Towards Internet voting security: A threat tree for risk assessment

Abstract

The Internet is a dangerous place for any critical application and is particularly risky for binding government elections where every vote must count. The complex interplay of people, processes, equipment, software, policies, and legislation in a networked environment that spans national boundaries makes, for example, determining the precise likelihood of a threat nearly impossible. This does not mean, however, that the risk analyst cannot model, understand, and assess the risks to Internet voting systems. To that end, this paper presents a threat tree for risks to Internet voting systems. The Internet voting threat tree was successfully vetted by a panel of elections officials, security experts, academics, election law attorneys, representation from governmental agencies, voting equipment vendors, and voting equipment testing labs. We submit that this threat tree is sufficiently abstract to be useful in a wide range of risk assessment techniques.

A review of attack graph and attack tree visual syntax in cyber security

“…No visual distance [20,19,49,51,52,99,99,110,127,147,158,167,177,186,196,203,205,247,253,262,269,277,299,305,306,310,314,315,323,324,325,334,346,354,385,386,24]…”

“…Ellipse represents 'or', diamond represents 'and' [54,11,4]; Fault tree symbols Fault tree symbols turned upside down and coloured black: [239]; Plaintext [366,383,417,54,356]; Triangle The word 'and' added to a triangle [189] Arc: [39,40,49,105,253,104,186,245,203,24,407,246,177,127,354]; Arc with the word 'or'. Absence of arc represents 'and': [123]; Double arc is an 'and': [282]; Arc with the word 'and' and a double arc with the word 'or': [324]; Arc -word 'and' added to the arc -the absence of an arc represents an 'or': [346,299,110] Attack Tree Fault tree symbols: [147,395,60,321,306,337,247,297,305,382,167,99,205,111,323]; The words 'and' and 'or'...…”

Internet voting

“…The road towards effective conformance testing of voting machines installed in polling places has been long. It went through deep review of systems initially adopted without a transparent process guaranteeing their security [12,4,17]. It led to ample public discussions in the U.S.A [24,3] as well as in the European Union [15] that were incorporated in the track for defining public standards [22,8].…”

SecIVo: a quantitative security evaluation framework for internet voting schemes

“…Several works have addressed the assessment of risks for electronic voting schemes [6,13,39,47,55,[57][58][59] by deriving threats trees for electronic voting schemes. Comprehensive threat trees for electronic voting (or Internet voting) schemes are of great value for the deduction of adversaries violating security requirements, yet, the fine-grained threats considered in these works require decision makers to assign probabilities to specific threats.…”