🔒Pharmacy Chain's Cisco Firewall Password Set to 'password'
IT vs Auditors: A 3-Year Battle Over a Weak Password
TL;DR
A major pharmacy chain's Cisco firewall had its enable password set to 'password', leading to a prolonged conflict between IT and auditors over security risks. The weak password was marked as a 'high find' but resisted by IT for three years.
A major American pharmacy chain's Cisco firewall had its enable password set to 'password', a glaring security risk that sparked a three-year battle between the IT team and auditors. The password was stored in a reversible encoding with a publicly known key, making it trivial for threat actors to guess. Despite the auditor marking it as a 'high find' and needing immediate attention, the IT team resisted due to the compensation structure tied to security posture. The conflict highlights the severe consequences of misaligned incentives in security practices, with the pharmacy chain's security compromised for years.
Key Points
Cisco firewall enable password set to 'password', a known security risk.
Password stored in reversible encoding with a publicly known key, easy to decrypt.
Auditor marked password vulnerability as a 'high find', requiring immediate fix.
IT team resisted changes, conflict lasted for three years due to compensation structure.
Pharmacy chain's security compromised due to weak password, highlighting misaligned incentives.
Why It Matters
The pharmacy chain's security was compromised due to a weak password, leading to a prolonged conflict between IT and auditors. This highlights the critical importance of strong password practices and the risks of misaligned incentives in security teams. Any organization relying on Cisco firewalls should immediately review their password policies and ensure strong, non-reversible password storage.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.