Stop the count! Or rather – stop the vote – as the British government follows cyber security advice from the NCSC to preserve the integrity of the upcoming Conservative leadership election. Additional security measures have been put in place, meaning the vote has been delayed.
The Conservative party had originally planned to allow members to choose whether to vote by post or online. Should that member later change their mind and vote for the alternative candidate, they could use the alternative method to cancel out their previous vote. This raised concern from the National Cyber Security Centre (NCSC), part of GCHQ (Government Communications Headquarters) and they stepped in to provide cyber security advice to minimise the risk of fraud.
The Telegraph said it understood fears were raised that scores of votes could be changed by nefarious , although there was no specific threat from a hostile state. Threat actors will use a variety of exploits, from technical vulnerabilities of systems to social engineering, in order to compromise businesses and societies.
Since the 2016 US presidential election there have been various reports of Russia’s efforts to interfere and influence the election. For example, The Senate Intelligence Committee found that the Russian government had engaged in an “extensive campaign” to sabotage the election in favour of Trump
In addition, there were claims (without presented evidence) that Russia had attempted to get inside election systems. It is quite plausible therefore that the British Conservative leadership election would gain the interest and attention of foreign states and imperative that the party followed the advice presented by NCSC.
Conservative party members will still have the option to vote by post or online, but only the first vote cast will count. One time use codes for online voting will be deactivated immediately after use, or if the postal vote is received first. This goes to show that all organisations need to be consulting industry best practice and if necessary, seek advice from cyber security experts to make safe and secure business decisions.
Over the weekend, the NHS 111 software confirmed it was brought down by a cyber attack . This emphasises that organisations should be performing regular vulnerability scanning and paying close attention to the threat landscape to ensure they are as prepared as possible. It is imperative that thorough cyber risk and impact assessments are conducted, and robust mitigating controls are implemented.
Businesses should inform their risk assessments and bolster their cyber security posture by receiving regular and actionable threat intelligence (in line with recent updates to ISO27002), keeping abreast of the latest trends in their every evolving cyber threat landscape.
