Score: +22 (36/34/14)
Sacramento County Grand Jury • 2019-2020

Election Security in Sacramento County Election Results The date and time of the results are noted on the page

Published: March 03, 2020 16 pages
View Original PDF

Findings and Recommendations 4 findings

F1
Sacramento County Department of Technology (DTech) is not currently practicing regular, consistent vulnerability scans and penetration testing. Vulnerability scanning and penetration testing are often confused. The two security procedures are quite different and are used for different purposes. At the most basic level, vulnerability scanning aims to identify any systems that are subject to known vulnerabilities while a penetration test aims to identify weaknesses in specific system configurations and organizational processes and practices that can be exploited to compromise security.
Related Recommendations (1)
R1
Sacramento County Grand Jury (SCGJ) recommends the Sacramento County Department of Technology (DTech) institute frequent penetration testing performed by a third party twice per year at a minimum. SCGJ further recommends DTech perform vulnerability scans each time the following occurs within the IT ecosystem. • Security patches are applied, • Significant changes are made to the infrastructure or network, • New infrastructure or web applications are added, • An office location changes, or an office is added to the network.
F2
Voter Registration and Elections Department (VRE) considers election security a major concern and has given it a very high priority. The Sacramento County Registrar of Voters (SCRV) and her staff were very cooperative and began almost immediately to implement changes and corrective measures for identified shortcomings.
Related Recommendations (1)
R2
Sacramento County Grand Jury (SCGJ) recommends the Communication and Media Office (CMO) adjust its election security policy to include security of the Voter Registration and Elections Department (VRE) website, communication, registration, voting and results from tabulation by June 30, 2020 in preparation for the November 2020 general election.
F3
Media policy is currently under review to address the management of account passwords and the enforcement of the County of Sacramento supported multi-factor authentication methods. The estimated completion date is June 30, 2020. Social Media Accounts are managed by the Communication and Media Office (CMO) and adhere to the County of Sacramento Social Media Policy. Due to the limitations and diversity of Social Media account authentications, a review of Social Media Management software will be conducted by the Sacramento County Department of Technology (DTech). The estimated completion date is January 15, 2021.
Related Recommendations (1)
R3
Sacramento County Grand Jury (SCGJ) recommends that the Sacramento County Department of Technology (DTech) and Voter Registration and Elections Department (VRE) need to implement multi-factor authentication procedures before the November 2020 general election.
F4
Sacramento County Department of Technology (DTech) has begun a 16-month county-wide initiative to implement multi-factor authentication. Multi-factor authentication is one of the best deterrents to keep unauthorized users from hacking into computer networks. Voter Registration and Elections Department (VRE) will be one of the first departments to deploy this methodology.
Related Recommendations (1)
R4
Sacramento County Grand Jury (SCGJ) requests that the Sacramento County Department of Technology (DTech) report back to the SCGJ the results of the CyberDefenses, Inc. review and the U.S. Department of Homeland Security (DHS) audit of the election security by September 30, 2020. 98

Agency Responses 12

Government agencies' official responses to this report's findings and recommendations. Click on a response to see the structured breakdown.