Category Overview

Attack Methods — Election Security Glossary

24 election security terms in the Attack Methods category, with definitions sourced from NIST, CISA, EAC, and 30+ authoritative documents.

Browse all 24 terms in Attack Methods

Jamming

An attack that attempts to interfere with the reception of broadcast communications.

Low consensus2 sources

By ESG Editorial Team · Drawing on MITRE ATT&CK, CISA advisories, and 25+ sources on election-targeted threats

Attack methods are the techniques adversaries use against election infrastructure. They span the full range of cyber and physical activity: phishing, malware deployment, denial-of-service, supply chain compromise, insider threat, physical intrusion, influence operations, and disinformation. No single defense addresses all of them. Defending against the full range requires knowing what the threats are.

Why this category matters for election security is that defenders cannot prioritize what they do not understand. The threat intelligence community publishes indicators of compromise, advisories, and reports of observed activity. The most useful of these are election-specific: not just "ransomware is active" but "ransomware has been observed targeting county government networks that support elections."

The taxonomy of attack methods is not fixed. Adversaries develop new techniques as defenders close off old ones. Election infrastructure is a specific target with specific characteristics, and the threats to it are correspondingly specific. Phishing against a county election office is not the same as phishing against a bank. The vocabulary here reflects that specificity.

The terminology in this category covers the major categories of attacks that have been observed against election infrastructure. The concepts here are descriptive. They name the threats so they can be discussed and defended against.

Key Concepts

Phishing

Deceptive communications, typically email, crafted to trick election officials into revealing credentials or installing malicious software.

Ransomware

Malware that encrypts victim data and demands payment for the decryption key.

Denial Of Service

An attack that aims to make a system or network resource unavailable to its intended users.

Supply Chain Attack

A cyberattack that compromises less-secure elements of a supply chain (hardware, firmware, or software) to ultimately target the election system using those components.

Advanced Persistent Threat

A prolonged, sophisticated cyberattack in which an adversary gains long-term access to a network, often for espionage or future disruption.

How These Terms Relate

These concepts together describe the threat landscape that election infrastructure faces. The terminology here draws on the broader cybersecurity vocabulary, but applied to the election context. The unifying theme is that named threats are addressable threats. A jurisdiction that knows what it faces can plan for it. The category does not rank threats by likelihood: the threat a given election office faces depends on its size, its visibility, its connectedness, and the resources of its adversaries.