**EAC Standards Board / Board of Advisors Meeting**

December 12, 2007

Nelson Hastings

Barbara Guttman

National Institute of Standards and Technology

Agenda

n Background

n Software Independence

n Innovation Class

n Cryptography, Communication Security, and System Event Logging

n Open Ended Vulnerability Testing (OEVT)

n Other Security Requirements

Background

n The security requirements of the next VVSG work together to support
equipment security

n Difficult to understand security provided by a single requirement or
set of requirements without understanding how requirements relate to
each other

Types of Security Controls

n Procedural verses Technical Controls

n Voting equipment requirements is about

n Technical controls

n Technical components used to realize management and/or operational
(procedural) controls

Security Controls of VVSG

n General technical security controls

n Based NIST Special Publication 800-53: Recommended Security Controls
for Federal Information Systems

n Voting equipment specific technical security controls

Defense in Depth

n Strategy of multiple layers of defense are placed on a system

n Attackers should have to break through multiple defensive
countermeasures in order to be successful

Software Independence

n TGDC Resolution 06-06 requires software independence (SI)

n Software Independence means that changes must be detectable

n Detectable, in practice, means auditable

SI = Auditable

Why Does the TGDC Want SI?

n With software, it is pretty easy to make a screen say one thing, but
record another thing inside the computer.

n The hard part is making plausible, directed changes.

Auditing Records

n Two types of records

n Electronic records

n Independent records

How Does the VVSG Address Auditability?

n Requires equipment to have features that can be used for various types
of audits

n Requires documentation

n NOTE -- The VVSG itself does not require auditing -- This is
procedural and outside the scope.

Independent Voter Verifiable Records (IVVR)

n What is an independent voter verifiable record?

n Direct verification by voter

n Support for hand auditing

n Various security and operational properties (can be rejected/durable)

n Doesn't this mean paper?

Independent Voter Verifiable Records (IVVR)

n Direct review (by voter & election official)

n Can support a hand audit

n Can support a recount

n Durable

n Tamper evidence

n Support for Privacy

Independent Voter Verifiable Records (IVVR)

n Public Format

n Sufficient Information (ballot configuration, not just selections)

n No codebook required

n Support for multiple physical media

n Able to be accepted or reject (per media)

n Non-human readable allowed (public format)

Independent Voter Verifiable Records (IVVR)

n Two current types of IVVR

n Voter Verifiable Paper Audit Trail (VVPAT)

n Optical Scan

Voter Verifiable Paper Audit Trail (VVPAT)

n VVPAT & Accessibility addressed by HFP

n Note need for observational testing

n Many operational requirements

n Paper rolls allowed

Voter Verifiable Paper Audit Trail (VVPAT)

n Components and definitions

n Printer/computer interactions

n Protocol of operations

n Human readable contents

n Linking electronic and paper records

n Paper roll privacy

Innovation Class

n All voting systems must be software independent (SI)

n 2 Paths:

n Independent Voter Verifiable Record (IVVR)

n Voter Verifiable Paper Record (VVPR)

n Non paper

n Innovation Class

Innovation Class

n Meet software independence (SI) without Independent Voter Verifiable
Record (IVVR)

n Promote innovation

n Better security

n Better accessibility

n Better usability

Innovation Class

n Innovation class (IC) procedures are role of EAC

n TGDC provided some advice:

n Technologies must be new and different

n Meet goal of fair, accurate, transparent elections

n Meet all relevant VVSG requirements

Cryptography

n Powerful security technique

n Information Integrity

n Information Authentication

n Requirements developed to provide easy use and maintenance

n Key management particularly

n Use strength of existing federal standards

Cryptography

n Cryptographic voting protocols (a.k.a End-to-End voting systems) not
yet mature enough for standardization

n Many sections of the next VVSG leverage the security capabilities that
cryptography provides

Cryptography

n FIPS 140-2 validated cryptographic module

n Minimum strength of cryptography

n Signature Module

n A hardware cryptographic module

n Generates digital signatures

n Generates and stores private signature keys

n Permanently attached to voting equipment

Cryptography

n Key management is critical in achieving the expected security
properties of cryptography

n Generation of keys - part of voting equipment setup process

n Destruction of keys - part of election close out process for voting
equipment

n Distribution of keys - limited

Communication Security

n Protection of voting system communications

n Transmission of information

n Communications based threats

n No use of wireless technology

n Exception for infrared technology

Communication Security

n Communication within polling place allowed

n No remote communication to voting devices during election day

n Exceptions for devices used to transmit end of day results and
communication with voter registration databases

n However, these devices cannot be connected to other polling place
devices

Communication Security

n Disable physical network interfaces when not required

n Monitor network interfaces for evidence of attack

n Integrity information for data via cryptography

n Mutual authentication between devices before exchange of information

Communication Security

n Limit communications to only devices that are required to communicate
with each other

n List of all network communication required for processes and
applications

n List of all network ports, shares, services, and protocols used

System Event Logging

n Provides accountability and supports the ability to reconstruct events
and detect intrusions

n Electronic audit trail

n Information to be generated

n Integrity protection of the information

n Management of system event log information

System Event Logging

n Log information must maintain voter privacy and ballot secrecy

n Basic log entry information

n System Identifier

n Event Identifier

n Time Stamp

n Result of event

n When applicable, user that triggered event and requested resource

System Event Logging

n Time Stamp requirements

n Format of time stamp

n Day, month, and four digit year

n Hours, minutes, seconds, and time zone

n Clock drift

n Limits on who can adjust clock

System Event Logging

n Minimum list of events to be logged

n General system functions events

n Authentication and access control events

n Software events

n Cryptographic events

n Voting events

System Event Logging

n Management requirements

n Default setting of system event log

n Storage of log information in a publicly documented format such as XML

n Event logs separable on an election and device basis

n Retention of event log data from previous elections

System Event Logging

n Management requirements (continued)

n Export of log information with digital signature

n Log capacity management

n Tools to view, analyze, and search system event log while on voting
device

n Halt vote capturing when system log malfunctions or is disabled

n Limits on who can configure and clear system event logs

System Event Logging

n Protection of log information

n Unauthorized access

n Unauthorized modification

n Unauthorized deletion

n Integrity and availability protection of archived log information

Open Ended Vulnerability Testing(OEVT)

n Attempts to bypass the security of a system

n Discover flaws that could be used to

n change the outcome of an election,

n interfere with voters' ability to cast ballots or have their votes
counted

n compromise the secrecy of the vote

Open Ended Vulnerability Testing(OEVT)

n NOT a way to prove that a system is secure

n NOT bound by a pre-determined test plan

n Specific findings may differ between test teams

n Consistent framework for discussing flaws that are found

Open Ended Vulnerability Testing (OEVT)

n The test team

n Figures out how the system works

n Identifies the vulnerabilities -- actual and potential

n Attempts to break-in using a variety of different approaches

Open Ended Vulnerability Testing (OEVT)

n Team made up of security and election management experts

n Minimum of 12 staff weeks of testing

n Team given a voting device and associated technical data package (TDP)
and user documentation

Open Ended Vulnerability Testing (OEVT)

n Team given a description of how significant plausible threats are
addressed

n Team examines system within the context of a process model with
plausible threats

Open Ended Vulnerability Testing (OEVT)

n Reasons for failure:

n A violation of mandatory VVSG requirements

n Inadequate means to mitigate a significant plausible known threat

n Flaws that could be used to change outcome of election, compromise the
secrecy of the vote, or interfere with voter's ability to cast ballot or
vote counted

Open Ended Vulnerability Testing (OEVT)

n Report documents information associated with testing effort including

n Threat scenarios considered

n Threat scenarios identified but not investigated

n Discussion of remaining vulnerabilities

n Level of effort and qualifications of each team member

Other General Security Requirements

n Security Documentation

n Setup Inspection

n Software Installation

n Access Control

n System Integrity Management

n Physical Security

Security Documentation

n Technical Data Package

n Provided to test lab to assist in the testing campaign

n General security documentation about

n Security Architecture

n Security Threat Controls

n Security Testing and Vulnerability Analysis

n Detailed implementation specification for each security mechanism

Security Documentation

n User Documentation

n Provided to user of the voting system

n How security mechanism are to be used

n Information needed to support security features

Setup Inspection

n Requirements related to the capabilities to inspect properties of
voting devices

n Inspections generate system event log entries

n Software identification verification

Setup Inspections

n Software integrity verification

n SI approach allows for internal verification

n NO external interface requirement unlike VVSG 2005

n Voting device election information inspection

n Generalized register and variable terminology from VVSG 2005

n Support zero total inspections prior to use in election

Setup Inspection

n Inspection of properties of voting device components

n Backup power supply level

n Cabling connectivity indicator

n Communications operational status and on/off indicators

n Consumables remaining indicator

n Calibration determination and adjustments

Software Installation

n Requirements related to the installation of software on voting devices

n Including access and modification of configuration files

n Software installation generates system event log entries

Software Installation

n Digital signature verification of software before installation

n National Software Reference Library (NSRL)

n Designated repositories

n Externally visible alert when software installation fails

Software Installation

n Software installation only when in pre-voting state

n Limits on who can perform software installation

n Software to only be able to be installed using documented procedures

Access Control

n Supports the ability of the voting system to

n Account for users actions

n Limits use of resources

n Applies to individuals, applications, and processes of the voting
system

n Requirements focus on

n Logical access control

n Technical aspects of physical access controls of the voting equipment

Access Control

n The management of three basic elements of access control

n Identification - distinguishing between different users

n Authentication - proving a user is who they claim to be

n Authorization - permission to use a resource

Access Control

n Role identification

n Required for voting devices and election management systems

n Roles specified: Voter, Election Judge, Poll Worker, Central Election
Official, and Administrator

n Individual identification

n Required by election management systems

Physical Security

n Requirements to ensure that sufficient controls are in place to
prevent undetected, unauthorized physical access.

n Requirements recognize use of a combination of procedures and physical
countermeasures without prescribing either

Physical Security

n Unauthorized physical access must leave physical evidence

n Control and use procedures for door covers and panels must be
sufficient to monitor access

n Ballot boxes must be tamper evident

n Physical locks and keys used for security purposes must meet UL
standards and be tamper evident

n They must also be keyed per System Owner's preference

Physical Security

n If the power disrupted or fails, physical countermeasures should not
fail

n Control and use procedures for physical port access and least
functionality must be sufficient to monitor access

n Physical ports must be able to be manually disabled

n Broken connections between components must result in automatically
disabling the relevant port, setting off an alarm, creating an event
log, and only re-enabling with appropriate authorization

System Integrity Management

n Security controls that do not fit into other sections of the VVSG

n Boot, load, and execute process protection

n Removable media interface protection

n Backup and recovery capabilities

n Malicious software protection