HHS Cybersecurity Chief Expressed Concerns Over Health Exchange Site Associated Press (01/16/14) Kevin Charest, the Health and Human Services Departments top cybersecurity officer, recently expressed concern about potential vulnerabilities prior to the Obama administrations launch of the health exchange website. During a Jan. 8 deposition, Charest told congressional investigators that he had been unable to get any answers to his questions, which had lead him to conclude that the site testing didnt follow best practices. He and Teresa Fryer, another government cybersecurity professional with concerns about the sites vulnerabilities, testified before the House Oversight and Government Reform Committee on Jan. 16. Charest noted that while parts of the website underwent security testing, such testing is generally done once the system is fully built and stable, not while it is still being built and is frequently crashing. He said that he was not able to review the security evaluation of a key outside contractor until a month into the websites rollout, and found that the consumer-facing part of the website had only been granted a provisional six-month operational and security certificate. Fryer, the chief information security officer for the Centers of Medicare and Medicaid Services, testified that she had recommended against issuing full certification for that part of the website, but never sent the memo in which she expressed those thoughts. Charest expressed cautious optimism over the testing measures and increased vigilance implemented to reduce risk, telling the committee that he had no reason to believe that these broad mitigation strategies, if followed through in detail, would not mitigate the risk.
Posted on: Sat, 18 Jan 2014 02:10:12 +0000