Though weak passwords are a well-known security vulnerability that allows malicious users to gain unauthorized access, the IG report found lapses in implementing strong password controls, Bowman said.