Explaining security issues with healthcare.gov

David Kennedy (TrustedSec) summarizes his congressional testimony and blog post about security problems on healthcare.gov, explaining that passive reconnaissance and Google search techniques revealed approximately 70,000 exposed user records without any active hacking; he criticizes reliance on compliance (FISMA) as insufficient, calls out ongoing configuration and development flaws, and urges stronger federal oversight and comprehensive security testing.