IT department and auditors at major pharmacy chain got into a rip-roaring fight about using ‘password’ on Cisco firewall
A security tester found that a major US pharmacy chain used the word “password” as the administrator password on an internet-facing Cisco firewall. The discovery mattered because anyone who gained ordinary access to the device could potentially elevate their privileges and control network traffic.
The password was stored using Cisco’s reversible Type 7 encoding, which the tester said was easy to decrypt and had long been considered insecure. Auditors rated the issue as high priority, while IT staff argued it was less serious; the dispute lasted over an hour and delayed the presentation of other findings. The tester later learned that a high-priority finding would remove IT staff bonuses, creating an incentive to minimise the problem.
In short
- A pharmacy chain’s edge firewall used “password” for administrator access.
- The credential was stored in easily reversible Cisco Type 7 encoding.
- Bonus rules may have fuelled a prolonged dispute over the finding.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Auditors could reasonably classify the password as a high-priority weakness: “password” is easy to guess, and the reversible encoding offers little protection if someone can access the device’s configuration. Because administrator access could allow control of network traffic, prompt remediation and a rating that reflects the potential impact would support sound security oversight.
The case against
IT staff could reasonably argue that the finding’s severity should depend on how an attacker could first gain access, what safeguards limited that route, and the realistic scope of any resulting control. A high rating can carry operational and financial consequences, so they may have wanted evidence that the risk justified that classification and a proportionate response.