How a Florida county’s election office solved authentication challenges

The volume of ransomware attack attempts in the first half of 2021 was 150% higher than the same time in 2020. Despite this alarming increase, many local governments lag behind other organizations in adopting modern cybersecurity practices, leaving them woefully unprepared for the onslaught of attacks they face.

Government agencies have been particularly susceptible to ransomware attacks. Over 40% of central government organizations were targeted in 2020 because their data stores are highly tempting to cybercriminals who want citizens’ sensitive data for phishing and identity theft. Attackers may also be attempting to steal classified data and undermine citizen confidence.

Smaller cities and agencies face a unique set of challenges that make them especially vulnerable to attacks. They operate with decentralized budgets and security operations, while large federal, state and local government agencies have the reach, budget and personnel to deliver higher security. The nation’s smaller cities, municipalities, counties and agencies unwittingly offer a wide array of attack options to cybercriminals.

Some government agencies, however, have begun preventing attacks by taking a more active approach to threats.

Florida’s Orange County Election Office, whose staff comprises a broad spectrum of full- and part-time employees and volunteers, is one such example. The OC Office needed a cybersecurity solution to protect voter data and files to prevent vote tampering and fraud, while also ensuring easy access for its employees.

Since the staff shares workstations, secure multi-factor authentication (MFA) access was crucial. During election cycles, many new staffers are added, increasing the need for secure, efficient, adaptable authentication solutions that provide a transparent user access audit trail.

Election officials needed an easy-to-deploy and cost-effective authentication solution. For election security, the OC Elections Office sought an alternative to user-controlled, device-based biometric methods. They wanted a solution to ensure that only authorized users could access their online identity, preventing information from being accessed by unauthorized users or hackers. They also needed the solution to be affordable to meet disciplined IT resource investment goals as well as easy to deploy and manage.

The OC Office partnered with an access management and biometric identity provider to deploy solutions that checked all the boxes on their list of requirements. In 2018, the firm created a voting systems application that focused on ensuring poll workers and volunteers were securely authenticated before they’re granted access to high-value data, such as voting machine data, systems and networks.

In 2021, the OC Elections Office expanded this partnership and strengthened its cybersecurity posture with identity-bound biometrics (IBB), which offers a stronger alternative to user-controlled, device-based biometric methods. This enterprise solution keeps the office’s data safe by positively identifying the users who attempt to gain access.

Cybersecurity solutions that government agencies can implement today:

The best way for agencies to start improving cybersecurity is to make a plan for strengthening organizational login procedures. Here are key areas that can be addressed today:

Strengthen identity and authentication. Agencies should break the habit of relying on usernames and passwords for proving identity and gaining access to sensitive, confidential, secret and other personal data. Passwords are susceptible to phishing attacks, password spraying, brute-force attacks and password compromises. In 2015, a data breach in the Office of Personnel Management that compromised the sensitive information of 21.5 million individuals was traced back to stolen login credentials.

Implement strong multi-factor authentication. Government agencies must take specific actions to upgrade their cybersecurity practices and implement stronger controls, such as MFA, before they are attacked. Traditional authentication methods often include a personal identification number or one-time password that’s sent to or stored on a device the user owns, such as a phone, hardware token, or even a credit card chip.

Not all authentication methods offer the same level of security, and solutions can be enhanced with stronger protections. MFA approaches that feature IBB and public-key cryptography offer greater security than those that rely on SMS codes and email notifications. In situations where the highest level of identity verification is needed, IBB offer the only way to positively identify an individual, rather than a device or token. Biometrics are just as convenient and a good alternative for users in an environment rife with variations in device capabilities, forgotten tokens or phones and cell coverage dead spots.

Governments must act now

Governments need to secure their networks before it’s too late. A single cyberattack can wipe out funds, halt work or deprive citizens of their vote, and hackers are well aware of how easy small government agencies are attack. Strengthening cybersecurity requires careful planning and a roadmap to implementing controls. The best way to start improving cybersecurity is to make a plan: assess risks, develop security policies, implement critical controls such as MFA and know how they will respond to an incident.