U.S. state uses the YubiKey to protect voter registration databases from hackers

About the organization

The elections office in a U.S. state wanted a more secure, efficient, and cost-effective way to protect access to voter registration databases in all counties across the state. The election office is primarily responsible for ensuring voter data is secure and up-to-date because this information determines who is eligible to vote in any given election.

The challenge: Securing access to state voter registration databases

Protecting the integrity of voter registration data is one of the biggest security concerns in every U.S. state today. Voter records, which include information such as name, date of birth, address, and voting history, are maintained by the state. Concerns over database hacking motivated the state elections office to take a proactive approach and look at more secure methods of authentication, such as moving to two-factor authentication (2FA). The office then conducted a search for a solution that met the state’s top three requirements: compliance with industry security standards, cost control, and ease-of-use.

To meet these goals, the election office first enhanced password requirements. While other security measures were considered, these options either didn’t meet compliance requirements or were too cumbersome for the end user. Finally, an IT security specialist working with the elections office recommended YubiKeys, which met all of the state’s top requirements for meeting compliance standards, budget constraints, and simplicity.

The solution: YubiKeys support industry standards, cost control, and simplicity

The state deployed more than 1,000 YubiKeys to employees accessing the voter registration database in all counties across the state. Authentication to the voter registration database is as simple as entering username/password credentials and tapping the YubiKey. By using hardware based public key cryptography, this simple solution eliminates the risk of someone using hacked credentials to gain access to voter records. And, because Yubico supports open authentication standards like FIDO U2F and FIDO2, the state isn’t tied to a proprietary platform that could eventually become obsolete or costly to maintain and multiple modern browsers support those standards including Chrome, Edge, and Firefox.

In addition to the increased security and better user experience, the state also cited cost as a major factor in deploying YubiKeys. YubiKeys are extremely durable and don’t require a battery, power supply, or LCD screen to operate, so there are no moving parts that need to be replaced. Cost control and scalability are especially important for any solution that needs to be deployed to thousands of users across the state. Just as important, YubiKeys are easy to configure and use with little training required.

The results: Improving voter registration security with a simple and cost-effective solution

The YubiKey provides several essential benefits to the state elections office:
• By supporting open industry security standards like FIDO U2F and FIDO2, YubiKeys help organizations avoid being tied to a proprietary platform that can become outdated or costly to maintain
• Users love the simplicity of the YubiKey—they just enter their credentials and tap the YubiKey for instant database access, without having to type in any cumbersome and problematic one-time passwords.
• The YubiKey is easy to configure and distribute to end users, making it a highly cost- effective solution at scale.
• YubiKeys can be easily numbered, tracked, and managed as a state asset. If a user leaves the organization, the YubiKey can be quickly and securely reassigned to another user.
• YubiKeys don’t require a battery, power source, or other parts that need to be replaced, so they are cost-effective to maintain.