The IT Nerd

As the 2024 election nears, election officials finalize preparations to protect themselves against the most common threats seen targeting voters and campaigns. CISA recently released an Election Infrastructure Cybersecurity Readiness and Resilience Checklist, providing guidance on potential security incidents that may impact election infrastructure. 

Tom Marsland, VP of Technology for Cloud Range who has personally led live-fire simulation attacks on election infrastructure, including forensic analysis of voting machines and misinformation campaigns, has shared his thoughts on CISA’s checklist:

This checklist by CISA is a great reminder to election officials and participants about the basics – however, with less than two months until the election, many of these will be hard to implement if not at least begun already.  That said, it provides a clean slate for officials to take a step back and give their practices of cyber hygiene a holistic overview, and an honest look as they enter the final stages of preparation. I’ll repeat the findings from CISA that our elections are as secure as they’ve ever been. We really have to stay on top of misinformation campaigns and social engineering in that realm, but this is a great product for CISA, and I hope we see it used. 

A great way for election officials to test their readiness against the checklist provided by CISA is by conducting hands-on, tabletop exercises that test the organizations policies and playbooks against the very items called out in the checklist. Lessons learned from table top exercises should be incorporated into the organization’s continuous improvement, made actionable, and tracked to completion.

The CISA has put out a number of these sorts of checklists. But checklists aren’t good if they’re not followed. So here’s hoping that this one is followed as this November’s elections are going to be extremely important to the future of the US.

This week, CISA announced a new plan to align the “collective operational defense capabilities” of over 100 US central Government agencies outside defense to reduce their cyber-risk.

CISA notes in the plan that there is currently “no cohesive or consistent baseline security posture” across agencies, which fails to consider the current threat environment and the complex digital ecosystem.

The plan, known as FOCAL, for Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment, sets out both “broad organizing concepts for federal cybersecurity” and tactical guidance agencies should implement in the coming year. It covers five areas of cybersecurity including:

1. Asset management
2. Vulnerability management
3. Defensible architecture
4. Cyber supply chain risk management
5. Incident detection and response

While CISA stresses that each FCEB agency has its own mission, supported by its own networks and systems, with standardization and consistency, CISA also believes that a collective approach to cybersecurity will further reduce risks across all federal cyber defenses as agencies interact with each other and share data.

Emily Phelps, Director, Cyware had this to say:

  “CISA’s FOCAL plan highlights the value of collective defense in securing the federal cyber landscape. This approach leverages the strengths and knowledge of each entity to build a more robust defense against evolving threats. The interconnected nature of today’s digital ecosystem means that vulnerabilities in one area can ripple across others, making a collective defense strategy essential for reducing risk. By fostering collaboration, information sharing, and standardization, agencies can more effectively defend against sophisticated cyber adversaries while reinforcing the overall security of the nation’s critical infrastructure.”

Stephen Gates, Principal Security SME, Horizon3.ai follows with this:

  “This initiative is not just necessary—it’s long overdue. Now is the time to embrace a proven strategy that aligns with the five key objectives outlined in the plan. Organizations must begin by assessing their own environments, using the same tactics, techniques, and procedures (TTPs) that adversaries use. This ensures they’re effectively managing high-risk assets, identifying and mitigating exploitable vulnerabilities, and fortifying their architectures. This approach should extend to their supply chain, ensuring partners meet the same standards, and that incident detection and response systems are proven to be fully operational.”

This is a good move by the CISA who has a history of coming up with good initiatives to improve cybersecurity inside and outside government. This is something that seriously needs to be copied by the private sector as I think you will see that this is going to be highly effective in terms of deterring cyberattacks.