Risk Management: improving elections

I recently attending the Computer Security Institute's NETSEC information security conference in Phoenix. While attending a session on information security metrics, the topic of information security metrics as used by the Australian Electoral Commission came up. Tim Evans, the Director of Election Systems & Policy of the AEC has actually used Risk Analysis methodology to evaluate vendors as part of the procurement process. Interestingly enough, the vendor has to show that the offering meets the business needs of the AEC and will be within acceptable risk parameters.

This seems to be a novel concept in the elections world. Determine what your business needs are, evaluate your vendors against those needs (including security), and then make your purchasing decision based on that type of evaluation. Sure a lot of the elections officials in the USA say they do that, but when you look at the purchasing process it seems better connected to the quality of the lunch the vendor bought, not whether the product meets the needs of the elections department.

The trick is to implement a risk management methodology that brings together the technical people who can identify and mitigate risks with the system owners and users who identify only with the business processes. Obviously fraud control is a risk that must be managed, as is system availability,reliability and even usability. A scan of the AEC's annual reports going back several years shows that risk management is a critical part of the AEC's day to day operations.

I think every elections department should have a formal risk management program, but I bet most don't and won't unless they are forced by law.