By the Numbers: How Election Cybersecurity Improved [and How It Didn't]

How has election cybersecurity changed since 2016?

In major ways, and for the better, according to a brand new elections cybersecurity scorecard issued by the Center for Strategic and International Studies.

The CSIS says 99% of all votes in the United States will be cast, counted or tabulated by a computer in the 2018 mid-term elections. And with more than 10,000 local election entities spread across the U.S., you can imagine the threat landscape when it comes to hacking an election. The landscape is huge.

More state elections offices implementing cybersecurity best practices

Here is what we view as the most hopeful graphic of the report:

Here are state elections security improvements, by the numbers, during the 2018 midterms:

• All 50 states are involved in MS-ISAC for government agencies to share info
• 46 states have established best practices on access
• 43 states have best practices on vulnerability analysis and intrusion detection
  

And there are more improvements, according to the CSIS election cybersecurity scorecard:

"This includes 26 states that have conducted security assessments and implemented cybersecurity upgrades, 20 states that have invested in enhanced cybersecurity training for election officials, 15 states that have upgraded or replaced voting equipment, and nine states that are expanding post-election audits."

All of this since the 2016 presidential election.

Some states lag behind on election cybersecurity

 What's frightening of course, is that 6 states decided not to participate in the Department of Homeland Security's tabletop exercises to practice incident response and information sharing. 

And 14 states do not have a paper audit trail for all voters. And 10 states did not report spending federal dollars to improve cybersecurity this year, even though the government offered it to them.

There is more work to be done as you can read in the complete Elections Cybersecurity Scorecard.

The report, by the way, concludes like this:

"If Russia, or any other foreign adversary, attempts to interfere with the 2018 midterm elections, they will find this country better secured, better prepared, and ready to take action to defend our sovereignty. But federal, state and local officials must continue to work after November to strengthen the security of election systems for 2020 and beyond.

We will be ready for Russia’s 2016 tactics in 2020, but our adversaries continue to innovate, and it will take sustained effort and investment to maintain the security and resilience of American democracy against cyber threats."

At SecureWorld, we look forward to helping in that fight by bringing cybersecurity leaders and teams together in 17 cities during 2019.