CISA Urges Tech Manufacturers to Stop Using Default Passwords

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to technology manufacturers, asking them to eliminate the risk of default password exploitation in their software and hardware devices.

Default passwords are often used to simplify the production or deployment process, but they also create a vulnerability that attackers can exploit to access online systems and networks. CISA cited several examples of incidents involving default password breaches, such as the Iranian hackers who compromised a U.S. water facility using a '1111' default password for PLC's.

CISA advises manufacturers to follow two principles: taking ownership of customer security outcomes and building organizational structure and leadership to achieve these goals.

CISA suggested some alternatives to using default passwords, such as providing unique setup passwords for each products instance, implementing time-limited setup passwords that deactivate after the setup phase, requiring physical access for the initial setup, and prompting admins to use more secure authentication methods, such as MFA.

Get the full details by reading the original article.