Common Weakness Enumeration

CWRAF Vignette Details - Domain evoting

CWRAF version: 0.8.3

Date: April 3, 2013

Project Coordinator:

Document Editor:

Within the Common Weakness Risk Analysis Framework (CWRAF), a vignette provides a shareable, formalized way to define a particular environment, the role that software plays within that environment, and an organization's priorities with respect to software security. It identifies essential resources and capabilities, as well as their importance relative to security principles such as confidentiality, integrity, and availability. For example, in an e-commerce context, 99.999% uptime may be a strong business requirement that drives the interpretation of the severity of discovered weaknesses.

Vignettes allow CWSS to support diverse audiences who may have different requirements for how to prioritize weaknesses. CWSS scoring can occur within the context of a vignette.

This page currently contains details for 4 vignettes within the "evoting" domain. These are illustrative only; the CWRAF community will help to refine these and develop others. Feedback is welcome.

Help America Vote Act (HAVA) requirements mandate paper audit logs for use by election officials.

Security incidents might facilitate fraud via malicious influence of election process or outcomes, facilitate extortion, coercion, or vote selling, incur Federal regulatory concerns, & erosion of voter confidence.

Security incidents might facilitate fraud via malicious influence of election process or outcomes as well as incur Federal regulatory concerns, and erosion of voter confidence.

Modify or delete election data files, causing DoS or unreliable voting results, or modify DRE system configuration.

Modify or delete voter record data, voting logs, or other core files essential for the election; change votes or modify the voting records, or modify cryptographic keys.

Read voter record information or steal cryptographic keys used for encrypting voting records prior to upload to voting server, or read system/application configuration of the DRE machine.

Read voter record data, voting logs, or other core files essential for the election; read votes or record the voting records in an unauthorized manner, or steal cryptographic keys used to protect vote confidentiality.

Printer fails to print out local record of vote result.

Federal Voting Assistance Program (FVAP) conducted a Pilot internet voting experiment (i.e. the VOI and SERVE initiatives) which were cancelled due to security concerns prior to the implementation phase.

Security incidents might facilitate fraud via malicious influence of election process or outcomes, facilitate extortion, coercion, or vote selling, incur Federal regulatory concerns, and erosion of voter confidence.

Modify or delete election data files, causing DoS or unreliable voting results, or modify Internet Voting system configuration.

Modify or delete voter record data, voting logs, or other core files essential for the election; change votes or modify the voting records, or modify cryptographic keys

Read voter record information or steal cryptographic keys used for encrypting voting records prior to upload to voting server, or read system/application configuration of the Internet Voting system.

Read voter record data, voting logs, or other core files essential for the election; read votes or record the voting records in an unauthorized manner, or steal cryptographic keys used to protect vote confidentiality.

Voters experience difficulty in using Internet Voting System, unpredictable firmware behavior causes delays, lost votes, miscalculated votes, or erosion of voter confidence affecting overall election results and turnout.

Voters experience slow or unresponsive user interface, unpredictable firmware behavior including lag, delays between actions, causes incorrect votes or confusion on the part of the voter. Overall voter confidence is eroded.