由买买提看人间百态

boards

本页内容为未名空间相应帖子的节选和存档,一周内的贴子最多显示50字,超过一周显示500字 访问原贴
USANews版 - Hearing: Security Flaws in Obamacare Website Endanger Americans
相关主题
Reassuring: ‘I would say the website is either hacked already or will be soon’Obama: You Can Put Lipstick on a Pig
杨林Blog: Obama 为什么不配作美国总统肤色高于党派,“Colin Powell might endorse Obama”
What to Watch as Arizona Votes on Tuesday老马还挺乐观的。。。 McCain guarantees victory
现在也就共和党的敢说几句实话了25个最差的Job Markets。
奥巴马的“祖母门”(Grandmother Gate)气候门骗子继续暴光.
63年来第一次,肯尼迪家族里没有一个任职美国总统或联邦议员现在House Replican一个个上来再干嘛?
老马昨天在Jay Leno Show哈,ARIZONA牛13大了
McCain民调出现五月以来最大领先Ariz. Gov Wants Panel to Combat 'Mistruths' on Law
相关话题的讨论汇总
话题: security话题: said话题: website话题: kennedy话题: americans
进入USANews版参与讨论
1 (共1页)
l****z
发帖数: 29846
1
BY: Elizabeth Harrington Follow @GoliadGal
November 19, 2013 6:12 pm
A panel of IT experts had one answer for Congress when asked if Americans
should use the Obamacare exchanges on Healthcare.gov in light of its
security concerns: “No.”
A quartet of experts testifying before the House Committee on Science, Space
, and Technology cited numerous security flaws within Healthcare.gov. They
attributed the risks to the complexity of its 500 million lines of code and
a rushed rollout that failed to properly test the website.
David Kennedy, the founder of TrustedSec, an online security firm, said that
the risks were easy to ascertain.
“Just by looking at the website we can see that there is just fundamental
security principles not being followed, things that are basic in nature that
any security tester, like myself or anyone that we hire to test these sites
, would actually test for prior to being released,” Kennedy, formerly of
the National Security Agency and a one-time cyber-intelligence analyst for
the U.S. Marine Corps, said.
The experts said the personal information of millions of Americans is at
risk, including Social Security numbers, birthdays, incomes, home mortgages,
and addresses. Rep. Mo Brooks (R., Ala.) called it the “mother lode for
identity theft.”
“Americans should be scared to death,” said Rep. Chris Stewart (R., Utah).
Kennedy demonstrated an attack in the hearing room, showing how on Finder.
Healthcare.gov a hacker could breach into a computer, monitor its webcam,
and steal passwords.
Hackers from Russia or China could “absolutely” breach the online
marketplace, he said.
The problems could only get worse since the president’s team is trying to
fix the website while it is still up and running.
Morgan Wright, a cyber terrorism expert and CEO of Crowd Sourced
Investigations, LLC., said attempting to fix one line of code could open up
a “Pandora’s box.”
“You create an unintended series of cascading events you have no control
over because you don’t have a grasp of what the code is actually doing,”
he said. “You think you’ve changed one thing, by doing that you’ve opened
up a Pandora’s box of vulnerabilities on the other side.”
Kennedy said he has never seen anything like it.
“To be honest with you, I have not seen—and I’ve worked for Fortune 10,
Fortune 50, Fortune 1,000 companies, as well as on the government side—I
have not seen an application that pales in comparison to 500 million lines
of code, including some of the largest applications you would ever see in
the history of man.”
Because of the sheer amount of code, it is impossible to conduct a complete
end-to-end security assessment on the website, the panelists said. Just
reviewing it for security risks could take six months.
Fixing the flawed code will also be extremely expensive. The market value of
high-end website code is about $50 per line, Kennedy said.
“That’s where I’ve been trying to get my head around, just—half a
billion lines of code, particularly when you’re reaching out and pulling it
out of other databases and then standardizing,” said Rep. David Schweikert
(R., Ariz.). “Does something seem almost absurd?”
“Well, there’s also another paradigm, too, that it costs you $1 to fix it
before you launch, it will cost you up to $100 to fix it after you launch,”
Wright said.
Another concern is that the website is integrated with other federal
agencies, including the Internal Revenue Service (IRS).
“It hooks into the IRS, it hooks into DHS, it hooks into Experian, which is
a third party,” Kennedy said. “You have all of these trusted connections,
all these things that make up the site itself, but the pieces that actually
make up Healthcare.gov are multiple areas.”
“Given Healthcare.gov’s security issues, and assuming for the moment that
you would be personally responsible for all damages incurred from your
advice, would any of you advise an American citizen to use this website as
the security issues now exist?” asked Rep. Brooks.
Every witness said no.
Kennedy offered three recommendations to Congress. The best option, he said,
is to create “Healtcare.gov 2.0,” a completely redesigned second website
that will work in conjunction with the original. He estimated it would take
about six months to complete.
The other options are to take the website offline to fix it, which could
take four to six months, or introduce new code while it’s still running,
which could take years.
“I’m not a political person, I’m not here to talk politics, but if you’
re asking me from a technology standpoint, it would be easier to start over
again, lay the foundation of security, and start from the beginning,”
Wright said. “The security has to be the foundation of this site. Period.”
“Unfortunately the personal information that has already been entered into
Healthcare.gov is vulnerable to online criminals and identity thieves,”
Committee Chairman Lamar Smith (R., Texas) said. “President Obama has a
responsibility to ensure that the personal and financial data collected as
part of Obamacare is secure. It is clear this is not the case.”
“There is only one useable course of action: Mr. President, take down this
website.”
1 (共1页)
进入USANews版参与讨论
相关主题
Ariz. Gov Wants Panel to Combat 'Mistruths' on Law奥巴马的“祖母门”(Grandmother Gate)
pink underware, baby63年来第一次,肯尼迪家族里没有一个任职美国总统或联邦议员
GOP bill would ban guns within 1,000 feet of lawmakers老马昨天在Jay Leno Show
BYE BYE EARMARKSMcCain民调出现五月以来最大领先
Reassuring: ‘I would say the website is either hacked already or will be soon’Obama: You Can Put Lipstick on a Pig
杨林Blog: Obama 为什么不配作美国总统肤色高于党派,“Colin Powell might endorse Obama”
What to Watch as Arizona Votes on Tuesday老马还挺乐观的。。。 McCain guarantees victory
现在也就共和党的敢说几句实话了25个最差的Job Markets。
相关话题的讨论汇总
话题: security话题: said话题: website话题: kennedy话题: americans