This Obamacare contractor doesn’t take security seriously

Right. A solution is for the government to develop a series of security standards that cover a wide range of IT projects, and each project should declare that "implementation must conform to Security Level X, Category Y"

And if you go beyond the contract, and stuff doesn't work, you get blamed and have to eat the cost of fixing it.

Which is also true in government contracting. What's odd is that security requirements are mandated by law, FISMA, so the government is supposed to require that systems meet the FISMA requirements. You shouldn't be able to get an ATO without it, unless the management of that agency "accepts the risks" (SES levels only, gS personnel can't do this) and waives the vulnerabilities.

So if I had to guess, if they didn't protect the data then it's likely those controls were notin place everyone knew they were not and the agency heads said it was ok. All fed systems get tested, and the system certifier is supposed to be an impartial reporter of the facts (these are the vulns, missing controls, risks, etc. and they are almost always impartial). They report those to the DAA along with a recommendation to approve or not approve the system to operate. Given how important this system was, I highly doubt anyone would not have issued the ATO no matter what vulns it had. And that's not to pick on this system, sadly slap dash rush ATOs happen far too often in the USG.

If you spend a ton of time and money on a system, execs in the USG have their careers on the line to show that wasn't wasted and since they don't understand security it all seems like science fiction to them. They almost always ATO the system. And why not, no USG exec has ever been fired for having a poorly protected system broken into.

"Coming from the construction industry, there isn't a contractor in the world that cares about things which aren't in the contract."

In the construction industry, a contract might not explicitly say that the building has to comply with local building, fire and electrical codes - that's taken as a given. To construct a web site that deals with sensitive information without taking security into account is like building a skyscraper with no fire exits - not something that any honest or competent builder would do.

actually security is not a feature, but a constraint. It doesn't bring the user anything, but it absence would be a problem for secondary reasons (that might be important in the grand scheme of things).

Imagine a bank (well just an account), on the functional level, you just need to deposit and withdraw money. The fact that they have to secure it is a huge constraint, but at the functional level we're not far from a trash can, a parking lot or a gas tank.

> they try to find others to blame instead of just fixing the damn issue.

This is for two reasons:

1) Fixing something makes it appear, politically, like it's your fault, or at least savvy opposing politicians can spin it that way.

2) The incentive to fix the issue <= incentive to shift the blame. If one party points their fingers, the other must point back, lest the public think the first party is right. Shifting blame is easy, one can do it without working too hard, and it can fuel public debate which forgets about the original issue.

Many politicians care less about fixing problems and more about getting/staying elected.

> If that's the case then shouldn't lawmakers, being lawmakers, pass laws so that future government projects include a clause in the contractual arrangement?

They already passed a law creating mandatory security requirements for Federal IT systems, whether contracted out or built in house or any combination. [1]

[1] http://en.wikipedia.org/wiki/Federal_Information_Security_Ma...

So, I know we are looking for hypocrisy here because gasp hypocrisy, but there really isn't any. You were providing your information to the government, making sure nobody other than the government sees it isn't at conflict with defending the NSA's actions if you see this kind of activity as legitimate.

Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, right into the week before launch??? Also check the date of the "you must register first, no window shopping" decision, it was quite late and had a very major impact.

That CMS, responsible for integration testing, would delay that until 1-2 weeks before launch (see above change orders problem), see the tests failed, and launched anyway.

Well, I'm actually sure CGI wasn't surprised by the latter, but, still, I can't blame them for any of the above. The White House -> HHS -> CMS, all insufficiently experienced in running a major development project, turned out to be a customer from hell. Heck, given how important this site is, a key part of Obama's legacy, I and many others assumed the Administration would treat it with appropriate seriousness. We were wrong.

I watched most of it yesterday. It was a fascinating post-mortem of a software project.

What I saw was a small minority of politicians that seemed to have a handle on some of the technological challenges at-hand. Some politicians used their time to score political points completely unrelated to the technology issues - basically "our party is good / your party is bad" idiocy. Some politicians read prepared smart-sounding questions which they wouldn't be able to rephrase in another-way if they were asked to. One politician asked for a copy of the server logs so that Congress could get to the bottom of what was going wrong. And none of the company representatives were willing to accept that they'd done much wrong - instead taking every opportunity to blame people or entities not in the room.

Totally agree. One of the thoughts that came to my mind is that a public project like this one sh(c)ould be open source right from the beginning. That would solve a lot of quality issues on one hand, and probably the pricing will also be better for the Government/taxpayers.

While I am pretty sure that most congressmen do not get it, but there are some very qualified and awesome technical people who work in the Government. Probably, someone has to have the balls and call it open source one fine day.

> If anyone saw this briefing, it was mostly a lot of really technologically illiterate people asking pointed questions about a gigantic set of systems that can't easily be answered to technologically illiterate people.

This is, unfortunately, what every discussion among politicians regarding any sort of technology is.

Is there a video link where we can watch it?

for those who want to form their own opinion, the hearing can be viewed at: http://energycommerce.house.gov/hearing/ppaca-implementation...

I believe the part about end-to-end testing and HIPA were something that needed to be asked and was not answered in an acceptable manner. There are some technical folks on that committee and they even showed source code.

Ummm.... many people are now legally required to buy insurance, and this marketplace is the only option for many of those people. Saying "use the system or pay a fine, oh and by the way the system doesn't work" is not the same comparison to many other "1.0" systems which are optional to use.

No, the Space Shuttle is far less important.

This is standard practice for all IT organizations, and any org that isn't testing its security is failing at security.

Certification would be, at best, a third of the equation. It can demonstrate that you know how to do something correctly, not that you will do it correctly all the time or that you will be working in an environment that permits you to do it correctly.

I'm sure your software engineer certification program will be way more successful and effective than government procurement certification program that certified these clowns in the first place.

I guarantee that the contractors involved were loaded with a significant number of Java & Microsoft certified developers. Furthermore, I'd guarantee that the Big Dig, et al, were loaded with certified "real" engineers. Certification (even some fancy "project management" certification) doesn't get you any guarantees of project quality as a whole.

If anything, I'd expect a focus on certification to decrease quality. Those things are expensive & time-consuming and the only ones who invest in them are the people who expect to be in that consulting ecosystem for a long time.

There are processes, not certifications, that result in generally high-quality projects (see NASA's processes) at the cost of being incredibly slow and expensive.

I'm not so sure it was incompetent engineers on the bottom of this equation who caused it to fail.

I am 99% certain that the software engineers involved--that is, the ones who did the actual development of the software--had almost no say in the process that created this debacle, and were almost certainly powerless in steering the project's direction.

To take something from the article as an example, the QSSI executive's hedge about security not being part of his contract illustrates one of the real problems with our government contracting system. The sad fact is that it is more likely to have technologically illiterate "Business Analyst" and (cost-conscious) "Project Management" types making critical technology-related decisions about the scope of a project and contents of contracts than people who are technology-savvy, such as software or systems engineers, even if said people have some input.

A companion problem to this is the nature of government contracting. The QSSI guy is just doing what contractors do: they fulfill the letter of the contract (sometimes completely, sometimes by handwaving) and then when the government complains that the product doesn't work the way they wanted the contractor wins an extension or a follow-on (paid) contract to do the "additional" work.

It works like this for a reason. The "Analyst" ass-clowns in the government get better job security, because they're overseeing a project that can have its duration extended almost indefinitely. The contractor owners get to reap huge contracting windfalls. The lobbyists for the contractors who continue to bilk the government continue to get paid, and the Congressmen who the contractors buy, er, provide donations and campaign support for continue to hold their seats of power.

Look it like this: from their perspective, badly run projects that don't actually accomplish what they need to are a feature of government contracting, not a bug or problem to be solved.

I keep thinking whether it would be a good idea or not to hold companies responsible for security issues affecting their users. If you fail to secure passwords, why shouldn't there be a fast-track way to sue? Almost any physical service provider I can think of already is responsible for damages. Your plumber fails - in most cases the company is insured and will fix at no cost and will be responsible for damages. Your mechanic fails - there's likely a clause in their agreement that allows you claim for the damage caused. Even if your payment card is misused, the bank is expected to reverse the charges. Why are the internet service providers excluded from this treatment?

Sure, it's possible that this kind of danger would be then aimed at separate developers working in those companies too... but I'm not sure it's a bad thing. It would be easier to resist stupid requirements (I won't do it, because it would bring legal issues on me) and even the comments on SO would be different too ("if you do this, you will be sued", rather than "this is not a secure way to do it").

It was worse, the "no window shopping" decision was made less than 4 months before launch (August to September as I recall), and changes were made through the week before launch. The NYT reports 7 major changes in less than 10 months.

And it didn't matter what the QA reported, the site was hell or high water launch Oct 1st whatever they revealed.

As always, those with political power (reported to be the White House and CMS, maybe some of HHS) trump those who have to make it work in the real world.

I'm seeing enough of this trope, not to include the BBC initially, to wonder if this didn't hit the current incarnation of the Journolist.

Unfortunately this disaster is so huge that's not adequate to tamp it down. But it sure looks like some are trying ... hmmm, what is the broadcast part of the MSM aside from Fox saying?