Binary Check Ad Blocker Security News

Millions of Android smart television sets from the Chinese vendor TCL Technology Group Corporation contained gaping software security holes that researchers say could have allowed remote attackers to take control of the devices, steal data or even control cameras and microphones to surveil the set’s owners.

The security holes appear to have been patched by the manufacturer in early November. However the manner in which the holes were closed is raising further alarm among the researchers about whether the China-based firm is able to access and control deployed television sets without the owner’s knowledge or permission.

Two Flaws, Lots of Red Flags

In a report published on Monday, two security researchers described two serious software security holes affecting TCL brand television sets. First, a vulnerability in the software that runs TCL Android Smart TVs allowed an attacker on the adjacent network to browse and download sensitive files over an insecure web server running on port 7989.

More Questions as Expert Recreates Chinese Super Micro Hardware Hack

That flaw, CVE-2020-27403, would allow an unprivileged remote attacker on the adjacent network to download most system files from the TV set up to and including images, personal data and security tokens for connected applications. The flaw could lead to serious critical information disclosure, the researchers warned.

Consumer Reports: Flaws Make Samsung, Roku TVs Vulnerable

Second, the researchers found a vulnerability in the TCL software that allowed a local unprivileged attacker to read from- and write to critical vendor resource directories within the TV’s Android file system, including the vendor upgrades folder. That flaw was assigned the identifier CVE-2020-28055.

Both flaws affect TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below, according to the official CVE reports.

John Jackson is an application security engineer at Shutterstock.

The researchers, John Jackson, an application security engineer for Shutter Stock, and the independent researcher known by the handle “Sick Codes,” said the flaws amount to a “back door” on any TCL Android smart television. “Anybody on an adjacent network can browse the TV’s file system and download any file they want,” said Sick Codes in an interview via the Signal platform. That would include everything from image files to small databases associated with installed applications, location data or security tokens for smart TV apps like Gmail. If the TCL TV set was exposed to the public Internet, anyone on the Internet could connect to it remotely, he said, noting that he had located a handful of such TCL Android smart TVs using the Shodan search engine.

CVE-2020-28055 was particularly worrisome, Jackson said. “It was clear that utilizing this vulnerability could result in remote code execution or even network ‘pivots’ by attackers.” That would allow malicious actors to move from the TV to other network connected systems with the intention of exploiting systems quickly with ransomware, Jackson observed. That, coupled with a global population of millions of TCL Android TVs, made the risk considerable.

Nobody Home at TCL

The researchers said efforts to alert TCL about the flaws in October initially fell on deaf ears. Emails sent to a designated email address for reporting security issues bounced. And inquiries to the company on October 16 and 20th went unanswered. Furthermore, the company did not appear to have a dedicated product security team to reach out to, Jackson said in a phone interview.

A screen shot of the browse-able file system of a TCL television set.
A screen capture showing the full, browsable file system on an Internet-connected TCL television set.

Podcast Episode 128: Do Security and Privacy have a Booth at CES?

Only after reaching out to a security contact at TCL partner Roku did Sick Codes and Jackson hear from a security resource within TCL. In an email dated October 29th, Eric Liang of TCL wrote to the two researchers thanking them for their discovery and promising a quick fix.

“Here is how is it going on now: A new version to fix this vulnerability is going to release to SQA on Oct. 29 (UTC+8). We will arrange the upgrade plan after the regression test passes.”

Silent Patch Raises More Questions

Following that, however, there was no further communication. And, when that fix came, it raised more questions than it answered, the researchers said.

According to the researchers, TCL patched the vulnerabilities they had identified silently and without any warning. “They updated the (TCL Android) TV I was testing without any Android update notification or warning,” Sick Codes said. Even the reported firmware version on the TV remained unchanged following the patch. “This was a totally silent patch – they basically logged in to my TV and closed the port.”

Sick Codes said that suggests that TCL maintains full, remote access to deployed sets. “This is a full on back door. If they want to they could switch the TV on or off, turn the camera and mic on or off. They have full access.”

Jackson agreed and said that the manner in which the vulnerable TVs were updated raises more questions than it answers. “How do you push that many gigabytes (of data) that fast with no alert? No user notification? No advisory? Nothing. I don’t know of a company with good security practices that doesn’t tell users that it is going to patch.”

There was no response to emails sent by Security Ledger to Mr. Liang and to TCL media relations prior to publication. We will update this story with any comment or response from the company when we receive it.

Questions on Smart Device Security

The vulnerabilities raise serious questions about the cyber security of consumer electronics that are being widely distributed to the public. TCL, a mainland Chinese firm, is among those that have raised concerns within the U.S. Intelligence community and among law enforcement and lawmakers, alongside firms like Huawei, which has been labeled a national security threat, ZTE and Lenovo. TCL smart TVs are barred from use in Federal government facilities. A 2019 U.S. Department of Defense Inspector General’s report raised warnings about the cyber security risks to the Pentagon of commercial off the shelf (COTS) technology purchased by the U.S. military including televisions, laptops, surveillance cameras, drones and more. (PDF)

And while disputes over Chinese apps like TikTok dominate the headlines,  a recent report from the firm IntSights on China’s growing cyber risk notes that the Chinese Communist Party (CCP) is engaged in a far broader campaign to elevate the country to superpower status by treating “data as the most valuable asset.”

The supply chain for a seemingly endless variety of technology sold and used in the United States originates in China. A 2019 study by the security firm Interos, for example, found that one fifth (20%) of the hardware and software components in a popular voting machine came from suppliers in China. Furthermore, close to two-thirds (59%) of components in that voting machine came from companies with locations in both China and Russia.

TCL has risen quickly in the past five years to become a leading purveyor of smart television sets in the U.S. with a 14% market share, second behind Samsung. The company has been aggressive in both partnerships and branding: teaming with firms like Alcatel Mobile and Thompson SA to produce mobile phones and other electronics, and sponsoring sports teams and events ranging from the Rose Bowl in Pasadena, California, to The Ellen Show to the 2019 Copa América Brasil soccer tournament.

TCL’s TV sets are widely available in the US via online e-tailers like Amazon and brick and mortar “box stores” like Best Buy. It is unclear whether those retailers weigh software security and privacy protections of products before opting to put them on their store shelves. An email to Best Buy seeking comment on the TCL vulnerabilities was not returned.

Buyer Beware

The security researchers who discovered the flaw said that consumers should beware when buying smart home electronics like TV sets, home surveillance cameras, especially those manufactured by companies with ties to authoritarian regimes.

“Don’t buy it just because a TVs cheap. Know what you’re buying,” said Sick Codes. “That’s especially true if it’s hooked up to the Internet.”

The 2020 election in the U.S. is less than a week away and warnings about cyber threats to the vote are coming out with about the regularity as polls of the presidential contest between Joe Biden and Donald Trump. 

Public Sector Mega-Vendor Tyler Technologies Says It Was Hacked

On October 9, for example, the FBI and DHS warned that so called “Advanced Threat” actors were chaining together multiple vulnerabilities in an attempt to compromise federal, state and local government networks and elections organizations.

Rob Bathurst is the Chief Technology Officer at Digitalware.

Also this month, an outbreak of the Dopplepaymer ransomware affected elections infrastructure in Hall County, Georgia, disabling a database used to verify voter signatures in the authentication of absentee ballots. 

Which leads us to ask: despite years of warnings, are state and local governments ready for what Russia, Iran or any number of ransomware gangs have in store for them? 

To help answer that question, we invited Rob Bathurst into the studio. Rob is the Chief Technology Officer at Digitalware, a Denver area company that specializes in risk analysis  and risk management with Federal, state and local government and F500 companies. 

Episode 96: State Elections Officials on Front Line against Russian Hackers

In this conversation, Rob and I talk about what the biggest cyber risks are to state and local governments and how worried we should be about warnings about cyber threats to elections systems are. 

Vulnerabilities are just a reality in government networks, Rob says. The key is to avoid being surprised by attacks and also to ensure that you can keep voting systems and other critical systems available even if they are the target of an attack. 

Episode 175: Campaign Security lags. Also: securing Digital Identities in the age of the DeepFake

In this conversation, Rob  and I talk about the bigger picture of cyber risk for federal state and local governments. We also talk about incidents like the recent hack of government ERP provider Tyler Technologies. 

Rob Bathurst is the Chief Technology Officer at the firm Digitalware. he was here talking to us about cyber risks in local governments and the risk to elections systems. 

Today marks eight years since the first Security Ledger post went live back on October 2, 2012. (That story was “After VOHO Attacks, Organizations Face Arduous Cleanup,” which concerned a string of watering hole attacks.)

In recognition, I’d like to take a moment to pause…take a deep breath and contemplate the nearly 1,800 articles and blog posts and millions of visitors who have graced SecurityLedger.com since that long-passed date.

Thanks to our sponsors!

We really couldn’t have made it this far without our readers, the many contributing writers who have added their thoughts to the site and – of course- our sponsors: RSA, LastPass/LogMeIn, Digicert, Trusted Computing Group, and QOMPLX. Thanks also to our many sponsors over the last eight years. Your financial support helped make Security Ledger a success!

A New Look

I’d also like to call attention to some changes at the site. Notably: we’ve updated the look of our home page: sprucing it up and also bringing our weekly- and spotlight podcasts front and center.

Of course, we’re still reporting and covering threats, attacks and disruptive technology and developments in the infosec space but podcasting has become a bigger part of our editorial output in the last year. We felt like the site should reflect that.

Podcast Series

On podcasts, we’re continuing to offer sponsors the opportunity to sponsor our weekly podcast as well as dedicated Spotlight podcasts. (Check out our Sales page if you’re interested in sponsoring a podcast.)

But we’re also providing a bit more direction and editorial insight going into Q4 and 2021. That includes a number of thematic podcasts like our CISO Close Up series in which we invite top CISOs into the Security Ledger studio to talk about the challenges, risks and rewards of being a security executive in a time of “great change.” Our recent interview with Andy Jaquith of QOMPLX is a good example of that. Aside from our CISO series we’ll be using our podcast to dig deep on some of the trends in news and technology that we think will shape the information security space in 2021 and beyond. Our recent interview with GitLab VP of Security Jonathan Hunt is an example of that, as we talk to some of the companies on the cutting edge of security’s “shift left” to more developer-centric offerings. Look for more talks like that in the weeks and months ahead.

Stay Tuned!

Stay tuned in the weeks ahead for more information on these editorial initiatives including a reader survey, a 2021 editorial calendar and – for our sponsors – an updated media kit and details on sponsorship opportunities.

Thanks again to everyone who has helped us make the past eight years of Security Ledger such a success!

Sincerely,

Paul Roberts

Binary Check Ad Blocker Security News

The pandemic isn’t the only thing shaking up development organizations. Application security is a top concern and security work is “shifting left” and becoming more intertwined with development. In this podcast, Security Ledger Editor in Chief Paul Roberts talks about it with Jonathan Hunt, Vice President of Security at the firm GitLab.


Even before the COVID pandemic set upon us, the information security industry was being transformed. Security was long a matter of hardening organizations to threats and attacks. The goal was “layered defenses” starting with firewalls and gateway security servers and access control lists to provide hardened network perimeter and intrusion detection and endpoint protection software to protect IT assets within the perimeter. 

Spotlight: Synopsys on democratizing Secure Software Development

Security Shifting Left

Jonathan Hunt is the Vice President of Security at GitLab

These days, however,  security is “shifting left” – becoming part and parcel of the development process. “DEVSECOPS”  marries security processes like code analysis and vulnerability scanning to agile application development in a way that results in more secure products. 

That shift is giving rise to a whole new type of security firm, including the likes of GitLab, a web-based DevOps lifecycle tool and Git-repository manager that is steadily building its roster of security capabilities. What does it mean to be a security provider in the age of DEVSECOPS and left-shifted security?

Application Development and COVID

To answer these questions, we invited Jonathan Hunt, the Vice President of Security at GitLab into the Security Ledger studio to talk about it. In this conversation, Jonathan and I talk about what it means to shift security left and marry security processes like vulnerability scanning and fuzzing with development in a seamless way. 

Spotlight Podcast: Intel’s Matt Areno – Supply Chain is the New Security Battlefield

We also discuss how the COVID pandemic has shaken up development organizations – including GitLab itself – and how the changes wrought by COVID may remain long after the virus itself has been beaten back. 


As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and check us out on SoundCloudStitcherRadio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

Keyboard to the internet

Tyler Technologies, the U.S.’s largest provider of software and services to the public sector said on Wednesday that it was hacked by unknown assailants, who gained “unauthorized access” to the company’s IT and phone systems.

Tyler, which sells software that supports a wide range of public sector functions such as permitting, inspections, 311 systems and utility billing said that it has hired independent IT experts to investigate the incident. The company’s MUNIS ERP (enterprise resource planning) technology is widely used by local governments across the U.S.

“We are treating this matter with the highest priority and working with independent IT experts to conduct a thorough investigation and response,” wrote Matt Bieri, the company’s Chief Information Officer in an email obtained by The Security Ledger. Tyler is also working with law enforcement.

The company’s web page displayed a message saying it was “temporarily unavailable” Wednesday evening.

In the email message to customers, Bieri said that the company discovered the intrusion Wednesday morning after the intruder “disrupted access to some of our internal systems” – a possible reference to ransomware.

Bieri told customers the intrusion was “limited to our internal network and phone systems” and that the company has “no reason to believe that any client data, client servers, or hosted systems were affected.”

However, security experts said those assurances weren’t worth much. The average dwell time for adversaries on compromised networks was 56 days in 2019, according to data from the firm FireEye.

“If that amount of time goes by, there’s plenty of time to look around for passwords,” said Michael Hamilton, the CISO of CI Security and a former Vice-Chair for the DHS State, Local, Tribal and Territorial Government Coordinating Council.

Tyler Technologies displayed a message that its web page was unavailable Wednesday following a cyber attack.

Hamilton worries that Tyler’s deep connections to local governments could have provided sophisticated adversaries with credentials needed to get a foothold on municipal networks – a particularly worrying prospect with a national election just over a month away in the U.S. and heightened concerns about cyber attacks on elections systems designed to sow chaos.

Michael Hamilton is the CISO of CI Security

Hamilton said clients he has consulted with who use MUNIS have complained that it does not support multi-factor authentication, and that Tyler technicians have a habit of accessing customer systems for maintenance “when they feel its necessary” – a practice that might complicate efforts to establish whether there have been suspicious patterns of activity related to Tyler systems.

Municipalities that use MUNIS or other Tyler systems should do a force reset of any passwords as a precaution, Hamilton advises. Also, IT security teams should review access logs related to Tyler support accounts to look for suspicious behavior including unusual session times or logins from unusual locations. That’s especially true for municipalities who are at increased risk of election-related tampering.

Keyboard to the internet

In this Spotlight Podcast, sponsored by The Trusted Computing Group, we speak with Matthew Areno, a Principal Engineer in the Intel Product Assurance and Security (IPAS) group about the fast-changing landscape of cyber threats including attacks on hardware and software supply chains.


It’s funny that one of the most controversial stories about supply chain security, Bloomberg Businessweek’s scoop on “spy chips” on motherboards by the firm Super Micro that infiltrated “more than 30 companies” is remembered less for what it said than the staunch denials it provoked.

Matthew Areno is a Principal Engineer in the Intel Product Assurance and Security (IPAS) group at Intel.

Whether or not that story was accurate, however, security experts have long agreed that the threat it describes is real – and growing. The deep reliance of the high tech industry on software and hardware supply chains that originate in nations like China has created the conditions for compromised technology to infiltrate U.S. homes, businesses and governments at all level.

Unfortunately, the information security industry has been slow to respond. Companies spend billions of dollars on information security tools and technology every year. But much of that spending is for fighting “the last war:” viruses, spam, application- and denial of service attacks and so on.

Cyber: Fighting the Last War

Our guest this week is here to tell you that those aren’t even close to being the only kinds of threats organizations need to worry about. Matthew Areno spent years conducting both offensive and defensive research at some of the most sophisticated and targeted firms in the world: Sandia National Labs in New Mexico and defense contractor Raytheon among them.

Episode 161: 3 Years after Mirai, IoT DDoS Problem may get Worse

Areno, who now works at Intel, where he is a Principal Engineer in the Intel Product Assurance and Security (IPAS) group, says his work at companies that were in the crosshairs of nation-state actors opened his eyes to “what was possible” in cyber offense. It also taught him how organizations – even sophisticated ones – often fail to discern the full spectrum of possible attacks on their security, with dire consequences. 

A Range of Supply Chain Threats

Supply chain attacks could run the gamut from degrading the performance of a sensor to exfiltrating sensitive data to denial of service attacks. “And these attacks can happen at any point in the lifecycle of these products,” Areno told me. That includes attacks on the design network that manufacturers use, attacks on shared or open source software components and – as with SuperMicro- the introduction of malicious components during manufacturing, which is an issue that Areno said is still probably more hype than reality – even if component piracy and counterfeiting is not.

“When we’re sendings our designs over the seas, how much confidence and how much trust do we have that what we sent to them is what we got back,” Areno wonders.

Spotlight Podcast: Two Decades On, Trusted Computing Group tackles IoT Insecurity

In this podcast, Matt and I talk about where the new front lines in cyber security fall and how companies need to re-think their approach to security in order to address the changing threat.

We also talk about Matt’s work with the Trusted Computing Group where he helps develop technologies that make it easier to protect against threats like attacks on device firmware and hardware supply chains by building a hardware based root of trust that can be a foundation for the security of entire products and product ecosystems. 


(*) Disclosure: This podcast and blog post were sponsored by Trusted Computing Group. For more information on how Security Ledger works with its sponsors and sponsored content on Security Ledger, check out our About Security Ledger page on sponsorships and sponsor relations. 

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and check us out on SoundCloudStitcherRadio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

Keyboard to the internet

Modern enterprise networks are populated by both people and, increasingly, “things.” But securing the growing population of Internet of Things devices presents unique challenges. In this thought leadership article, Brian Trzupek, the Senior Vice President of Emerging Markets at DigiCert discusses what is needed for effective IoT security.


We’ve seen the IoT come of age over just the past few years, and innovative use cases continue to build momentum. Gartner forecasts that 25 billion connected things will be in use by 2021. However, although the IoT has tremendous potential across many industries, Gartner surveys still show security is the most significant area of technical concern.

When it comes to security, IoT challenges are distinct from the enterprise. Although identity and identification are cornerstones of effective security, IoT and enterprise environments face different challenges. End users are generally involved in enterprise authentication. When trying to use an application or service, they can be present to respond to multifactor authentication challenges. End-users may also have varying sets of roles or access constraints that evolve as their position changes in the organization.

IoT: Insecure by Design

 


(*) Disclosure: This article was sponsored by DigiCert. For more information on how Security Ledger works with its sponsors and sponsored content on Security Ledger, check out our About Security Ledger page on sponsorships and sponsor relations.

Binary Check Ad Blocker Security News

Thirty eight years after it was founded, RSA Security is embarking on what may be its most challenging journey yet: cybersecurity startup. In this Spotlight Podcast, sponsored by RSA, we’re joined by Chief Digital Officer Dr. Zulfikar Ramzan about the company’s path forward as an independent company.


The company which was acquired by storage giant EMC back in 2006 and then became a part of Dell when that company acquired EMC in 2015 re-emerges as an independent company this week, more than six months after it was acquired by a group of investors led by Symphony Technology Group. 

Zulfikar Ramzan RSA
Zulfikar Ramzan is the Chief Technology Officer at RSA.

What does independence looks like? What will RSA do with its newfound freedoms? And how does the challenging business environment created the ongoing COVID pandemic figure into the company’s plans? 

To find out, we invited Dr. Zulfikar Ramzan, RSA’s CTO into the Security Ledger studio. In this conversation, Zulli talks about how RSA’s path forward is informed by the company’s pioneering past, starting all the way in 1977,  when three MIT researchers Ron Rivest Adi Shamir and Len Adleman published research on a novel public key cryptosystem that took their name. 

Three Decades On: RSA Labs Sets Course for Future

The Past Informing the Future

As Ramzan sees it: the daring and persistence of the founders – whose work helped create the modern Internet, but who initially had to contend with the limitations of contemporary hardware and software, not to mention Cold War era restrictions on the sale of cryptography technology outside the US. That perseverance will serve as an inspiration to RSA as it looks to re-establish its leadership in vastly altered technology and security landscape.

Spotlight Podcast: Managing the Digital Risk in your Digital Transformation

To start off I asked Zulli to talk about RSA’s earliest days and what messages he and other company executives take from the company’s origins almost 4 decades ago.


(*) Disclosure: This podcast and blog post were sponsored by RSA Security for more information on how Security Ledger works with its sponsors and sponsored content on Security Ledger, check out our About Security Ledger page on sponsorships and sponsor relations.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and check us out on SoundCloudStitcherRadio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

Binary Check Ad Blocker Security News

In this Spotlight Podcast, sponsored by RSA, we take on the question of securing the 2020 Presidential election. Given the magnitude of the problem, could taking a more risk-based approach to security pay off? We’re joined by two information security professionals: Rob Carey is the Vice President and General Manager of Global Public Sector Solutions at RSA. Also joining us: Sam Curry, the CSO of Cybereason.


With just over two months until the 2020 presidential election in the United States, campaigns are entering the final stretch as states and local governments prepare for the novel challenge of holding a national election amidst a global pandemic. 

As Election Threats Mount, Voting Machine Hacks are a Distraction

Lurking in the background: the specter of interference and manipulation of the election by targeted, disinformation campaigns like those Russia used during the 2016 campaign – or by outright attacks on election infrastructure. A report by the Senate Intelligence Committee warns that the Russian government is preparing to try to influence the 2020 vote, as well.

A Risk Eye on the Election Guy

Securing an election that takes place over weeks or even months across tens of thousands cities and towns – each using a different mix of technology and process – may be an impossible task. But that’s not necessarily what’s called for either.

Robert Carey RSA Security
Robert J. Carey is the  Vice President and GM of Global Public Sector Solutions at RSA.

Like large organizations who must contend with a myriad of threats, security experts say that elections officials would do well to adopt a risk-based approach to election security: focusing staff and resources in the communities and on the systems that are most critical to the outcome of the election. 

What does such an approach look like? To find out, we invited two, seasoned security professionals with deep experience in cyber threats targeting the public sector. 

Robert J. Carey is the  Vice President and GM of Global Public Sector Solutions at RSA.

Feds, Facebook Join Forces to Prevent Mid-Term Election Fraud

Rob retired from the Department of Defense in 2014 after over 31 years of distinguished public service after serving a 3½ years as DoD Principal Deputy Chief Information Officer.

Sam Curry, CISO Cybereason
Sam Curry is the CISO at Cybereason

Also with us is this week is Sam Curry, Chief Security Officer of the firm Cybereason. Sam has a long career in information security including work as CTO and CISO for Arbor Networks (NetScout)  CSO and SVP R&D at Microstrategy in addition to senior security roles at McAfee and CA. He spent seven years at RSA variously as CSO, CTO and SVP of Product and as Head of RSA Labs. 

Voting Machine Maker Defends Refusal of White-Hat Hacker Testing at DEF-CON

To start off our conversation: with a November election staring us in the face,  I asked Rob and Sam what they imagined the next few weeks would bring us in terms of election security. 

Like Last Time – But Worse

Both Rob and Sam said that the window has closed for major new voting security initiatives ahead of the 2020 vote. “This election…we’re rounding third base. Whatever we’ve done, we have to put the final touches on,” said Carey.

Like any other security program, election security needs baselines, said Curry. Elections officials need to “game out” various threat, hacking scenarios and contingencies. Election officials need to figure out how they would respond and how communications with the public will be handled in the event of a disruption, Curry said.

“The result we need is an election with integrity and the notion that the people have been heard. So let’s make that happen,” Curry said.

Spotlight Podcast: As Attacks Mount, ERP Security Still Lags

Carey said that – despite concerns – little progress had been made on election security. “The elections process has not really moved forward much. We had hanging chads and then we went to digital voting and then cyber came out and now we’re back to paper,” he said.

Going forward into the future, both agree that there is ample room for improvement in election security – whether that is through digital voting or more secure processes and technologies for in person voting. Carey said that the government does a good job securing classified networks and a similar level of seriousness needs to be brought to securing voting sessions.

“Is there something that enables a secure digital vote?” Carey said. “I’m pretty sure our classified networks are tight. I know we’re not in that space here, but I know we need that kind of confidence in that result to make this evidence of democracy stick,” he said.  


(*) Disclosure: This podcast and blog post were sponsored by RSA Security for more information on how Security Ledger works with its sponsors and sponsored content on Security Ledger, check out our About Security Ledger page on sponsorships and sponsor relations.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and check us out on SoundCloudStitcherRadio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted.