, involving a Medicaid server at the Utah Department of Health, resulted from a configuration error at the authentication layer of the server hosting the compromised data, according to state IT officials.

Many security analysts see that as a somewhat euphemistic admission by the state that the breached server was using a default administrative password or an easily guessable one. By taking advantage of the error, the attackers were able to bypass the perimeter-, network- and application-level security controls that IT administrators had put in place to protect the data on the server.

Such mistakes, though relatively easy to avoid, are surprisingly common.

In March, the inspector general of the U.S. Department of Energy released the results of an information security audit at the Bonneville Power Administration, which provides about 30% of wholesale power to regional utilities in the Pacific Northwest. According to the audit, vulnerability scans of nine applications used to support key financial, HR and security management functions at Bonneville identified 11 servers that had been configured with easily guessable passwords.

An attacker taking advantage of those vulnerabilities would have been able to gain complete access to the system. Four servers were configured to allow any remote user to access and modify shared files. One server hosted an administrator account that was protected only with a default password.