Forgetting to change default logins on IT systems has emerged as one of the most common cybersecurity mistakes made by US companies and organizations, according to a recent advisory released by the NSA and the US Cybersecurity and Infrastructure Security Agency (CISA). The advisory highlights the top 10 cybersecurity misconfigurations observed at large organizations in the country.
At the top of the list is the failure to change default configurations on new software or hardware added to an organization’s IT network. Default configurations, including login credentials, are often publicly available on the internet, making it easy for hackers to exploit them. By using default credentials, attackers can easily navigate through a victim’s network or take control of devices like printers, scanners, and security cameras.
The second most common mistake is the improper separation of user/administrator privilege, which involves granting low-level employees access to an entire IT network. If a hacker gains control of such an employee’s account, they can easily compromise the entire network.
The rankings were based on assessments conducted by the offensive and defensive security testing teams at the NSA and CISA. These teams have been responsible for safeguarding IT networks in various sectors, including the Department of Defense, federal, state, and local governments, as well as the private sector.
To address these common mistakes and prevent them from being exploited, the NSA and CISA have released this advisory in the hope that it will prompt action from the public and software manufacturers.
CISA warns that these misconfigurations are frequently discovered during assessments, hunts, and incident responses conducted by their teams. The tactics, techniques, and procedures (TTPs) associated with these misconfigurations are commonly employed by multiple cyber actors and have resulted in numerous compromises.
The top 10 cybersecurity misconfigurations identified in the advisory are as follows:
1. Default configurations of software and applications
2. Improper separation of user/administrator privilege
3. Insufficient internal network monitoring
4. Lack of network segmentation
5. Poor patch management
6. Bypass of system access controls
7. Weak or misconfigured multifactor authentication (MFA) methods
8. Insufficient access control lists (ACLs) on network shares and services
9. Poor credential hygiene
10. Unrestricted code execution
The report also highlights that organizations frequently use unsupported Windows operating systems without critical updates addressing remote code execution vulnerabilities. These updates, such as MS17-010 (the EternalBlue exploit) and MS08-67, were released years ago.
By addressing these common misconfigurations and ensuring proper cybersecurity practices, organizations can significantly reduce their risk of falling victim to cyberattacks.