NICE eNewsletter Spring 2021 Government Spotlight

Launching the Cyber Navigator Program in Illinois

By Adam Ford, Chief Information Security Officer, Illinois Department of Innovation & Technology

When the U.S. Election Assistance Commission (EAC) announced grant funding in 2018 for the Help America Vote Act (HAVA) to improve elections security, including cybersecurity, the State of Illinois chose to use the funds to build out a statewide cybersecurity program. Public Act 100-0587 directed the Illinois State Board of Elections to provide a Cyber Navigator Program (CNP) to support the cybersecurity efforts of local election authorities (EAs). While the mandate was clear, the path forward was uncharted.  

The Illinois State Board of Elections is an independent agency responsible for the supervision of voter registration and the administration of elections throughout the state. Elections in Illinois are conducted by 108 local EAs who facilitate voting, process ballots, and manage voter registration. There is great variation in population among the counties in Illinois. Cook County, home to Chicago, is the second largest county in the nation with a population of over 5 million residents. In contrast, the four smallest counties in Illinois each have less than 5,000 residents. Information technology and cybersecurity resources vary among EAs as widely as the populations served.  

The Cyber Navigator Program is a partnership between three Illinois state agencies: Illinois State Board of Elections, Illinois State Police (ISP), and Department of Innovation and Technology (DoIT). The program utilizes the statewide fusion center operated by ISP as a central point of information sharing and incident reporting for all 108 EAs. As the state’s information technology and cybersecurity agency, DoIT oversees the Cyber Navigators.

The Cyber Navigator team is comprised of eight security professionals, divided into groups of two that are geographically distributed across Illinois. A lead Cyber Navigator serves as the central coordinator and works in the DoIT information security office under the direction of the Illinois Chief Information Security Officer (CISO). Each team is responsible for building and maintaining relationships with the EAs in their region.  

As the dedicated cybersecurity workforce for Illinois elections, the Cyber Navigators provide a variety of functions for the election authorities statewide. Although the Navigators report to the state CISO, their primary customers are the senior leaders, elected officials, and appointees at the EAs in their region. 

The Cyber Navigators provide several services to the election authorities:

• Risk Assessments – Professional cybersecurity organizations must be focused on the identification and management of risk in order to be successful. At their first meeting with each EA, the Navigators perform an organizational risk assessment. Utilizing the Center for Internet Security (CIS) controls as a baseline and conduct the risk assessment with the EA and the EA’s technology team. This assessment is structured to utilize business-friendly language, and it encourages conversations between the Navigator, the EA, and their technical staff.  Once the results are available, the Navigator meets with the EA staff to discuss outcomes and answer any questions that may arise.   
• Trusted Advisor – Each EA is independently responsible for the election’s operations in their jurisdiction, and this responsibility extends to the operation of the IT environment. Some have full-time dedicated IT staff, others have part-time or shared resources, and some contract with local support technicians as needed. Even fewer have dedicated information security staff. The Navigators bring best-practices and guidance from NIST, EI-ISAC and DHS-CISA in a jargon-free, business-friendly manner.
• Incident Response – Responding effectively to cybersecurity incidents requires adequate planning and coordination before an incident occurs. Navigators work with EAs to develop incident response plans in advance to ensure that EAs are familiar with how to utilize the statewide fusion center operated by ISP to engage with all state and federal resources should incident response be needed.

The Cyber Navigator Program’s impact on election cybersecurity can be measured in a number of ways.  The first – and arguably most important – metric was getting all 108 EAs to join the program. Illinois has a strongly decentralized election system and the CNP is an all-volunteer program. The Illinois State Board of Elections sent representatives to zone meetings, county boards, election authority offices, and conventions to explain the benefits of joining the CNP. Some took longer to join than others, but eventually all 108 offices volunteered to join the program. Going forward, improvements can be measured by engagement with training materials, dollars spent on upgrades, and number of potential attacks thwarted.

In all aspects, the goal of the Navigator program is to make cybersecurity understandable and accessible to the EAs and their information technology teams. For small and medium size organizations, knowing where to start with a cybersecurity program can be a huge challenge. Utilizing the freely available resources provided by the Department of Homeland Security, the Information Sharing and Analysis Centers, and states can be intimidating. Meeting election authorities where they are and working together to strengthen election security is the cornerstone of the Cyber Navigator program.
 

NICE eNewsletter Spring 2021