U.S. Gov Employee Responds to TrustedSec's Review of Healthcare.gov

After I wrote yesterday's article "The Questionable Value and Ethics of TrustedSec's Pen Test of the HealthCare.gov Website", I received an email from a well-respected employee of a large government agency who had read TrustedSec's report on the Healthcare.gov website. This employee has asked me if I would publish the content of that email on my blog. Here it is with some minor formatting changes.

-------------------

So let's put aside the isc2 ethics violation by TrustedSec that this "report" is and instead focus upon its content."

The report is split into two parts, one based upon public open source intel gathering, and on upon actual "analysis". Contrary to what Goebbels might say, repeating a lie does not make it true. The first half of the "analysis" consists of misquotes and out of context statements about news reports, blog postings and the Heritage foundation (an anti-Affordable Care Act org). 

They extrapolate from news articles and jump to conclusions that would be laughed out of a Bsides conference, let alone a court of law. Most of the "observations" are generic in nature with no supporting detail. Everything is anecdotal. Everything is hearsay. There is no direct observation of any vulnerability, and only "potential risks". 

Many of the articles highlight pre-launch issues that have since been resolved, and others are issues common to most web application (hello, user enumeration? Seriously? Any site with a unique user account has this issue).

This lack of substance extends to the second part of the "analysis" which shows a lack of understanding of both what healthcare.gov is and what security is. 

In the professional world of cyber security there are two concept at the heart of computer forensics; peer review and reproducibility. Professionals understand that their word is not enough and they actually have to show something that the community and their peers can reproduce. None of their findings are "reproducible" vulnerabilities. They are all vague possible-maybe-there-could-be risks, or worse yet, a gross misunderstanding of what they are "analyzing."

They raise issues with things like the Terms of Service (TOS).

They raise issues with data.healthcare.gov.

Healthcare.gov is not just a website, it is a complex node in a web of Federal, State, and private systems that interconnect to produce the healthcare.gov site. The data in it comes from state exchanges, medicare, the IRS, SSA, and other Federal/state agencies, plus private insurers. It's not just a webserver/webapp with a back end database like something circa 2003.

They raise an issue that data will be shared with outside agencies which shows they don't understand what healthcare.gov is. Then they raise another issue about public profiles on the data.healthcare.gov site. The fact is that Data.healthcare.gov is an open data initiative based on the data gathered from insurers. Public profiles are a feature, not a bug, of that SEPARATE platform.

These two examples show the lack of due care conducted on this analysis. Please take a moment to read the "results" [CARR: A link to TrustedSec's report is provided below]. The level of writing and actual deliverable are so laughable that if a contractor had produced this for my agency I would have terminated their contract on the spot. (The report shows) no due diligence, sloppy work, and worst of all it is wrong in its "conclusions". 

Determinations need proof beyond media quotes and theoretical issues. They need to be based in fact.

------------------------

Here's a link to TrustedSec's public report (.pdf) for those readers who wish to review it and assess the above criticism for themselves. Comments are open.

UPDATE (12/13/13): "On December 11, in order to address ongoing questions, Committee members and staff received a classified briefing from Dr. Kevin Charest, the HHS Chief Information Security
Officer, and Ned Holland, HHS Assistant Secretary for Administration. Portions of this briefing
were classified to protect information relevant to national security. This memo contains a summary of the unclassified portion of the briefing."

Add to Cart View detail

Cyber Profiteering: Profits Over Ethics

Profiteering is what happens when a business takes advantage of an emergency or a shortage to boost their prices. The Iraq war had its war profiteers like Haliburton/KBR and many others. The same thing is happening today during the "cyberwar" gold rush. Two recent examples are Gunter Ollman's article "Sinkholing for Profit" and Brian Krebs' article "Chasing APT: Persistance Pays Off". Krebs should have underscored the word "Pays" in the title because the article describes something akin to ambulance chasing. A cybersecurity firm Cyber ESI uses proprietary techniques (perhaps similar to what Ollman describes in his article) to identify corporate victims, then contacts them and tries to sell them remediation services at a high price. Unlike Krebs' article, Ollman didn't provide any names but thanks to Anonymous and the AntiSec movement, at least two companies' profiteering activities have come to light: Unveilance and Endgame Systems.

It's no secret that corporations and governments are overwhelmed, confused, and desperately looking for solutions that will allow them to defend themselves in cyberspace. That's a perfectly understandable state for them to be in. What isn't understandable, at least to me, is the behavior of some companies seeking to make a quick buck at the expense of the very people that they're purportedly trying to help. For example, I'll never understand how Symantec can sell services to protect their customers against IP theft from China while at the same time be profiting from a joint venture with Huawei, a Chinese company with clear ties to the Chinese government.

Profit with no ethics is what brought us to the point that we're at today; the Occupy movement being just the beginning. If things don't change in the "Cyber Industrial Complex"(CIC) soon, there will almost certainly be a backlash. Fortunately, this level of greed hasn't infected the entire industry. I personally know dozens of infosec companies that profit by putting their customer first; by providing a fair service at a fair price and getting paid for results. If CIC CEO's don't adopt an ethical pricing model and business practices on their own, then their customers should do it for them. C-level executives at victim corporations need to educate themselves about the realities of information security and network defense because cyber profiteers count on two things to win a customer: ignorance and fear. Becoming smarter about information security will save you money and improve your company's profitability instead of the other guy's.

Add to Cart View detail