Forgetting to change default logins on IT systems has emerged as one of the most common cybersecurity mistakes made by US companies and organizations, according to a recent advisory released by the NSA and the US Cybersecurity and Infrastructure Security Agency (CISA). The advisory highlights the top 10 cybersecurity misconfigurations that large organizations in the country frequently fall victim to.
At the top of the list is the failure to change default configurations on new software or hardware added to an organization’s IT network. Default configurations, including login credentials, are often readily available on the internet, making it easy for hackers to exploit them through a simple web search. This oversight allows attackers to navigate through a victim’s network or take control of devices such as printers, scanners, and security cameras.
The second most common mistake is the improper separation of user/administrator privilege, which involves granting low-level employees access to an entire IT network. If a hacker gains control of an employee’s account, they can easily compromise the entire network.
The rankings were based on assessments from the offensive and defensive security testing teams at the NSA and CISA, who have been working to safeguard IT networks across various sectors, including defense, government, and private industries.
To address these common vulnerabilities, the NSA and CISA have released the advisory in hopes of prompting action from the public and software manufacturers. CISA warns that these misconfigurations are frequently found in assessments and have led to numerous compromises by cyber actors.
The top 10 cybersecurity misconfigurations identified in the advisory are as follows:
1. Default configurations of software and applications
2. Improper separation of user/administrator privilege
3. Insufficient internal network monitoring
4. Lack of network segmentation
5. Poor patch management
6. Bypass of system access controls
7. Weak or misconfigured multifactor authentication (MFA) methods
8. Insufficient access control lists (ACLs) on network shares and services
9. Poor credential hygiene
10. Unrestricted code execution
The report also highlights the frequent use of unsupported Windows operating systems without critical updates addressing remote code execution vulnerabilities, such as MS17-010 (the EternalBlue exploit) and MS08-67.
By raising awareness about these common mistakes, the NSA and CISA aim to encourage organizations and software makers to take necessary precautions and implement robust cybersecurity measures.