{"id":34659,"date":"2020-08-20T15:09:44","date_gmt":"2020-08-20T19:09:44","guid":{"rendered":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/?p=34659"},"modified":"2020-08-20T15:09:44","modified_gmt":"2020-08-20T19:09:44","slug":"election-security-ohio-vulnerability-disclosure-program-indicates-maturity","status":"publish","type":"post","link":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","title":{"rendered":"Ohio’s vulnerability disclosure program for elections indicates ‘maturity’"},"content":{"rendered":"

A pair of cybersecurity experts on Thursday praised Ohio’s new\u00a0vulnerability disclosure policy for its election-related websites as being a mark of a mature organization.<\/p>\n

Speaking during a weekly briefing led by Ohio Secretary of State Frank LaRose,\u00a0who announced the policy<\/a>\u00a0earlier this month,\u00a0Matt Olney, a director at Talos, Cisco’s threat intelligence division, and Matt Masterson, a senior adviser to the federal Cybersecurity and Infrastructure Security Agency, said the new initiative shows how far along some state governments have come in protecting their election infrastructure.<\/p>\n

“The vulnerability disclosure policy invites the best and brightest,” Olney said of the policy, which permits independent cybersecurity researchers to look for and notify officials of vulnerabilities in election-related websites without fear of legal ramifications.<\/p>\n

Ohio’s vulnerability policy \u2014 the first created by any statewide election authority \u2014 only applies to websites, not physical equipment such as voting machines or electronic pollbooks. Still, LaRose said, the policy shows that Ohio officials are open to assistance from white-hat hackers.<\/p>\n

“We wanted to unleash the great minds that are out there to tell us where we\u2019ve left a hole in our fence,” he said.<\/p>\n

Olney also said it indicates how much Ohio election officials have come to appreciate the role of cybersecurity in their operations.<\/p>\n

“It can be a little out of the blue for someone to call you and say, ‘Hey, your baby is ugly,'” he said. “It’s a very specific, very technical capability.”<\/p>\n

Masterson, whose agency conducts routine scans of state and local networks as part of its role protecting critical infrastructure, said that vulnerability disclosure policies can be a low-cost way for governments to expand their IT and cybersecurity efforts.<\/p>\n

“You get the benefit of the federal government testing your systems,” he said. “Now you get the benefit of researchers across the country. That is significant. You\u2019ve basically increased your IT workforce and security workforce exponentially by allowing that kind of engagement with the cybersecurity community.”<\/p>\n

Masterson also said that CISA recently published a guide<\/a> for state election officials on how to establish vulnerability disclosure programs.<\/p>\n

A good disclosure policy, he said, can help states and counties protect themselves against attacks like ransomware, which both CISA and industry experts have cited as a lingering threat against election-related IT<\/a>, especially voter registration databases<\/a> and the websites on which counties and states post unofficial results on election nights.<\/p>\n

In Ohio, at least, all 88 county election boards are members of the Election Infrastructure Information Sharing and Analysis Center, the Department of Homeland Security-funded organization through which election officials share security information. LaRose in recent months has also implemented statewide use of endpoint detection monitoring software and required counties to develop contingency plans for any incident that disrupts the voting process.<\/p>\n

“The bad guys only have to be right once,” he said. “We have to be right every day.”<\/p>\n","protected":false},"excerpt":{"rendered":"

The first-in-the-nation policy allows independent researchers to look for flaws in voter registration websites across the state’s 88 counties.<\/p>\n","protected":false},"author":200,"featured_media":34663,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false},"categories":[4675,4677],"tags":[54,125,5351,5803,10400],"people":[],"special-report":[],"authors":[4697],"class_list":["post-34659","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-county-local","category-state","tag-ohio","tag-election-security","tag-matt-masterson","tag-frank-larose","tag-vulnerability-disclosure","author-benjamin-freed"],"yoast_head":"\nOhio's vulnerability disclosure program for elections indicates 'maturity' | StateScoop<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ohio's vulnerability disclosure program for elections indicates 'maturity' | StateScoop\" \/>\n<meta property=\"og:description\" content=\"The first-in-the-nation policy allows independent researchers to look for flaws in voter registration websites across the state's 88 counties.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-08-20T19:09:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2000\" \/>\n\t<meta property=\"og:image:height\" content=\"1335\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Benjamin Freed\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@brfreed\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/\",\"name\":\"Ohio's vulnerability disclosure program for elections indicates 'maturity' | StateScoop\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/08\\\/LaRose-6.jpg\",\"datePublished\":\"2020-08-20T19:09:44+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/08\\\/LaRose-6.jpg\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/08\\\/LaRose-6.jpg\",\"width\":2000,\"height\":1335,\"caption\":\"Frank LaRose (Georgebailey2015)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#website\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/StateScoop-Black.png\",\"contentUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/StateScoop\\\/\",\"https:\\\/\\\/x.com\\\/State_Scoop\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/statescoop\\\/\",\"https:\\\/\\\/www.youtube.com\\\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ohio's vulnerability disclosure program for elections indicates 'maturity' | StateScoop","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","og_locale":"en_US","og_type":"article","og_title":"Ohio's vulnerability disclosure program for elections indicates 'maturity' | StateScoop","og_description":"The first-in-the-nation policy allows independent researchers to look for flaws in voter registration websites across the state's 88 counties.","og_url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2020-08-20T19:09:44+00:00","og_image":[{"width":2000,"height":1335,"url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg","type":"image\/jpeg"}],"author":"Benjamin Freed","twitter_card":"summary_large_image","twitter_creator":"@brfreed","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","name":"Ohio's vulnerability disclosure program for elections indicates 'maturity' | StateScoop","isPartOf":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/#primaryimage"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/#primaryimage"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg","datePublished":"2020-08-20T19:09:44+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/#primaryimage","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg","width":2000,"height":1335,"caption":"Frank LaRose (Georgebailey2015)"},{"@type":"WebSite","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#website","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#organization","name":"StateScoop","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/sandbox.statescoop.com\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Ohio’s vulnerability disclosure program for elections indicates ‘maturity’","url":"http:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/scoopmedia-develop.go-vip.net\/statescoop\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\/"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg"},"articleSection":"County & Local","author":[{"@type":"Person","name":"Benjamin Freed","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/author\/benjamin-freed\/"}],"creator":["Benjamin Freed"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/develop.statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["election security","frank larose","matt masterson","ohio","vulnerability disclosure"],"dateCreated":"2020-08-20T19:09:44Z","datePublished":"2020-08-20T19:09:44Z","dateModified":"2020-08-20T19:09:44Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"Ohio’s vulnerability disclosure program for elections indicates ‘maturity’\",\"url\":\"http:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/election-security-ohio-vulnerability-disclosure-program-indicates-maturity\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/08\\\/LaRose-6.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2020\\\/08\\\/LaRose-6.jpg\"},\"articleSection\":\"County & Local\",\"author\":[{\"@type\":\"Person\",\"name\":\"Benjamin Freed\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/author\\\/benjamin-freed\\\/\"}],\"creator\":[\"Benjamin Freed\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/develop.statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"election security\",\"frank larose\",\"matt masterson\",\"ohio\",\"vulnerability disclosure\"],\"dateCreated\":\"2020-08-20T19:09:44Z\",\"datePublished\":\"2020-08-20T19:09:44Z\",\"dateModified\":\"2020-08-20T19:09:44Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/sandbox.statescoop.com\/p.js"},"jetpack_publicize_connections":[],"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop","push-errors":false,"jetpack_featured_media_url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2020\/08\/LaRose-6.jpg","_links":{"self":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts\/34659","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/users\/200"}],"replies":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/comments?post=34659"}],"version-history":[{"count":3,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts\/34659\/revisions"}],"predecessor-version":[{"id":34664,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts\/34659\/revisions\/34664"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/media\/34663"}],"wp:attachment":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/media?parent=34659"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/categories?post=34659"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/tags?post=34659"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/people?post=34659"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/special-report?post=34659"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/authors?post=34659"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}