,
5 tweets,
2 min read
Read on Twitter
Scoop: Voting technology vendors are meeting next month to complete a plan for an industry-wide coordinated vulnerability disclosure program:
subscriber.politicopro.com/cybersecurity/…
The vendors got a CVD briefing at an April meeting with the EAC. But it's unclear how many will join the program.
subscriber.politicopro.com/cybersecurity/…
The vendors got a CVD briefing at an April meeting with the EAC. But it's unclear how many will join the program.
Major voting technology vendor ES&S wants the EAC to provide an ETA for certifying software updates. (Vendors don't want updates that fix vulnerabilities to linger in the queue.)
That could be sticking point for this program.
That could be sticking point for this program.
Needless to say, with the EAC's testing team as short-staffed as it is, it will be difficult to promise rapid certification in cases where there's a large volume of updates coming in, which could happen.
The vendors' CVD planning is taking place under the auspices of the @ITISAC's Elections Industry Special Interest Group.
The EI-SIG meets with IT-ISAC officials every two weeks, per a source, and CVD “is the primary topic discussed at these meetings.”
The EI-SIG meets with IT-ISAC officials every two weeks, per a source, and CVD “is the primary topic discussed at these meetings.”
ES&S recently told @gregotto that it's willing to participate in a CVD program, but only if all the other vendors participate too. cyberscoop.com/election-secur…
