Thread by @mattblaze

Note: if I comment that it’s extremely unlikely that your state or local government election website can withstand attack from a foreign intelligence agency, I’m not casting aspersions on your competence. I’m stating a harsh reality that you really need to think about.

I don’t know how to reliably secure a complex internet facing service against a state adversary. No one I know does, either. The only people I’d trust to try understand this.

So what should state and local election officials do? Start by planning for scenarios where your web systems get compromised. Because they might be, no matter how confident you are that they won’t.

It's also worth noting that the (publicly reported) Russian attacks against US state and local election systems in 2016 represented nowhere near the full capabilities of a determined nation-state actor. There's a lot more to defend against than spearphishing attacks.

A full-in attack from an intelligence agency looks a lot more like Stuxnet than what happened in 2016. There are no reliable defenses against such an adversary, at least not if you're not a national intelligence agency yourself. The only defense is a good plan for recovery.

Of course, as we saw in 2016, intelligence agencies don't always (or even usually) unleash their full capabilities. So defend against phishing, have backups, and patch things. But also have a recovery plan for when that fails.

Also, reupping this, where I go into this in more detail. mattblaze.org/papers/blaze-g…