Account Security: Tech Platform Training for Election Officials

Listen to experts from Google, Meta, Microsoft, and Twitter as they run through additional protection protocols for vulnerable accounts to increase security against threats and attacks during an election cycle.

Google:

• Advanced Protection Program – comes under Protect Your Democracy initiative by Google which safeguards users with high visibility and sensitive information from targeted online attacks.
• To enroll, the account holder would need a Google Titan Security Key, or any FIDO® compliant security key. The key is like a second lock after the password.
• Protects account from phishing: Advanced Protection requires the account holder to use a security key to verify the identity and sign-in to the Google Account.
• Provides extra protection from harmful downloads: Advanced Protection flags, or even blocks the user from downloading files that may be harmful. Only app installations from verified stores and the device manufacturer’s app store are allowed.
• Keeps personal information secure: Google Accounts come with built-in protections and check over 1 billion saved passwords for breaches every day. Advanced Protection allows only Google apps and verified third-party apps to access the Google Account data, and only with permission.
• Tools to provide extra checks on the account security:
  1. Privacy Check-up: Helps choose the privacy settings to the account data private, safe and secure.
  2. Security Check-up: Step-by-step tool which provides personalized and actionable security recommendations to help strengthen the security of the Google account.
  3. Password Manager: Built into Chrome and Android, this tool creates, remembers and auto-fills passwords for all the online accounts.
• Request Removals: With this tool, personal contact information such as phone number, email address, or physical address etc. can be requested to be removed from Google Search Results.

Meta:

• Facebook Protect is a program that offers additional security protections like two-factor authentication, and monitors for potential hacking threats. to the accounts of candidates, their campaigns, and elected officials from cyber threats.
• Meta has developed the following Safety Tools:
  1. Staying Safe: Enabling safe content sharing, friending/following the right people, and blocking/reporting the harmful content or users through links on almost every post.
  2. Securing Your Account: Strong password criteria, two-factor authentication, login alerts from unrecognized devices, and tools to report scams and hacked accounts.
  3. Protecting Your Information: “Audience Selector” tool for posts, photos, and profile, to provide selected sharing. Control tagging, review tagging and timeline, ability to remove oneself from being tagged.
• The Security Checkup feature for security diagnostics, two-factor authentication, and alerts on logins from unrecognized devices.

Microsoft:

• Microsoft AccountGuard – offered via the elections security focused Democracy Forward team – is a cybersecurity service that adds an extra layer of protection to high-risk, highly-targeted organizations that underpin a healthy democracy, including elections officials. Features include enhanced monitoring and special notification procedures and remediation assistance if your account is compromised or targeted by a known nation-state adversary and discounted security products like Azure AD P2 and YubiKeys. AccountGuard protections extend to both the professional accounts for all staff, but also to the personal Microsoft email accounts of staff members, poll workers, and family members of executive staff.
• Azure for Elections Program – Running elections workloads in the Azure cloud? Microsoft’s Azure for Elections program offers a set of free security and resiliency assessments, plus enhanced customer support for elections-critical cloud workloads like voter information portals, databases, or results reporting sites. Email Microsoft to learn more.
• Enable MFA everywhere! Multifactor authentication can be added to every type of Microsoft account. Click to enable MFA on your professional O365 accounts, your personal Microsoft accounts (personal email, Xbox, Skype), LinkedIn, and Github. Hardware security keys (such as Yubikeys) are an optional authentication method for all Microsoft accounts for maximum security.
• Contact Us with Any Issues – Report information integrity concerns or cybersecurity concerns directly to the Democracy Forward team at [email protected]

Twitter:

• To protect and secure accounts of government officials from cyber threats, accounts will be reminded to use a strong password, encouraged to enable two-factor authentication, login verification, asked to update software and to check the third-party apps they have connected to their accounts.
• Safety tools by twitter: 1. Block, Mute, Report (email the case number to [email protected] to escalate the issue), remove an unwanted follower. 2. Conversation with multiple people can be hidden or controlled. 3. Sensitive content can be removed. 4. The tweets can be protected, the photo tagging can be turned off and the data sharing can be controlled through these tools.
• Twitter will also enable password reset protection for accounts by default to help prevent unauthorized password changes.
• Twitter can be contacted on this link or [email protected] to get assistance on any kind of account issues such as problems with account access, privacy, authentication etc.
• Additional proactive safeguards for these accounts, including:
• More sophisticated detections and alerts to help account holders respond rapidly to suspicious activity.
• Increased login defenses to prevent malicious account takeover attempts.
• Expedited account recovery support to ensure account security issues are resolved quickly.