Pharmacy Chain IT and Auditors Clash Over 'Password' Firewall Credential
A major US pharmacy chain's IT department and external auditors engaged in a heated dispute over the use of 'password' as the enable password on a critical edge firewall.
A significant security lapse at a major US pharmacy chain, where the enable password for an edge firewall was set to the universally weak 'password,' has sparked a contentious debate between the company's IT department and its auditors. The incident, revealed by security specialist Dahvid Schloss, highlights not only a critical misconfiguration but also the complex and often adversarial relationship between security teams and those tasked with verifying their compliance.
Schloss, COO of Suzu Labs, discovered the vulnerability during a routine audit of the pharmacy chain's network infrastructure. The firewall in question was an edge device, meaning it directly interfaces with the internet, making its security posture paramount. The enable password, which grants administrative privileges on Cisco devices, was set to the easily guessable string 'password.' This configuration presented a severe risk, as any attacker gaining initial access to the firewall could potentially elevate their privileges to full administrative control.
Adding to the severity, the password was stored using Cisco IOS type 7 encoding. Schloss noted that this is not a true hash but a reversible encoding with a publicly known key, making it trivial to decrypt even without direct access to the device's configuration. "Even back then, it was best practice not to use it," Schloss commented, emphasizing that this method of password protection was outdated and insecure even at the time of the audit.
The discovery was flagged as a "high find" by Schloss, indicating a critical vulnerability requiring immediate remediation. However, when presented to the pharmacy chain's auditing department, the IT team vehemently disputed the finding's severity. This disagreement escalated into a prolonged and intense argument involving Schloss, his manager, the auditing team, and the entire IT department.
According to Schloss, the audit team stressed the urgency of fixing the issue, while the IT team downplayed its significance, questioning its practical impact and arguing it should be classified as a medium-severity finding at best. The dispute was so heated and protracted that it consumed the entire allotted time for Schloss's presentation, preventing him from discussing other critical findings and recommendations.
Further complicating matters, Schloss later learned that the auditing department's findings directly impacted the IT team's annual bonuses. Any "high finding" would result in the elimination of these bonuses, revealing the underlying financial stakes driving the IT team's resistance. The argument was not merely about a weak password but about potential financial repercussions for an entire division.
This incident underscores a critical lesson beyond the obvious advice to avoid using 'password' as a password. It highlights the dangers of misaligned incentives within organizations. While tying compensation to security posture might seem like a logical way to encourage best practices, it can also lead to a culture of denial, minimization of errors, and resistance to external validation when vulnerabilities are uncovered.
The conflict persisted for years, with the client repeatedly asking Schloss to re-explain his findings long after he had moved on. The case serves as a stark reminder that technical vulnerabilities are often intertwined with organizational dynamics, human behavior, and financial motivations, making comprehensive security management a multifaceted challenge.