12 ms·

This Obamacare contractor doesn’t take security seriously

70 points by RougeFemme 13y ago

eigenvector 13y ago
> In Slavitt's defense, data security may not have been an explicit feature of QSSI's federal contract Coming from the construction industry, there isn't a contractor in the world that cares about things which aren't in the contract. Implementing features which the client has not asked for, in the design-bid-build world of public-sector contracting, just means you will lose the bid to a lower bidder who won't do those extras.
- gohrt 13y ago
  Right. A solution is for the government to develop a series of security standards that cover a wide range of IT projects, and each project should declare that "implementation must conform to Security Level X, Category Y"
  - dragonwriter 13y ago
    > A solution is for the government to develop a series of security standards that cover a wide range of IT projects, and each project should declare that "implementation must conform to Security Level X, Category Y" Well, you'd think so, which is why that's essentially already mandated: http://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002 http://en.wikipedia.org/wiki/Federal_Information_Security_Ma... http://en.wikipedia.org/wiki/Federal_Information_Processing_Standards http://en.wikipedia.org/wiki/Federal_Information_Processing_...
- smackfu 13y ago
  And if you go beyond the contract, and stuff doesn't work, you get blamed and have to eat the cost of fixing it.
  - 31mamun 13y ago
    <a href="http://knottspinegosford.com.au">Furniture http://knottspinegosford.com.au">Furniture stores central coast</a>
  - 31mamun 13y ago
    http://knottspinegosford.com.au http://knottspinegosford.com.au
- growupkids 13y ago
  Which is also true in government contracting. What's odd is that security requirements are mandated by law, FISMA, so the government is supposed to require that systems meet the FISMA requirements. You shouldn't be able to get an ATO without it, unless the management of that agency "accepts the risks" (SES levels only, gS personnel can't do this) and waives the vulnerabilities. So if I had to guess, if they didn't protect the data then it's likely those controls were notin place everyone knew they were not and the agency heads said it was ok. All fed systems get tested, and the system certifier is supposed to be an impartial reporter of the facts (these are the vulns, missing controls, risks, etc. and they are almost always impartial). They report those to the DAA along with a recommendation to approve or not approve the system to operate. Given how important this system was, I highly doubt anyone would not have issued the ATO no matter what vulns it had. And that's not to pick on this system, sadly slap dash rush ATOs happen far too often in the USG. If you spend a ton of time and money on a system, execs in the USG have their careers on the line to show that wasn't wasted and since they don't understand security it all seems like science fiction to them. They almost always ATO the system. And why not, no USG exec has ever been fired for having a poorly protected system broken into.
  - dragonwriter 13y ago
    eigenvector: Implementing features which the client has not asked for, in the design-bid-build world of public-sector contracting, just means you will lose the bid to a lower bidder who won't do those extras. growupkids: Which is also true in government contracting. "Public-sector" = "government".
- greenyoda 13y ago
  "Coming from the construction industry, there isn't a contractor in the world that cares about things which aren't in the contract." In the construction industry, a contract might not explicitly say that the building has to comply with local building, fire and electrical codes - that's taken as a given. To construct a web site that deals with sensitive information without taking security into account is like building a skyscraper with no fire exits - not something that any honest or competent builder would do.
  - thezilch 13y ago
    Not "would do" but "could do;" you can't build, honest and competent or not, without local code-compliance. Perhaps the same should be true for the web; perhaps there should be damages for poor security; government or not.
    - dragonwriter 13y ago
      > Not "would do" but "could do;" you can't build, honest and competent or not, without local code-compliance. You can, and people do, and they are cited for it when caught. Likewise, there are mandatory standards for Federal IT systems, particularly in the area of security.
  - lmkg 13y ago
    Yes, but those are actual codes. In fact, that's why they're codes. Contractors won't do more than they're legally required to (nor should they be expected to), so safety features were made legal requirements. Relying on the honesty or competency of your contractors go above & beyond their requirements is an inefficient and unsustainable solution in a free market. This is a clear case of Moral Hazard: In the same way that bad money drives out good, corner-cutting organizations out-compete honest ones.
    - benmanns 13y ago
      What about reputation? I regularly do more than the legal minimum for my clients and there are companies who do the same for me. Meeting the legal minimums only makes sense for commodities, e.g. this salt is 99.5% pure. This software is 99.5% "secure"? This software is 99.5% "complete"?
- nraynaud 13y ago
  actually security is not a feature, but a constraint. It doesn't bring the user anything, but it absence would be a problem for secondary reasons (that might be important in the grand scheme of things). Imagine a bank (well just an account), on the functional level, you just need to deposit and withdraw money. The fact that they have to secure it is a huge constraint, but at the functional level we're not far from a trash can, a parking lot or a gas tank.
VMG 13y ago
Or else what?
jcutrell 13y ago
If anyone saw this briefing, it was mostly a lot of really technologically illiterate people asking pointed questions about a gigantic set of systems that can't easily be answered to technologically illiterate people. At one point, a congressman, with the tone of a disappointed parent, said (paraphrased) "I am very disappointed in you all. have yet to hear any one of you say sorry to the American people." Someone in the room retorted with "we didn't hear an apology when the government shut down either." (You'd expect someone to get timeout for this kind of pettiness.) With that said, one of the obvious problems was blame shift, as this article points out. The guy was (I don't remember this particular interchange) most likely outlining the fact that the question being asked of him wasn't relevant to "his responsibilities" in the contract. However, when responsibilities of a project are distributed, things fall through the gap. This article is a bit too short to give enough space for the subject, but I think it does point out the most important issue - no one really had full control of the project.
- uptown 13y ago
  I watched most of it yesterday. It was a fascinating post-mortem of a software project. What I saw was a small minority of politicians that seemed to have a handle on some of the technological challenges at-hand. Some politicians used their time to score political points completely unrelated to the technology issues - basically "our party is good / your party is bad" idiocy. Some politicians read prepared smart-sounding questions which they wouldn't be able to rephrase in another-way if they were asked to. One politician asked for a copy of the server logs so that Congress could get to the bottom of what was going wrong. And none of the company representatives were willing to accept that they'd done much wrong - instead taking every opportunity to blame people or entities not in the room.
  - aryastark 13y ago
    > One politician asked for a copy of the server logs so that Congress could get to the bottom of what was going wrong. No need to worry, folks! Your government is on top of things. I wonder, how many Congress idiots does it take to fix the caching policy on a web server?
- 13y ago
uptown 13y ago
So Rep. Mike Rogers is now suddenly concerned with protecting the security of data? The same guy that's been defending everything the NSA has been exposed to have done?
- cobrausn 13y ago
  So, I know we are looking for hypocrisy here because gasp hypocrisy, but there really isn't any. You were providing your information to the government, making sure nobody other than the government sees it isn't at conflict with defending the NSA's actions if you see this kind of activity as legitimate.
  - uptown 13y ago
    On one hand he's alarmed that enrollment data may not be properly protected. On the other hand, he's protecting an agency that's requiring technology companies to create back-doors and weaken encryption algorithms for the NSA's convenience. How are those two objectives not in conflict?
    - shortstuffsushi 13y ago
      > How are those two objectives not in conflict? A. The government wants all your data available to them. B. The government does not want all your data available to the public. A != B Edit: Not to come off as rude, I just tend to agree. If you want to say that in that sense, the government is being hypocritical, perhaps that's true. At the same time, though, their goal here is (hopefully) to keep your data safe from outsiders, whereas we can "trust" them to be good with the data they backdoor from companies ;)
    - joyeuse6701 13y ago
      Basically, the gov't is allowed to have all your information and see it, and no one else. Enrollment data needs to be protected from everyone but the US gov't is the stance. From this perspective, there is not conflict of interest.
lightblade 13y ago
Can we talk about software engineer certification yet? I tought things like this suppose to push on the movement.
- gnoway 13y ago
  Certification would be, at best, a third of the equation. It can demonstrate that you know how to do something correctly, not that you will do it correctly all the time or that you will be working in an environment that permits you to do it correctly.
  - stan_rogers 13y ago
    No, we're talking about "affix a stamp and make yourself liable" engineering certs, not just competency testing. You know, PEng engineers, not just inflated job titles.
- herge 13y ago
  I'm sure your software engineer certification program will be way more successful and effective than government procurement certification program that certified these clowns in the first place.
- fiatmoney 13y ago
  I guarantee that the contractors involved were loaded with a significant number of Java & Microsoft certified developers. Furthermore, I'd guarantee that the Big Dig, et al, were loaded with certified "real" engineers. Certification (even some fancy "project management" certification) doesn't get you any guarantees of project quality as a whole. If anything, I'd expect a focus on certification to decrease quality. Those things are expensive & time-consuming and the only ones who invest in them are the people who expect to be in that consulting ecosystem for a long time. There are processes, not certifications, that result in generally high-quality projects (see NASA's processes) at the cost of being incredibly slow and expensive.
  - lightblade 13y ago
mberning 13y ago
In this latest witch hunt I am sure there is plenty of blame to go around. This is not the first 1.0 system to have serious problems. It will get better. You would think they crashed the Space Shuttle and killed some people given the level of grilling they have received.
- mgkimsal 13y ago
  Ummm.... many people are now legally required to buy insurance, and this marketplace is the only option for many of those people. Saying "use the system or pay a fine, oh and by the way the system doesn't work" is not the same comparison to many other "1.0" systems which are optional to use.
  - mberning 13y ago
    My understanding is that it IS possible to register rather quickly during non-peak times. You are also not required to go through the marketplace to acquire insurance. And finally, open enrollment ends in March 2014, so there is plenty of time to get this sorted. The media coverage and congressional circus is blowing this way out of proportion.
    - mgkimsal 13y ago
      Not entirely. They've completely hosed up existing data. Took me 2 weeks to get in, finally got in. Application created for my wife and I. System broke. Logged in a couple days later. My wife's data is gone. No ability to add it back in. No ability to delete current application. No ability to start a new application. It's a mess. Registering and using vastly different. Given that it took them years to get this far, I don't have a whole lot of hope that this will be usable for everyone, with data problems sorted, by March. Possible, but not likely. Especially because the attitude of "hey, just go somewhere else to buy" is so quick to be used. If that's really the case, why did we bother to even put this together, if it's not at all necessary or required? There's going to be massive loads of hidden bugs that will plague this for months, if not years. Having such a tight deadline on it is crazy because it's not at all how any large insurance agency works, nor is it how the federal government works.
sailfast 13y ago
The most useful part about this article for me was to discover that Northrop Grumman's CISO is phishing its own employees. Brilliant. Wish I had thought of it. Great way to keep people on their toes and aware of what's going on in the space.
- gohrt 13y ago
  This is standard practice for all IT organizations, and any org that isn't testing its security is failing at security.
  - ihsw 13y ago
    Same for backups. If you have six months of backups but you haven't tested any of them, and they broke four months ago, then it's going to be very unpleasant.
UnoriginalGuy 13y ago
I might be horribly misreading this, but it reads like they're talking about no specific threat or problem but rather arguing if that was part of the contract or not? If that's the case then shouldn't lawmakers, being lawmakers, pass laws so that future government projects include a clause in the contractual arrangement? Isn't that just common sense? Seems like this is a trend with the US government, they try to find others to blame instead of just fixing the damn issue. They had this massive set of hearings about people abusing military disabilities (e.g. claiming for disabilities obtained before joining the US military) but didn't actually, you know, fix the freaking issue -- or even try to. They just berated the people being advantaged from it.
- Bsharp 13y ago
  > they try to find others to blame instead of just fixing the damn issue. This is for two reasons: 1) Fixing something makes it appear, politically, like it's your fault, or at least savvy opposing politicians can spin it that way. 2) The incentive to fix the issue <= incentive to shift the blame. If one party points their fingers, the other must point back, lest the public think the first party is right. Shifting blame is easy, one can do it without working too hard, and it can fuel public debate which forgets about the original issue. Many politicians care less about fixing problems and more about getting/staying elected.
- dragonwriter 13y ago
  > If that's the case then shouldn't lawmakers, being lawmakers, pass laws so that future government projects include a clause in the contractual arrangement? They already passed a law creating mandatory security requirements for Federal IT systems, whether contracted out or built in house or any combination. [1] [1] http://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002 http://en.wikipedia.org/wiki/Federal_Information_Security_Ma...
gxela 13y ago
Regardless, government site or not, who currently does care about security? Most code I have seen widely in production is using old sql injection vulnerable code. No sanitization and no proper session handling. You would think that people would care about something like security with all the privacy concerns. I wish I had better words to say this, but I had just woke up and out the door to breakfast.
- viraptor 13y ago
  I keep thinking whether it would be a good idea or not to hold companies responsible for security issues affecting their users. If you fail to secure passwords, why shouldn't there be a fast-track way to sue? Almost any physical service provider I can think of already is responsible for damages. Your plumber fails - in most cases the company is insured and will fix at no cost and will be responsible for damages. Your mechanic fails - there's likely a clause in their agreement that allows you claim for the damage caused. Even if your payment card is misused, the bank is expected to reverse the charges. Why are the internet service providers excluded from this treatment? Sure, it's possible that this kind of danger would be then aimed at separate developers working in those companies too... but I'm not sure it's a bad thing. It would be easier to resist stupid requirements (I won't do it, because it would bring legal issues on me) and even the comments on SO would be different too ("if you do this, you will be sued", rather than "this is not a secure way to do it").
gohrt 13y ago
The overall project needs an independent security evaluation by a separate organization. Without an audit and tests before launch (and ongoing after), any problems discovered in production are the primary contractor/procurors's responsibility.
beauzero 13y ago
It was a 3 year project with requirements changing up until the last 4 months where end-to-end was managed under waterfall (some pieces/contractors used agile like methodology)...and there was 2 weeks of final end-to-end manual QA...what the hell else did they expect to happen?
- hga 13y ago
  It was worse, the "no window shopping" decision was made less than 4 months before launch (August to September as I recall), and changes were made through the week before launch. The NYT reports 7 major changes in less than 10 months. And it didn't matter what the QA reported, the site was hell or high water launch Oct 1st whatever they revealed. As always, those with political power (reported to be the White House and CMS, maybe some of HHS) trump those who have to make it work in the real world.
joshuahedlund 13y ago
I don't think the one line quote from the hearing necessarily supports the headline, but I certainly don't have high hopes that the site is secure; the number of bugs and inconsistencies I found just trying to create an account dissolved any hope of that.
mrweasel 13y ago
I hope (naively) that one day, software developer will collectively tell the governments that they work for "Sorry, no amount of money will deliver what you're asking for". Pretty much every government IT projects I've seen fail, that's most of them here in Denmark, has done so because of politics, laws and regulations. The thing is: the big contractors like CGI, aren't going to turn down the money. They are only to happy to deliver a poor product because they are paid millions and never asked to account for the failures of these projects. It would be better for the industry as a whole to say NO to projects we know will fail. I don't for a second believe that CGI software developers thought that they could make healthcare.gov a massive success, or even just plain decent. If they couldn't see that, then they shouldn't be doing software development in the first place. Doing a postmortem this way is refreshing, except you'll never get the right answer: "With the time available (not the money) this was never going to work. The integration with legacy system and the shear amount of these integration points makes this an almost impossible project". In reality will get a lot of blame allocation and CGI won't be made accountable for accepting a project that should have be rejected by anyone with half a brain.
- hga 13y ago
  Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, right into the week before launch??? Also check the date of the "you must register first, no window shopping" decision, it was quite late and had a very major impact. That CMS, responsible for integration testing, would delay that until 1-2 weeks before launch (see above change orders problem), see the tests failed, and launched anyway. Well, I'm actually sure CGI wasn't surprised by the latter, but, still, I can't blame them for any of the above. The White House -> HHS -> CMS, all insufficiently experienced in running a major development project, turned out to be a customer from hell. Heck, given how important this site is, a key part of Obama's legacy, I and many others assumed the Administration would treat it with appropriate seriousness. We were wrong.
  - mrweasel 13y ago
    >Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, right into the week before launch??? When the second or third of the changes happens, CGI should have told them "NO, this cannot be done professionally" and hand them their money back.
david_shaw 13y ago
Most organizations don't take security seriously. I work in the information security industry--primarily focused on healthcare security--and you'd be amazed and appalled at the lengths that CIOs will go to say that they "don't need to be HIPAA compliant." More and more, though--especially as high-profile incidents become more widely reported--security is starting to become an accepted norm. There's still not much budget for it, and it's still considered an inconvenience, but at least people recognize that spending some preventative dollars can save a significant amount in reactive responses (DFIR, legal fees, etc.). The HN crowd might be interested to know that the worst security offenders I've seen (even worse than old legacy systems) are software startups. Why? Slogans like "Ship First," or agile development cycles that don't include QA/security testing as part of a meaningful SDLC. What good is shipping something every two weeks, if one of those releases loses your customer database? My latest drive is to help organizations realize that security is a feature, not just an inconvenience. Once that idea is more commonly accepted, we'll all be better off.
patrickg_zill 13y ago
Blame the contractors? Instead of the ridiculous way the gov't handled it, with constantly changing requirements and a "change the car tire while we are driving" attitude? Sounds like the WashPost is trying to do some damage control.
- hga 13y ago
  I'm seeing enough of this trope, not to include the BBC initially, to wonder if this didn't hit the current incarnation of the Journolist. Unfortunately this disaster is so huge that's not adequate to tamp it down. But it sure looks like some are trying ... hmmm, what is the broadcast part of the MSM aside from Fox saying?

70 points by RougeFemme 13y ago

> In Slavitt's defense, data security may not have been an explicit feature of QSSI's federal contract Coming from the construction industry, there isn't a contractor in the world that cares about things which aren't in the contract. Implementing features which the client has not asked for, in the design-bid-build world of public-sector contracting, just means you will lose the bid to a lower bidder who won't do those extras.

gohrt 13y ago
Right. A solution is for the government to develop a series of security standards that cover a wide range of IT projects, and each project should declare that "implementation must conform to Security Level X, Category Y"
- dragonwriter 13y ago
  > A solution is for the government to develop a series of security standards that cover a wide range of IT projects, and each project should declare that "implementation must conform to Security Level X, Category Y" Well, you'd think so, which is why that's essentially already mandated: http://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002 http://en.wikipedia.org/wiki/Federal_Information_Security_Ma... http://en.wikipedia.org/wiki/Federal_Information_Processing_Standards http://en.wikipedia.org/wiki/Federal_Information_Processing_...
smackfu 13y ago
And if you go beyond the contract, and stuff doesn't work, you get blamed and have to eat the cost of fixing it.
- 31mamun 13y ago
  <a href="http://knottspinegosford.com.au">Furniture http://knottspinegosford.com.au">Furniture stores central coast</a>
- 31mamun 13y ago
  http://knottspinegosford.com.au http://knottspinegosford.com.au
growupkids 13y ago
Which is also true in government contracting. What's odd is that security requirements are mandated by law, FISMA, so the government is supposed to require that systems meet the FISMA requirements. You shouldn't be able to get an ATO without it, unless the management of that agency "accepts the risks" (SES levels only, gS personnel can't do this) and waives the vulnerabilities. So if I had to guess, if they didn't protect the data then it's likely those controls were notin place everyone knew they were not and the agency heads said it was ok. All fed systems get tested, and the system certifier is supposed to be an impartial reporter of the facts (these are the vulns, missing controls, risks, etc. and they are almost always impartial). They report those to the DAA along with a recommendation to approve or not approve the system to operate. Given how important this system was, I highly doubt anyone would not have issued the ATO no matter what vulns it had. And that's not to pick on this system, sadly slap dash rush ATOs happen far too often in the USG. If you spend a ton of time and money on a system, execs in the USG have their careers on the line to show that wasn't wasted and since they don't understand security it all seems like science fiction to them. They almost always ATO the system. And why not, no USG exec has ever been fired for having a poorly protected system broken into.
- dragonwriter 13y ago
  eigenvector: Implementing features which the client has not asked for, in the design-bid-build world of public-sector contracting, just means you will lose the bid to a lower bidder who won't do those extras. growupkids: Which is also true in government contracting. "Public-sector" = "government".
greenyoda 13y ago
"Coming from the construction industry, there isn't a contractor in the world that cares about things which aren't in the contract." In the construction industry, a contract might not explicitly say that the building has to comply with local building, fire and electrical codes - that's taken as a given. To construct a web site that deals with sensitive information without taking security into account is like building a skyscraper with no fire exits - not something that any honest or competent builder would do.
- thezilch 13y ago
  Not "would do" but "could do;" you can't build, honest and competent or not, without local code-compliance. Perhaps the same should be true for the web; perhaps there should be damages for poor security; government or not.
  - dragonwriter 13y ago
    > Not "would do" but "could do;" you can't build, honest and competent or not, without local code-compliance. You can, and people do, and they are cited for it when caught. Likewise, there are mandatory standards for Federal IT systems, particularly in the area of security.
- lmkg 13y ago
  Yes, but those are actual codes. In fact, that's why they're codes. Contractors won't do more than they're legally required to (nor should they be expected to), so safety features were made legal requirements. Relying on the honesty or competency of your contractors go above & beyond their requirements is an inefficient and unsustainable solution in a free market. This is a clear case of Moral Hazard: In the same way that bad money drives out good, corner-cutting organizations out-compete honest ones.
  - benmanns 13y ago
    What about reputation? I regularly do more than the legal minimum for my clients and there are companies who do the same for me. Meeting the legal minimums only makes sense for commodities, e.g. this salt is 99.5% pure. This software is 99.5% "secure"? This software is 99.5% "complete"?
nraynaud 13y ago
actually security is not a feature, but a constraint. It doesn't bring the user anything, but it absence would be a problem for secondary reasons (that might be important in the grand scheme of things). Imagine a bank (well just an account), on the functional level, you just need to deposit and withdraw money. The fact that they have to secure it is a huge constraint, but at the functional level we're not far from a trash can, a parking lot or a gas tank.

VMG 13y ago

Or else what?

jcutrell 13y ago

If anyone saw this briefing, it was mostly a lot of really technologically illiterate people asking pointed questions about a gigantic set of systems that can't easily be answered to technologically illiterate people. At one point, a congressman, with the tone of a disappointed parent, said (paraphrased) "I am very disappointed in you all. have yet to hear any one of you say sorry to the American people." Someone in the room retorted with "we didn't hear an apology when the government shut down either." (You'd expect someone to get timeout for this kind of pettiness.) With that said, one of the obvious problems was blame shift, as this article points out. The guy was (I don't remember this particular interchange) most likely outlining the fact that the question being asked of him wasn't relevant to "his responsibilities" in the contract. However, when responsibilities of a project are distributed, things fall through the gap. This article is a bit too short to give enough space for the subject, but I think it does point out the most important issue - no one really had full control of the project.

uptown 13y ago
I watched most of it yesterday. It was a fascinating post-mortem of a software project. What I saw was a small minority of politicians that seemed to have a handle on some of the technological challenges at-hand. Some politicians used their time to score political points completely unrelated to the technology issues - basically "our party is good / your party is bad" idiocy. Some politicians read prepared smart-sounding questions which they wouldn't be able to rephrase in another-way if they were asked to. One politician asked for a copy of the server logs so that Congress could get to the bottom of what was going wrong. And none of the company representatives were willing to accept that they'd done much wrong - instead taking every opportunity to blame people or entities not in the room.
- aryastark 13y ago
  > One politician asked for a copy of the server logs so that Congress could get to the bottom of what was going wrong. No need to worry, folks! Your government is on top of things. I wonder, how many Congress idiots does it take to fix the caching policy on a web server?
13y ago

uptown 13y ago

So Rep. Mike Rogers is now suddenly concerned with protecting the security of data? The same guy that's been defending everything the NSA has been exposed to have done?

cobrausn 13y ago
So, I know we are looking for hypocrisy here because gasp hypocrisy, but there really isn't any. You were providing your information to the government, making sure nobody other than the government sees it isn't at conflict with defending the NSA's actions if you see this kind of activity as legitimate.
- uptown 13y ago
  On one hand he's alarmed that enrollment data may not be properly protected. On the other hand, he's protecting an agency that's requiring technology companies to create back-doors and weaken encryption algorithms for the NSA's convenience. How are those two objectives not in conflict?
  - shortstuffsushi 13y ago
    > How are those two objectives not in conflict? A. The government wants all your data available to them. B. The government does not want all your data available to the public. A != B Edit: Not to come off as rude, I just tend to agree. If you want to say that in that sense, the government is being hypocritical, perhaps that's true. At the same time, though, their goal here is (hopefully) to keep your data safe from outsiders, whereas we can "trust" them to be good with the data they backdoor from companies ;)
  - joyeuse6701 13y ago
    Basically, the gov't is allowed to have all your information and see it, and no one else. Enrollment data needs to be protected from everyone but the US gov't is the stance. From this perspective, there is not conflict of interest.

lightblade 13y ago

Can we talk about software engineer certification yet? I tought things like this suppose to push on the movement.

gnoway 13y ago
Certification would be, at best, a third of the equation. It can demonstrate that you know how to do something correctly, not that you will do it correctly all the time or that you will be working in an environment that permits you to do it correctly.
- stan_rogers 13y ago
  No, we're talking about "affix a stamp and make yourself liable" engineering certs, not just competency testing. You know, PEng engineers, not just inflated job titles.
herge 13y ago
I'm sure your software engineer certification program will be way more successful and effective than government procurement certification program that certified these clowns in the first place.
fiatmoney 13y ago
I guarantee that the contractors involved were loaded with a significant number of Java & Microsoft certified developers. Furthermore, I'd guarantee that the Big Dig, et al, were loaded with certified "real" engineers. Certification (even some fancy "project management" certification) doesn't get you any guarantees of project quality as a whole. If anything, I'd expect a focus on certification to decrease quality. Those things are expensive & time-consuming and the only ones who invest in them are the people who expect to be in that consulting ecosystem for a long time. There are processes, not certifications, that result in generally high-quality projects (see NASA's processes) at the cost of being incredibly slow and expensive.
- lightblade 13y ago

mberning 13y ago

In this latest witch hunt I am sure there is plenty of blame to go around. This is not the first 1.0 system to have serious problems. It will get better. You would think they crashed the Space Shuttle and killed some people given the level of grilling they have received.

mgkimsal 13y ago
Ummm.... many people are now legally required to buy insurance, and this marketplace is the only option for many of those people. Saying "use the system or pay a fine, oh and by the way the system doesn't work" is not the same comparison to many other "1.0" systems which are optional to use.
- mberning 13y ago
  My understanding is that it IS possible to register rather quickly during non-peak times. You are also not required to go through the marketplace to acquire insurance. And finally, open enrollment ends in March 2014, so there is plenty of time to get this sorted. The media coverage and congressional circus is blowing this way out of proportion.
  - mgkimsal 13y ago
    Not entirely. They've completely hosed up existing data. Took me 2 weeks to get in, finally got in. Application created for my wife and I. System broke. Logged in a couple days later. My wife's data is gone. No ability to add it back in. No ability to delete current application. No ability to start a new application. It's a mess. Registering and using vastly different. Given that it took them years to get this far, I don't have a whole lot of hope that this will be usable for everyone, with data problems sorted, by March. Possible, but not likely. Especially because the attitude of "hey, just go somewhere else to buy" is so quick to be used. If that's really the case, why did we bother to even put this together, if it's not at all necessary or required? There's going to be massive loads of hidden bugs that will plague this for months, if not years. Having such a tight deadline on it is crazy because it's not at all how any large insurance agency works, nor is it how the federal government works.

sailfast 13y ago

The most useful part about this article for me was to discover that Northrop Grumman's CISO is phishing its own employees. Brilliant. Wish I had thought of it. Great way to keep people on their toes and aware of what's going on in the space.

gohrt 13y ago
This is standard practice for all IT organizations, and any org that isn't testing its security is failing at security.
- ihsw 13y ago
  Same for backups. If you have six months of backups but you haven't tested any of them, and they broke four months ago, then it's going to be very unpleasant.

UnoriginalGuy 13y ago

I might be horribly misreading this, but it reads like they're talking about no specific threat or problem but rather arguing if that was part of the contract or not? If that's the case then shouldn't lawmakers, being lawmakers, pass laws so that future government projects include a clause in the contractual arrangement? Isn't that just common sense? Seems like this is a trend with the US government, they try to find others to blame instead of just fixing the damn issue. They had this massive set of hearings about people abusing military disabilities (e.g. claiming for disabilities obtained before joining the US military) but didn't actually, you know, fix the freaking issue -- or even try to. They just berated the people being advantaged from it.

Bsharp 13y ago
> they try to find others to blame instead of just fixing the damn issue. This is for two reasons: 1) Fixing something makes it appear, politically, like it's your fault, or at least savvy opposing politicians can spin it that way. 2) The incentive to fix the issue <= incentive to shift the blame. If one party points their fingers, the other must point back, lest the public think the first party is right. Shifting blame is easy, one can do it without working too hard, and it can fuel public debate which forgets about the original issue. Many politicians care less about fixing problems and more about getting/staying elected.
dragonwriter 13y ago
> If that's the case then shouldn't lawmakers, being lawmakers, pass laws so that future government projects include a clause in the contractual arrangement? They already passed a law creating mandatory security requirements for Federal IT systems, whether contracted out or built in house or any combination. [1] [1] http://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002 http://en.wikipedia.org/wiki/Federal_Information_Security_Ma...

gxela 13y ago

Regardless, government site or not, who currently does care about security? Most code I have seen widely in production is using old sql injection vulnerable code. No sanitization and no proper session handling. You would think that people would care about something like security with all the privacy concerns. I wish I had better words to say this, but I had just woke up and out the door to breakfast.

viraptor 13y ago
I keep thinking whether it would be a good idea or not to hold companies responsible for security issues affecting their users. If you fail to secure passwords, why shouldn't there be a fast-track way to sue? Almost any physical service provider I can think of already is responsible for damages. Your plumber fails - in most cases the company is insured and will fix at no cost and will be responsible for damages. Your mechanic fails - there's likely a clause in their agreement that allows you claim for the damage caused. Even if your payment card is misused, the bank is expected to reverse the charges. Why are the internet service providers excluded from this treatment? Sure, it's possible that this kind of danger would be then aimed at separate developers working in those companies too... but I'm not sure it's a bad thing. It would be easier to resist stupid requirements (I won't do it, because it would bring legal issues on me) and even the comments on SO would be different too ("if you do this, you will be sued", rather than "this is not a secure way to do it").

gohrt 13y ago

The overall project needs an independent security evaluation by a separate organization. Without an audit and tests before launch (and ongoing after), any problems discovered in production are the primary contractor/procurors's responsibility.

beauzero 13y ago

It was a 3 year project with requirements changing up until the last 4 months where end-to-end was managed under waterfall (some pieces/contractors used agile like methodology)...and there was 2 weeks of final end-to-end manual QA...what the hell else did they expect to happen?

hga 13y ago
It was worse, the "no window shopping" decision was made less than 4 months before launch (August to September as I recall), and changes were made through the week before launch. The NYT reports 7 major changes in less than 10 months. And it didn't matter what the QA reported, the site was hell or high water launch Oct 1st whatever they revealed. As always, those with political power (reported to be the White House and CMS, maybe some of HHS) trump those who have to make it work in the real world.

joshuahedlund 13y ago

I don't think the one line quote from the hearing necessarily supports the headline, but I certainly don't have high hopes that the site is secure; the number of bugs and inconsistencies I found just trying to create an account dissolved any hope of that.

mrweasel 13y ago

I hope (naively) that one day, software developer will collectively tell the governments that they work for "Sorry, no amount of money will deliver what you're asking for". Pretty much every government IT projects I've seen fail, that's most of them here in Denmark, has done so because of politics, laws and regulations. The thing is: the big contractors like CGI, aren't going to turn down the money. They are only to happy to deliver a poor product because they are paid millions and never asked to account for the failures of these projects. It would be better for the industry as a whole to say NO to projects we know will fail. I don't for a second believe that CGI software developers thought that they could make healthcare.gov a massive success, or even just plain decent. If they couldn't see that, then they shouldn't be doing software development in the first place. Doing a postmortem this way is refreshing, except you'll never get the right answer: "With the time available (not the money) this was never going to work. The integration with legacy system and the shear amount of these integration points makes this an almost impossible project". In reality will get a lot of blame allocation and CGI won't be made accountable for accepting a project that should have be rejected by anyone with half a brain.

hga 13y ago
Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, right into the week before launch??? Also check the date of the "you must register first, no window shopping" decision, it was quite late and had a very major impact. That CMS, responsible for integration testing, would delay that until 1-2 weeks before launch (see above change orders problem), see the tests failed, and launched anyway. Well, I'm actually sure CGI wasn't surprised by the latter, but, still, I can't blame them for any of the above. The White House -> HHS -> CMS, all insufficiently experienced in running a major development project, turned out to be a customer from hell. Heck, given how important this site is, a key part of Obama's legacy, I and many others assumed the Administration would treat it with appropriate seriousness. We were wrong.
- mrweasel 13y ago
  >Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, right into the week before launch??? When the second or third of the changes happens, CGI should have told them "NO, this cannot be done professionally" and hand them their money back.

david_shaw 13y ago

Most organizations don't take security seriously. I work in the information security industry--primarily focused on healthcare security--and you'd be amazed and appalled at the lengths that CIOs will go to say that they "don't need to be HIPAA compliant." More and more, though--especially as high-profile incidents become more widely reported--security is starting to become an accepted norm. There's still not much budget for it, and it's still considered an inconvenience, but at least people recognize that spending some preventative dollars can save a significant amount in reactive responses (DFIR, legal fees, etc.). The HN crowd might be interested to know that the worst security offenders I've seen (even worse than old legacy systems) are software startups. Why? Slogans like "Ship First," or agile development cycles that don't include QA/security testing as part of a meaningful SDLC. What good is shipping something every two weeks, if one of those releases loses your customer database? My latest drive is to help organizations realize that security is a feature, not just an inconvenience. Once that idea is more commonly accepted, we'll all be better off.

patrickg_zill 13y ago

Blame the contractors? Instead of the ridiculous way the gov't handled it, with constantly changing requirements and a "change the car tire while we are driving" attitude? Sounds like the WashPost is trying to do some damage control.

hga 13y ago
I'm seeing enough of this trope, not to include the BBC initially, to wonder if this didn't hit the current incarnation of the Journolist. Unfortunately this disaster is so huge that's not adequate to tamp it down. But it sure looks like some are trying ... hmmm, what is the broadcast part of the MSM aside from Fox saying?