Separate abuse of default credentials from other credentials

[thorsheim]

If I understand this correctly, abuse of default credentials falls into the same category as successful bruteforced credentials.

I'd like to see a separation of those two, to better show the importance of changing default credentials, and perhaps convince vendors to change away from default credentials to "does not work without configuring a set of credentials" or something similar.

[gdbassett]

• We don't usually have the detail to code the two distinctions if they existed in veris.
• The difference in codes would be interesting but would not be likely to drive lots of practical actions
• We do not have a good way to update historically coded records.

[gdbassett]

updating from closed to deferred to the spit enum build.

[gdbassett]

considered 2018 and deferred again.

[gdbassett]

deferred 2019 over concern we would not have the granularity to tell the difference between the children.

[gdbassett]

If we know that the credentials are default, it should be coded as a action.*.variety.Exploit misconfig. However if we don't know know, brute force & use of lost & stolen is appropriate.