Category Overview

Attack Methods — Election Security Glossary

24 election security terms in the Attack Methods category, with definitions sourced from NIST, CISA, EAC, and 30+ authoritative documents.

Browse all 24 terms in Attack Methods

Attack Method

Attack methods are specific techniques adversaries use to achieve tactical goals, such as gaining initial access, stealing credentials, or moving through a network.

Low consensus2 sources

Attack Mode

Attack Mode refers to the specific techniques, strategies, and methodologies adversaries use to exploit vulnerabilities and achieve malicious objectives, ranging from phishing and…

Low consensus2 sources

Attack Path

An attack path is a sequence of interconnected steps that attackers use to navigate an organization's IT environment to reach critical assets, moving from initial entry to a final…

Low consensus2 sources

Attack Pattern

Attack patterns are standardized descriptions of common methods used by adversaries to exploit software, hardware, or network vulnerabilities, often categorized by TTPs (Tactics,…

Medium consensus1 source

By ESG Editorial Team · Drawing on MITRE ATT&CK, CISA advisories, and 25+ sources on election-targeted threats

Attack methods are the techniques adversaries use against election infrastructure. They span the full range of cyber and physical activity: phishing, malware deployment, denial-of-service, supply chain compromise, insider threat, physical intrusion, influence operations, and disinformation. No single defense addresses all of them. Defending against the full range requires knowing what the threats are.

Why this category matters for election security is that defenders cannot prioritize what they do not understand. The threat intelligence community publishes indicators of compromise, advisories, and reports of observed activity. The most useful of these are election-specific: not just "ransomware is active" but "ransomware has been observed targeting county government networks that support elections."

The taxonomy of attack methods is not fixed. Adversaries develop new techniques as defenders close off old ones. Election infrastructure is a specific target with specific characteristics, and the threats to it are correspondingly specific. Phishing against a county election office is not the same as phishing against a bank. The vocabulary here reflects that specificity.

The terminology in this category covers the major categories of attacks that have been observed against election infrastructure. The concepts here are descriptive. They name the threats so they can be discussed and defended against.

Key Concepts

Phishing

Deceptive communications, typically email, crafted to trick election officials into revealing credentials or installing malicious software.

Ransomware

Malware that encrypts victim data and demands payment for the decryption key.

Denial Of Service

An attack that aims to make a system or network resource unavailable to its intended users.

Supply Chain Attack

A cyberattack that compromises less-secure elements of a supply chain (hardware, firmware, or software) to ultimately target the election system using those components.

Advanced Persistent Threat

A prolonged, sophisticated cyberattack in which an adversary gains long-term access to a network, often for espionage or future disruption.

How These Terms Relate

These concepts together describe the threat landscape that election infrastructure faces. The terminology here draws on the broader cybersecurity vocabulary, but applied to the election context. The unifying theme is that named threats are addressable threats. A jurisdiction that knows what it faces can plan for it. The category does not rank threats by likelihood: the threat a given election office faces depends on its size, its visibility, its connectedness, and the resources of its adversaries.