IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

In a recent incident involving a major American pharmacy chain, an IT department and auditors engaged in a heated dispute over the use of a weak password on a Cisco firewall. Dahvid Schloss, a cybersecurity expert, was commissioned to perform an audit of the organization's corporate switches, routers, and firewalls. During the audit, Schloss discovered that the firewall's enable password was set to "password".

This password, if accessed, could grant an attacker administrative rights to the firewall and disrupt network traffic. Schloss reported the password failure as a "high find," meaning it needed to be fixed immediately. However, when he presented his findings to the company's auditing department, the IT team downplayed the significance of the issue.

The two groups argued for over an hour about the severity of the password problem, ultimately stalling Schloss's presentation of his findings and recommendations. The dispute escalated to the point that the client continued to ask Schloss to explain his findings for the next three years, even though he had moved on to other projects.

The root cause of the conflict was not just the use of a weak password, but also a misalignment of incentives. The auditing department controlled the bonuses for the IT team, and any "high finding" would result in the loss of those bonuses. This created a situation where the IT team minimized the severity of the password issue and denied responsibility for fixing it.

The takeaway from this story is that weak passwords and misaligned incentives can have serious consequences for network security. Organizations must prioritize security and align incentives to ensure that employees take their responsibilities seriously and follow best practices.