Cyber security threats: weak and default passwords

The idea

Weak and default passwords are a common cyber security threat because they let an attacker gain access to an account or device without breaking any encryption. A weak password is one that is easy to guess or crack, for example a short password, a common word, a name, a date of birth or a simple sequence. A default password is the one set by the manufacturer or supplier, such as a factory setting on a router or smart device, which is often the same across many units and published in manuals. If a user never changes it, an attacker can look up the default and log in. Learners should recognise both terms, explain why each is a risk, and suggest sensible protection such as long unique passwords and changing defaults on first use.

What earns the marks

• A weak password is easy to guess or crack, for example a short password, a common word, a name or a predictable sequence.
• A default password is the factory or supplier setting that comes with a device or account.
• Default passwords are a risk because they are often identical across many devices and may be published in manuals or online.
• Attackers can use guessing, dictionary or brute-force methods against weak passwords to gain unauthorised access.
• Protection includes choosing long, unique passwords and changing any default password immediately on first use.

Common mistakes and how to put them right

• Treating weak and default passwords as the same thing.

  Put it right: A default password is a supplied setting, while a weak password is one that is easy to guess or crack, and a password can be one without the other.

• Believing a default password is safe because it came with the device.

  Put it right: It is widely known and must be changed.

• Thinking only humans guess passwords.

  Put it right: Automated tools can try many combinations quickly, so short or common passwords fall fast.

Exam tips

• Give a clear example of each type, such as a common word for weak and a factory router setting for default.
• State the consequence, namely unauthorised access to the account or device and the data on it.
• Offer a specific defence, such as changing defaults on first use and using long unique passwords, rather than a vague 'be careful'.