Since launching at the beginning of October, Healthcare.gov, the website through which uninsured Americans can access the insurance exchanges created by the Affordable Care Act, has suffered from performance issues tied to both heavy traffic and poor code design. Additional contractors have been brought in to fix some of the problems, and developers are working on an accelerated schedule to try to get the site working fully in time to meet initial enrollment goals before the end of the year. With the rapid pace of development currently in progress, some onlookers are concerned that the modifications and additions to the code could introduce new software security risks.
A compressed schedule
Although the site has been live since Oct. 1, only a small percentage of those expected to enroll have been able to do so. With enrollment dragging due to the technical impediments, the U.S. Department of Health and Human Services is in a hurry to get the system running smoothly as soon as possible. For people to sign up for coverage starting in January, they must enroll by Dec. 15, giving the Obama administration a hard deadline it must do its best to pre-empt. According to The New York Times, administration officials approached contractors in mid-October to see if they could deliver repairs by Nov. 1. The timeline struck many as unrealistic, with one specialist suggesting that as many as 5 million lines of code might need to be modified.
Details on the actual process have remained scarce since, but contractors working under the umbrella of general contractor Quality Software Services Inc. have been working steadily on making changes in recent weeks and will continue to do so in the weeks ahead, according to Computerworld. At the minimum, thousands of lines of code are expected to be modified to correct existing issues. To many onlookers, this schedule is particularly challenging from a security standpoint.
Meeting secure development goals
According to Richard Stiennon, principal at security consulting firm IT-Harvest, the site has likely become an especially tempting target for hackers in the wake of its recent troubles. The accelerated development schedule now being attempted also limits the possibilities of following proper secure development processes.
“A secure software development effort takes time,” he told Computerworld. “I am very concerned that a rush job on the Healthcare.gov site will introduce new security vulnerabilities.”
Although the site itself stores little sensitive data, instead routing information between users, insurers and government agencies, it does rely on a data hub, operated by the U.S. Centers for Medicare and Medicaid Services, to quickly verify the eligibility of those attempting to enroll in insurance plans. An August report from the Inspector General of HHS had expressed concerns about the tight window for security testing surrounding the hub, but CMS announced shortly before the site’s launch that the hub had passed an independent security audit.
Nonetheless, concerns about security are likely to be reignited by the current development efforts. In addition to the speed with which development is happening, one of the challenges is the number of people who are being brought on to help fix the system, Dwayne Melancon, CTO of security vendor TripWire, told Computerworld.
“Coordinating complex application and infrastructure changes is challenging under the best of circumstances and it’s even worse during a mad scramble,” he said. “Haste is the enemy of good security. Security is complex and requires a lot of forethought and planning to be effective, so I’m concerned that trying to scramble and fix things quickly – especially on a live system – will introduce unintended security issues.”
To improve the coordination of secure development efforts while meeting time-sensitive development goals, contractors may be able to benefit from certain safeguards such as bringing in third-party auditors, Melancon said. Introducing tools such as static analysis software might also help ensure developers are scanning for vulnerabilities and errors as they build or modify code, reducing the likelihood of introducing new problems. Peer code review tools might also be helpful in allowing engineers to take a close look at code before rolling it out and to coordinate across different teams working on various parts of the site. As the efforts to correct Healthcare.gov errors continue, the project’s challenges can serve as lessons for similarly ambitious undertakings in other organizations.
Software news brought to you by Klocwork Inc., dedicated to helping software developers create better code with every keystroke.