I work for a hardware vendor and their customers are basically the same as Cisco's. So here is what happened with us - we had some hardcoded root password in the equipment during early development stages. And it was also known to some of the customers support staff for debugging. Then some of our tech leads raised this issue and discussed that we had to change the root password because it was a correct thing to do and don't wait for some breach in the field. After some usual months of bureaucracy someone did the push and actually changed the password in all versions.
Can you already guess what has happened next? :)
The biggest customer threw a gigantic hysterical fit and practically demanded to return the old root password which they knew. We just shrugged and complied. It's not like it will be ours network which can be breached. If they want to operate insecurely, they are welcome.
PS: just saying, no need to involve NSA in something that is better and more often explained by stupidity. :)
Can you already guess what has happened next? :)
The biggest customer threw a gigantic hysterical fit and practically demanded to return the old root password which they knew. We just shrugged and complied. It's not like it will be ours network which can be breached. If they want to operate insecurely, they are welcome.
PS: just saying, no need to involve NSA in something that is better and more often explained by stupidity. :)