Notifications
Clear all
Topic starter
20/08/2026 5:28 pm
TL;DR: A reported Louvre surveillance password of "LOUVRE," plus obsolete systems flagged in audits years earlier, shows how static credentials and legacy infrastructure can turn an access-control gap into an existential security failure, according to Ory. The case reinforces that IAM must move beyond passwords to MFA, passwordless access, and least privilege before compromise becomes routine.
NHIMG editorial — based on content published by Ory: Parlez-vous password? The Louvre's weak password and the IAM failure behind it
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when organisations rely on shared passwords in air-gapped systems?
A: Shared passwords destroy accountability and create permanent access that survives role changes, device changes, and personnel departures.
Q: Why do weak passwords and legacy systems increase identity risk so sharply?
A: Weak passwords reduce the cost of initial access, while legacy systems often lack modern monitoring, patching, and authentication safeguards.
Q: How do security teams know whether least privilege is actually working?
A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements.
Practitioner guidance
- Remove static passwords from high-value systems Replace reusable credentials on surveillance, admin, and infrastructure accounts with phishing-resistant authentication or passwordless methods, then confirm no shared secret remains as a fallback.
- Inventory every legacy identity dependency Identify systems still using outdated operating systems, unsupported authentication flows, or manual password handling, then classify them as remediation priorities before they touch sensitive assets.
- Apply least privilege to every privileged account Restrict each identity to the minimum task scope needed, and remove broad permissions from any account that can reach monitoring, security, or configuration functions.
What's in the full article
Ory's full blog post covers the operational detail this post intentionally leaves for the source:
- How the password failure illustrates modern IAM gaps across human and machine identities
- The role of MFA and passwordless authentication in removing reusable secret exposure
- Why least privilege changes the blast radius when a single identity is compromised
- How legacy systems create exceptions that identity governance must retire, not inherit
👉 Read Ory's analysis of the Louvre password failure and modern IAM gaps →
Weak passwords and legacy systems: what IAM teams need to fix?
Explore further
20/08/2026 6:16 pm
Static password trust is a broken governance premise, not just a weak control. Password-based access assumes the secret remains private, unique, and difficult to guess for the full period it is valid. That assumption collapses when the password is obvious, reused, or preserved in an old system that no longer reflects current risk. The practitioner conclusion is that reusable secrets should be treated as a lifecycle failure, not a configuration nuisance.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who is accountable when a simple password exposes a critical system?
A: Accountability sits with the owners of identity governance, system administration, and risk acceptance together. Frameworks such as the NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5 Security and Privacy Controls both require access control discipline, asset oversight, and corrective action when exceptions persist.
👉 Read our full editorial: Weak passwords expose the IAM failure behind the Louvre case
