can undermine our elections
Foreign
Interference
Unproven
Allegations
Voter
Fraud
Conspiracy
Theories
Information
Operations
Cyber
Breaches

9. Which brings us to
cisa.gov/protect2020
• Cybersecurity & Infrastructure Security Agency (CISA)
• Lead federal agency for election security
• National call to action to bolster election security
• Resources and outreach to state & local government

10. Example: Understanding foreign interference
From random cyberspace to the real world
https://www.cisa.gov/sites/default/files/publications/19_1008_cisa_the-war-on-pineapple-understanding-foreign-interference-in-5-steps.pdf

11. Step 1: Start with a divisive issue
https://www.cisa.gov/sites/default/files/publications/19_1008_cisa_the-war-on-pineapple-understanding-foreign-interference-in-5-steps.pdf

12. Step 2: Mobilize social media
https://www.cisa.gov/sites/default/files/publications/19_1008_cisa_the-war-on-pineapple-understanding-foreign-interference-in-5-steps.pdf

13. Step 3: Begin the misinformation operation
https://www.cisa.gov/sites/default/files/publications/19_1008_cisa_the-war-on-pineapple-understanding-foreign-interference-in-5-steps.pdf

14. Step 4: Get noticed by mainstream media
https://www.cisa.gov/sites/default/files/publications/19_1008_cisa_the-war-on-pineapple-understanding-foreign-interference-in-5-steps.pdf

15. Step 5: Influence legitimate voters
https://www.cisa.gov/sites/default/files/publications/19_1008_cisa_the-war-on-pineapple-understanding-foreign-interference-in-5-steps.pdf

16. As cyber defenders, let’s control what we can
Foreign
Interference
Unproven
Allegations
Voter
Fraud
Conspiracy
Theories
Information
Operations
Cyber
Breaches

17. 17© 2020 Cisco and/or its affiliates. All rights reserved.
Let’s make sure
voters know about
our progress
• “States should be open
about their investments,
timelines and policies.”
• “Success and progress in
security should be
aggressively communicated.”

18. And let’s start now
with the things we
can do today
At MITRE, we solve problems for a safer world.
Through our federally funded R&D centers and
public-private partnerships, we work across
government to tackle challenges to the safety,
stability, and well-being of our nation.

19. Poll 2Which cybersecurity best practice do you use the most?
1. NIST Cybersecurity Framework
2. CIS Controls
3. ISO 27000 Series
4. MITRE ATT&CK
5. None of the above

20. Agenda
1. The most important things
2. The system and the pieces
3. What makes securing it so hard
4. MITRE’s recommendations
5. Solutions to start using now

21. 21© 2020 Cisco and/or its affiliates. All rights reserved.
Technology
components
• Election Management System
• Voter Registration Database
(VRDB)*
• Election Night Reporting
Systems
• Electronic Pollbooks
• Voting Machines
• Ballot Counting Machines
* North Dakota doesn’t require voter registration

22. 22© 2020 Cisco and/or its affiliates. All rights reserved.
Voter
Registration
Database
(VRDB)

23. Voter Registration
Systems
in the spotlight
Source: https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume1.pdf

24. 24© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Not just about stealing data
• Attempts to delete or
manipulate voter information
• Undermines confidence in the
election process
• Impacts perceptions about
election legitimacy
• Fuels conspiracy theories
• More attacks expected this year
Voter Registration
Systems
in the spotlight

25. 25© 2020 Cisco and/or its affiliates. All rights reserved.
MITRE
General Voter
Registration
System
Architecture
Source: MITRE Recommended Controls for Voter Registration Systems (Nov 2019)

26. Agenda
1. The most important things
2. The system and the pieces
3. What makes securing it so hard
4. MITRE’s recommendations
5. Solutions to start using now

27. 27© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

28. 28© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

29. 29© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

30. 30© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

31. 31© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

32. 32© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

33. 33© 2020 Cisco and/or its affiliates. All rights reserved.
Election security
challenges • Each state runs their own
election systems
• Design and architecture varies
from state to state
• Many integrations both on and
off the state’s network
• Election officials’ workstations
serve multiple purposes
• No nationwide security
standards
• Limited resources
If you’ve seen one
election system,
you’ve seen one
election system.

34. Matthew Olney, Cisco Talos
Director, Threat Intelligenceand Interdiction
Election security can not be solved
just by looking at individual
components of the system.

35. Agenda
1. The most important things
2. The system and the pieces
3. What makes securing it so hard
4. MITRE’s recommendations
5. Solutions to start using now

36. 36© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
https://www.mitre.org/publications/technical-papers/recommended-
security-controls-for-voter-registration-systems
1 Secure External Connections
2
Strengthen External and Internal
Network Defenses
3 Enhance Access Management
4
ImproveSystem Management and
Monitoring
5
Facilitate Recovery and Ensure
Continuity of Operations
As evidenced by the widespread
attacks during the 2016 election
cycle, in which numerous states
were targeted for compromise by
nation-state actors,
voter registration
databases
are of particular interest to
sophisticated adversaries...
-- MITRE

37. 37© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
https://www.mitre.org/publications/technical-papers/recommended-
security-controls-for-voter-registration-systems
1 Secure External Connections
2
Strengthen External and Internal
Network Defenses
3 Enhance Access Management
4
ImproveSystem Management and
Monitoring
5
Facilitate Recovery and Ensure
Continuity of Operations

38. 38© 2020 Cisco and/or its affiliates. All rights reserved.
Secure External
Connections
“Evaluate, protect, and authenticate communications
with the external systems that share and validate
voter information to ensure that connections are
secure and do not offer a point of entry for external
attack.”
1
Secure External
Connections
Patterns of Communication
Protecting Connections
Authenticating Endpoints
Verifying Data
Overview

39. 39© 2020 Cisco and/or its affiliates. All rights reserved.
Strengthen External
and Internal
Network Defenses
“Deploy network segmentation, additional firewall and
intrusion detection layers, and email and web content
filtering to detect and halt attacks made through
network connections.”
2
Strengthen External and
Internal Network Defenses
Network Segmentation and Isolation
Firewalls
Intrusion Detection Systems
Device Access Control
Email, Web, and Content Filtering
Overview

40. 40© 2020 Cisco and/or its affiliates. All rights reserved.
Enhance Access
Management
“Implement role-based access, multifactor
authentication, device access control, and centralized
and federated identity management, and perform
supply chain risk assessment.”
3
Enhance Access
Management
Role-Based Access
Multifactor Authentication
Centralized/Federated Identity Mgmt
Supply Chain Risk
Overview

41. 41© 2020 Cisco and/or its affiliates. All rights reserved.
Improve System
Management and Monitoring
Improve System
Management and
Monitoring
Logging, Aggregation, and Analysis
Vulnerability Scanning
Asset Management
Patch Management
“Implement logging and vulnerability management to
improve visibility. Perform regular audits to ensure
validity of the database and compliance to policies
and procedures, and to verify and validate file
authenticity.”
4
Audits
Privileged Endpoint Security Services
Overview

42. 42© 2020 Cisco and/or its affiliates. All rights reserved.
Facilitate Recovery and Ensure
Continuity of Operations
Facilitate Recovery
and Ensure
Continuity of
Operations
Recovery Strategy
Backups
Continuity of Operations
“Perform regular backups, frequent system audits,
and institute clear recovery plans to mitigate damage
to election systems. Identify and test failover
methodology to ensure that operations can continue
if a system fails.”
5 Overview

43. Patterns of Communication
Protecting Connections
Authenticating Endpoints
Verifying Data
Network Segmentation
Firewalls
Intrusion Detection Systems
Device Access Control
Email, Web Content Filtering
Role-Based Access
Multifactor Authentication
Identity Management
Supply Chain Risk
Logging and Analysis
Vulnerability Scanning
Asset Management
Patch Management
Audits
Endpoint Security Services
Recovery Strategy
Backups
Continuity of Operations
1
2
2
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
20
21
22
19
1 Secure External Connections
2
Strengthen External and Internal Network
Defenses
3 Enhance Access Management
4 ImproveSystem Management and Monitoring
5
Facilitate Recovery and Ensure Continuity of
Operations

44. Patterns of Communication
Protecting Connections
Authenticating Endpoints
Verifying Data
Network Segmentation
Firewalls
Intrusion Detection Systems
Device Access Control
Email, Web Content Filtering
Role-Based Access
Multifactor Authentication
Identity Management
Supply Chain Risk
Logging and Analysis
Vulnerability Scanning
Asset Management
Patch Management
Audits
Endpoint Security Services
Recovery Strategy
Backups
Continuity of Operations
1
2
2
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
20
21
22
19
Actually
there’s 22
things...

45. Stephen R. Covey
“Most of us spend too much time on
what is urgent... and not enough time
on what is important.”

46. Poll 3Which of these is most vital for election integrity?
1. Secure External Connections
2. Strengthen Network Defenses
3. Enhance Access Management
4. Improve System Management and Monitoring
5. Facilitate Recovery and Ensure Continuity of Operations

47. Risk
UnacceptableAcceptable
What’s important? Focus immediate action on:
• Highest risk areas
• What you can do right now
• What your budget supports
• What’s aligned with cyber best
practices

48. 48© 2020 Cisco and/or its affiliates. All rights reserved.
Secure External
Connections
1
Secure External
Connections
Patterns of Communication
Protecting Connections
Authenticating Endpoints
Verifying Data
CIS Control 12
Boundary Defense

49. 49© 2020 Cisco and/or its affiliates. All rights reserved.
Strengthen External
and Internal
Network Defenses
2
Strengthen External and
Internal Network Defenses
Network Segmentation and Isolation
Firewalls
Intrusion Detection Systems
Device Access Control
Email, Web, and Content Filtering
CIS Control 7
Email and Web Browser Protections

50. 50© 2020 Cisco and/or its affiliates. All rights reserved.
Enhance Access
Management
3
Enhance Access
Management
Role-Based Access
Multifactor Authentication
Centralized/Federated Identity Mgmt
Supply Chain Risk
CIS Control 16
Account Monitoring and Control

51. 51© 2020 Cisco and/or its affiliates. All rights reserved.
Improve System
Management and Monitoring
Improve System
Management and
Monitoring
Logging, Aggregation, and Analysis
Vulnerability Scanning
Asset Management
Patch Management
4
Audits
Privileged Endpoint Security Services
CIS Control 8
Malware Defenses

52. 52© 2020 Cisco and/or its affiliates. All rights reserved.
Facilitate Recovery and Ensure
Continuity of Operations
Facilitate Recovery
and Ensure
Continuity of
Operations
Recovery Strategy
Backups
Continuity of Operations.
5
CIS Control 19
Incident Response and Management

53. Agenda
1. The most important things
2. The system and the pieces
3. What makes securing it so hard
4. MITRE’s recommendations
5. Solutions to start using now

54. 1 Secure External Connections
Patterns of Communication
Stealthwatch Cloud
Network Traffic Analysis
Comprehensive
visibility and analytics
Agentless deployment
with automated tuning
Network detection
and response

55. 2 Strengthen External and Internal Network Defenses
Email, Web, and Content Filtering
Umbrella and Email Security
Content Filtering
Protect users
everywhere with
DNS-layer security
Multiple security
services delivered
from the cloud
Layered email
defenses for
complete protection

56. 3 Enhance Access Management
Multifactor Authentication
Duo Security
Zero Trust Access
Modern, effective
multifactor
authentication
Protect any
application
on any device
Deploy easily
in any
environment

57. 4 Improve System Management and Monitoring
Privileged Endpoint Security Services
Advanced Malware Protection
Endpoint Security
Block Threats
Before Compromise
Continuous Detection
and Response
Secure and
Trusted Access

58. 5 Facilitate Recovery and Ensure Continuity of Operations
Recovery Strategy
Talos Incident Response
Proactive and Reactive IR Services
IR Readiness
Assessments
IR Plans and
Playbooks
Emergency Incident
Response

59. There’s so
much more

60. 60© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Cisco SecureX
A cloud-native, built-in platform experience within our portfolio
Your Infrastructure
SIEM/SOARIdentity
3rd Party/ITSM Intelligence
Cisco Secure
ApplicationsCloud
Network Endpoint
Your teams
ITOpsSecOps NetOps
Investigation
Remediation
Managed
Policy
Orchestration
Automation
Detection
Analytics
Unified Visibility

61. 61© 2020 Cisco and/or its affiliates. All rights reserved.
Learn from Matt
at Black Hat
What to expect
when you'reelecting:
What Talos learned after 4 years of
research and hands-on experience
https://www.blackhat.com/us-20/
“The voter registration database is the
foundation of almost every state election
system in the United States,” said
Matt Olney, Director of Talos Threat
Intelligence. “It’s a center-piece of our
discussions with election officials and a
key target for our adversaries.
“MITRE's controls are well-aligned with
Talos' own analysis and
recommendations for defending
these vital systems.”
Wednesday,August 5
3:30-4:10pm ET
12:30-1:10pm PT
Matt Olney
Director, Threat
Intelligence and
Interdiction

62. And read
up on
election
security
MITREElectionIntegrity
https://www.mitre.org/news/focal-points/election-integrity
CISA #Protect2020
https://www.cisa.gov/protect2020
CiscoCybersecurityForGovernment
https://www.cisco.com/c/en/us/products/security/cisco-cybersecurity-for-
government.html
CiscoCybersecurityFrameworkGuidance
https://www.cisco.com/c/en/us/products/security/cybersecurity-framework-
guidance.html

64. CIS Control12
Boundary Defense
CIS Control7
Email and Web Browser Protections
CIS Control16
Account Monitoring and Control
CIS Control8
Malware Defenses
CIS Control19
Incident Response and Management
1
2
3
4
5
FilterNetworkTraffic
M1037
RestrictWeb-BasedContent
M1021
Multi-factorAuthentication
M1032
Antivirus/Antimalware
M1049
Data Backup
M1053
Mitigations