What happened
Dahvid Schloss, chief operating officer of Suzu Labs, has assessed networks for more than 15 years. A large American pharmacy retailer once asked him to audit its corporate switches, routers and firewalls, not to break in, just to look. On the edge firewall, the device facing the internet, the enable password was set to the word password. Cisco uses enable for the administrator credential. The literal string, p a s s w o r d.
That matters more than it sounds. Enable grants administrative rights over the firewall, which means control of network traffic. Anyone who reached the device over SSH, or through an exploit, with ordinary user privileges could have escalated and shut off all traffic between the internal network and the outside world.
Schloss did not guess. He decrypted the file holding the passwords by breaking Cisco's own protection, which he described as easy. The credential had been stored as Cisco IOS type 7, a reversible encoding with a publicly known key rather than a real hash. Even then that was understood to be bad practice. He recorded it as a high finding, the category meant to be fixed immediately.
Then the finding went to the auditing department, which had commissioned the work. He was put on a call with the audit team, the entire IT team, his own manager and others. Audit was alarmed. IT did not think it was a serious problem. The two sides argued for more than an hour while Schloss and his colleagues sat quietly on camera. He never finished presenting his findings, and the client kept asking him to explain them for three more years.
He later learned why. The auditing department controlled the IT team's bonuses, and any high finding would eliminate them. The argument was about an entire division's pay.
Why this is a GRC story
The finding was trivial. The escalation was not. Disagreement over severity is normal, but a call where severity is settled by whoever argues longest is not. Every programme needs a named risk owner and a defined tie break, otherwise rating becomes a negotiation and the register stops meaning anything.
This was a configuration failure with a known fix. Type 7 encoding is reversible with a public key, so anyone holding a config file holds the credential. What prevents it is a hardening baseline plus an automated check at build, rechecked in an audit. No amount of awareness training was needed. A standard was.
Incentives shape findings. Paying people for a clean audit is a reasonable instinct and a bad control. When a high finding means a lost bonus, the cheap path is to relabel it, and people under pressure pick the cheap path.
Three years of re explaining is the real failure. A finding that has to be presented again was never accepted into a remediation record with an owner, a date and evidence of closure.
What to watch
This is a case study rather than a live incident, so the useful questions are internal. When a severity rating was last challenged, did it change without new evidence? Can you list open high findings with owners and due dates in under an hour? Does your reward structure make arguing about a label cheaper than fixing a device that faces the internet?
Almost every auditor has sat quietly on that call.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.