Part V: Computer Security and the next VVSG

1
Part V Computer Security and the next VVSG

• October 15-17, 2007
• Nelson Hastings
• National Institute of Standards and Technology
• nelson.hastings_at_nist.gov

2
5.2 Setup Inspection

• Requirements related to the capabilities to
  inspect properties of voting devices
• Reflects new focus of requirements in light of
  software independence (SI) approach

3
5.2 Setup Inspection

• Inspections generate system event log entries
• Time and date
• Information related to the specific inspection
• Location of software files
• Component calibration
• Result of inspection
• Voting device unique identification
• Individual (or role) that performed inspection

4
5.2 Setup Inspections

• Software identification verification
• Ability to query/inspect the voting device to
  determine what software is installed
• Software integrity verification
• Using digital signatures and hash
• Designated repositories such as National Software
  Reference Library (NSRL)
• Voting Device Owner - Jurisdiction
• SI approach allows for internal verification
• NO external interface requirement unlike VVSG 2005

5
5.2 Setup Inspection

• Voting device election information inspection
• Ability to query/inspect the storage locations
  containing information that changes during an
  election
• Number of ballots cast
• Totals for a given contest
• Generalized register and variable terminology
  from VVSG 2005
• Support zero total inspections prior to use in
  election

6
5.2 Setup Inspection

• Inspection of properties of voting device
  components
• Backup power supply level
• Cabling connectivity indicator
• Communications operational status and on/off
  indicators
• Consumables remaining indicator
• Calibration determination and adjustments

7
5.2 Setup Inspection

• User documentation requirements
• Model setup inspection process supported by
  voting device
• Minimally includes items mentioned previously
• Manufacturer provided
• Model inspection check list of other properties
  supported by the voting device
• Manufacturer provided
• Risks related to not performing a given inspection

8
5.3 Software Installation

• Requirements related to the installation of
  software on voting devices
• Also covers access and modification of
  configuration files
• Uses digital signatures to provide the ability to
  verify the authentication and integrity of the
  software
• National Software Reference Library (NSRL)
• Designated repositories

9
5.3 Software Installation

• Software installation only when in pre-voting
  state
• Only individuals with an administrator or central
  election official role can install software
• Central Election Officials limited to election
  specific software or data files

10
5.3 Software Installation

• Digital signature verification of software before
  installation
• Externally visible alert when software
  installation fails
• Software to only be installed using documented
  procedures

11
5.3 Software Installation

• Software installation generates system event log
  entries
• Time and date
• Software name and version
• Location installed software
• Digital signature verification
• Result of software installation

12
5.3 Software Installation

• Technical Data Package (TDP) requirements
• List of all software to be installed on voting
  system
• Name and version
• Manufacturer contract information
• Type of software
• Software documentation
• Location software is to be installed
• Functionality provided by the software
• Dependences and interactions between the software

13
5.3 Software Installation

• User documentation
• List of all software to be installed on voting
  system including election specific software
• Hardware and software needed to install software

14
5.3 Software Installation

• Procedures used to perform software installation
• No use of compilers
• COTS software to be obtained via open market
• How to create a baseline binary image for
  replication
• Preparations of erasable media
• Software from unalterable media - CDs
• Record resulting from the installation procedure

15
5.4 Access Control

• The management of three basic elements
• Identification
• Authentication
• Authorization
• Supports the ability of the voting system to
• Account for users actions
• Limits use of resources
• Applies to individuals, applications, and
  processes of the voting system

16
5.4 Access Control

• Management of identification information
• Creating and disabling identities or roles
• Failed attempts lock out
• Number of failures within in a time period
• Length of lockout time

17
5.4 Access Control

• Role identification
• Required for voting devices and election
  management systems
• Roles specified Voter, Election Judge, Poll
  Worker, Central Election Official, and
  Administrator
• Individual identification
• Required by election management systems

18
5.4 Access Control

• Management of authentication information
• Setting and changing authentication information
• Protection of authentication data by system
• Password management - strength, reuse, and
  expiration.

19
5.4 Access Control

• Authentication requirements by role
• Voter in Section 7.5.1 Issuance of voting
  credentials and ballot activation
• Poll Worker - N/A
• Election Judge and Central
• Something you know (user name or password)
• Administrator
• Multi-factor authentication - smartcard,
  biometric
• Application or Process
• Cryptographic techniques specifically digital
  signatures

20
5.4 Access Control

• Authorization Management
• By voting system state, time interval, or
  specific time
• Dual person control
• Separation of duties
• Limitations to resources
• Functions and data
• Explicitly allowed or disallowed

21
5.4 Access Control

• Technical Date Package (TDP) requirements
• Descriptions and specifications of all access
  control mechanisms used
• Descriptions and specification of all voting
  system mechanisms that rely on access control
• Mapping of all voting system operations and
  default roles with permissions to perform
  operations

22
5.4 Access Control

• User documentation requirements
• Instructions for implementing, configuring, and
  managing
• Model access control policy
• Templates or instructions for custom access
  control policy creation
• Disclosure of all default privileged roles

23
End of Presentation

• Additional VVSG Training Modules at
• http//vote.nist.gov

Next VVSG Training