Information Systems Security

Election Cyber Security in the U.S.

The U.S. intelligence officials have indicated on many occasions that Russia is likely to attempt to meddle with 2018 contests after doing so in 2016 presidential campaign. The DHS chief stated that Department of Homeland Security (DHS) was making an election cybersecurity a priority on top of other critical infrastructures such as financial, energy, and communications systems. DHS noted that in 2016 approximately 21 states had an initial probe of their systems from interference by Russian hackers where it was discovered that a small number of networks had been compromised although there was no evidence about the alteration of any votes (Shepardson, 2018).

The security threats to the electronic voting became prevalent when the states adopted the direct-recording electronic (DRE) voting machines in the 1990s and in the early 2000s. The systems, which are currently outdated heightens the vulnerability. The advances in technology imply that the voting machines have a shorter lifecycle. A number of breaches to the voting security have already been experienced seeking to gain access to the election information. Such was the case when a Russian political hacker interfered with the Democratic National Convention and leaked the party donor lists and the party’s opposition research, which was seen as a move to sway the American perception. Another incident was a breach by a cybersecurity researcher to the Florida election website, which gave him access to the county’s voter names, passwords, and records. Another major incident was experienced in Georgia, which elections officials termed as a rare error where the system failed to properly upload its vote tallies (Gumbel, 2018).

The importance of election cybersecurity saw the Department of Homeland Security designate election systems as critical infrastructure. This saw the creation of a subsector under the existing Government Facilities Sector. The election systems are thereby placed under designated security to safeguard the nation’s democratic process (Department of Homeland Security, 2018).

References

Department of Homeland Security. (2018). DHS Cybersecurity Services Catalog for Election Infrastructure. Retrieved from https://www.eac.gov/assets/1/6/DHS_Cybersecurity_Services_Catalog_for_Election_Infrastructure.pdf

Gumbel, A. (2018). Why US elections remain Dangerously Vulnerable to Cyber-Attacks. Retrieved from https://www.theguardian.com/us-news/2018/aug/13/us-election-cybersecurity-hacking-voting

Shepardson, D. (2018). Homeland Security Unveils New Cyber Security Strategy Amid Threats. Retrieved from https://www.reuters.com/article/us-usa-cyber/homeland-security-unveils-new-cyber-security-strategy-amid-threats-idUSKCN1IG2L9

Information Technology Security

Information security controls are defined as controls that are applied to information systems to protect the confidentiality, integrity, and availability of systems and the information they process, store, and exchange. Many organizations understand the importance of information security and institutes controls in place. Information security should not be considered a condition but an ongoing task (Bachlechner, Maier, Innerhofer-Oberperfler, & Demetz, 2011). The information security management is deemed to be important to ensure that they protect the information and give confidence to the interested partners.  

Control is described as a means of managing risks including policies, procedures, guidelines, practices, and organizational structures. The selection of controls is pegged on the analysis of risk in the form of likelihood-weighted cost-benefit analysis (Martin, Lyle, & Namiluko,2012). Information security systems are important to reduce the risk of crisis in an organization. The controls are also essential to minimize the effects of the crisis occurring outside an organization (Wawak, 2010).

California passed the consumer privacy law that will cause a shift in how companies manage personal data, especially the ones operating on digital space. The new law provides a different range of rights including being informed about the kinds of personal data collected and the reason why it is collected. California is noted to be the first state that enacted a comprehensive law protecting content, location data, metadata, and devices searches. The law points out to the category of data including consumer’s personal identifiers, geolocation, biometric data, internet browsing history, psychometric data, and personal inferences that a company might make about a consumer.

Another policy that governs the information systems is the California Cybersecurity Integration Center (Cal-CSIC). The law sought to minimize the likelihood and severity of cyber-attacks, enhance inter-agency and cross-information coordination, prioritize cybersecurity threats and inform potential victims’ entities, and strengthen the state’s cybersecurity strategy. The partners in implementing this law include California Governor’s Office of Emergency Service, California Department of Technology, California Military Department and California Highway Patrol. Other partners include the federal, state and private sector stakeholders such as the FBI and DHS.

References

Bachlechner, D., Maier, R., Innerhofer-Oberperfler, F., & Demetz, L. (2011). Understanding the management of information security controls in practice. Edith Cowan University. Retrieved from https://ro.ecu.edu.au/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1108&context=ism

Martin, A. P., Lyle, J., & Namiluko, C. (2012). Provenance as a Security Control. In TaPP.

Spidalieri, F. (2015). State of the States on Cybersecurity. Newport, RI: Pell Center, P37.

Wawak, S. (2010). The Importance of Information Security Management in Crisis Prevention in the Company.