Keeping details about lockdown practices confidential is generally derided by information technology experts as “security through obscurity.” Disclosing some types of information could help hackers formulate break-in strategies, but other facts, such as numbers of break-ins or descriptions of how systems store personal data, are commonly shared in the private sector. “Security practices aren’t private information,” said David Kennedy, an industry consultant who testified before Congress last year about HealthCare.gov’s security.
Last year, the AP found that CMS Administrator Marilyn Tavenner took the unusual step of signing the operational security certificate for HealthCare.gov herself, even as her agency’s security professionals balked. That memo said incomplete testing created uncertainties that posed a potentially high security risk for the website. It called for a six-month “mitigation” program, including ongoing monitoring and testing. The site has since passed a full security test.