Procurement and Cybersecurity

Enhancing Confidence

Introductions

Nice to meet everyone

Our consultancy aims to help public and private entities understand how policy impacts their technology (and vice versa) through process modeling, data analysis, and policy research.

Selected works

Our team

The state of things

The good and the bad

https://learn.cisecurity.org/NCSR-2022-Summary-Report

https://verizon.com/dbir/

High stakes require high standards

…but how to make sense of it all?

It takes a village

“Procurement teams, IT teams and IT security teams all have a role to play in making successful IT deployments possible.”

Recommendations

• States should establish a rigorous third-party (vendor) assessment and accountability system
• States should establish a process to regularly monitor security practices of all third parties involved in current state contracts
• Thorough market research should be conducted to identify risks, industry trends and solicitation best practices.

No shortage of information

• Attestations
• Self-assessments
• Third-party assessment reports
• Continuous monitoring

Center for Internet Security’s RABET-V program

A case study in product verification

Steering Committee: Representatives from Indiana, Maryland, Ohio, Pennsylvania, Texas, Wisconsin, EAC, CISA, NASED, and FVAP

Technical Advisory Committee: Representatives from CIS, NIST, Carnegie Mellon University, OWASP, Akamai, and the Atlantic Council

https://www.cisecurity.org/elections/rabetv

Understanding RABET-V

Fundamentals and objectives

Testing to meet modern software development

• Non-voting election technology differs greatly in use and threat from voting systems
• The development cycle demands a nimbler approach
• RABET-V: long name, short turnaround
• Re-evaluates product versions more quickly and at lower cost for products with higher quality organizational processes and product architectures

​

How does RABET-V differ from other programs?

• Follows industry best practices
• Evaluates the product, the organization, and the environment in which it is developed.
• Incentivizes continual improvement and incremental changes by simplifying verification and rewarding security maturity
• Re-verification is as little as hours, depending on maturity scores and risk of changes
• Addresses economic feasibility by lowering cost over time

The RABET-V process

Who tests: independent accredited assessors

• A wide variety of organizations and entities
• Must meet basic eligibility requirements
• Technical qualifications, U.S.-based working on U.S. soil, no conflicts of interest
• Currently have 7 accredited assessing organizations
• More assessors increases likelihood of availability at the time a tech provider wants to begin the program

Organizational Assessment

• Assesses the technology provider’s product development lifecycle processes
• Based on the OWASP Software Assurance Maturity Model (SAMM), extended to include usability and accessibility

​

​

Architecture Assessment

• Assesses the product’s design approach to system, software, security, and data
• Measures the reliability of security services, how isolated the services are, use of reputable dependencies, and other architectural best practices
• Leverages architectural analysis tools (does not require source code)

Product Verification

• Verifies the product performs as claimed and is free of known vulnerabilities
• In updates, this is scaled based on the risk of the change and previous scores

10 Security Control Families

• Authentication​
• Authorization​
• Injection Prevention​
• Key/Secret/Credentials Management​
• User Session Management​
• Logging/Alerting​
• Data Integrity Protection​
• Data Confidentiality Protection​
• Boundary Protection​
• System Integrity Protection

​

​

​

​

Reporting

Very detailed reports

Very detailed reports

Architectural Maturity

Product Testing Maturity

​

Streamlined testing of changes

Incorporating RABET-V

Utilizing procurement frameworks

Program benefits

Benefits to jurisdictions

• No/low cost
• Improves quality of procured non-voting solutions
• Allows them to focus on functional testing rather than maintain security requirements

​

Benefits to tech providers

• Rapid testing speed
• Streamlined testing program, as the program gets adopted
• Iterative approach makes re-testing easy and affordable
• Identifies actionable organization/product improvements

​

State and locality support

• Help map requirements and assist in setting new administrative rules
• Work with approval authorities to explain RABET-V and how it can fit in their processes
• Provide sample reports to assist in determining how incorporate the process
• Consider RABET-V adjustments to address needs

​

​

Success stories

• South Carolina Election Commission
• ePollbook providers must provide evidence they’ve gone through RABET-V
• North Carolina State Board of Elections
• RABET-V is slated to be one of the independent testing authorities in the certification manual

Managing procurement risks

Considerations into existing procurement processes

• Certification/approved list
• RABET-V-specific or independent testing mandate
• Security review
• RABET-V-specific or independent testing mandate
• RFP scoring process
• Internal reviews and testing [5 points]
• External reviews and testing of product performance [5 points]
• External reviews and testing of organizational performance and product architecture and dependencies [10 points]

Point-in-time testing isn’t enough

• The threat environment is evolving, so the testing must evolve
• RABET-V is meant to be run continuously and incentivizes repeated testing

Strengthening management

And relationships

Managing supply chain risks

1. A cybersecurity risk management program to address broad cybersecurity risks, regardless of whether they are supply chain risks.
2. A targeted supply chain risk mitigation program for identifying and mitigating the most consequential supply chain risks.
3. A supplier risk management program to reduce the risk from emerging threats and more elusive attacks.

Criteria for assessing vendors

Do they pass the baseline?

​

�

Product Verification scoring consists of an overall score, the percentage of Level 1 requirements met—which must be 100%—and percentage of Level 2/3 requirements—which must be greater than 50%.

Building collaborative relationships with vendors for enhanced cybersecurity

• If the vendors are in multiple states, find a common program
• Use a program that constantly looks for feedback from all stakeholders
• Be a part of that program

Enhancing accountability and performance through continuous evaluation

Speed is of the essence

Empowering procurement teams

With knowledge and tools

Next steps

• Training teams on the essentials of RABET-V
• Building more tools and resources for implementing RABET-V in procurement processes
• Creating a culture of cybersecurity awareness within procurement teams

To conclude

Final thoughts

• Security is a team sport
• Speed and quality are both possible in verification programs
• Adopting programs with the potential for a national reach is best for tech providers and procurement teams
• Please work with the program administrators to improve them

Thank you

Happy to take questions