Critical Security Misconfigurations to Avoid
Key Points
- Cloud misconfigurations rank as the third‑most common cause of data breaches in IBM’s 2023 report, trailing only phishing and stolen credentials, highlighting the critical need to address configuration errors.
- The leading security misconfiguration identified by the NSA and CISA is the use of insecure defaults—such as default admin credentials, enabled legacy services like Telnet, and self‑signed certificates—that attackers can easily discover and exploit.
- Proper system hardening involves removing or disabling unnecessary services and replacing default settings with secure, production‑ready configurations to eliminate attack surfaces.
- Improper separation of user and administrative privileges violates the principle of least privilege, making it essential to enforce strict privilege management so users only have access needed for their role.
Sections
- Dangerous Default Configurations - The speaker highlights that default settings—often containing easily discoverable credentials—rank as the top cloud misconfiguration causing data breaches, urging organizations to replace them before moving systems into production.
- Managing Privilege Creep and Least Privilege - The speaker explains that privilege creep occurs when permissions are granted but not revoked, emphasizing the principle of least privilege, the need to promptly remove unnecessary rights, maintain admin‑user separation, and avoid shared superuser credentials to reduce security risk.
- Combined Monitoring and Segmentation Needs - The speaker emphasizes using both host‑based and network‑based monitoring together with proper network segmentation to achieve full visibility and containment of malware propagation.
- The Crucial Role of Automated Patching - The speaker emphasizes upgrading outdated software and employing automated or regularly scheduled patch management to prevent known vulnerabilities from being exploited, even on systems that don’t contain sensitive data.
- Moving Toward Passwordless Multi‑Factor - The speaker advocates replacing single passwords with a multifactor, password‑less approach—combining biometrics, device possession, and cryptographic private keys (e.g., FIDO) to achieve stronger, less compromise‑prone authentication.
Full Transcript
# Critical Security Misconfigurations to Avoid **Source:** [https://www.youtube.com/watch?v=nwjROTpVpQQ](https://www.youtube.com/watch?v=nwjROTpVpQQ) **Duration:** 00:14:23 ## Summary - Cloud misconfigurations rank as the third‑most common cause of data breaches in IBM’s 2023 report, trailing only phishing and stolen credentials, highlighting the critical need to address configuration errors. - The leading security misconfiguration identified by the NSA and CISA is the use of insecure defaults—such as default admin credentials, enabled legacy services like Telnet, and self‑signed certificates—that attackers can easily discover and exploit. - Proper system hardening involves removing or disabling unnecessary services and replacing default settings with secure, production‑ready configurations to eliminate attack surfaces. - Improper separation of user and administrative privileges violates the principle of least privilege, making it essential to enforce strict privilege management so users only have access needed for their role. ## Sections - [00:00:00](https://www.youtube.com/watch?v=nwjROTpVpQQ&t=0s) **Dangerous Default Configurations** - The speaker highlights that default settings—often containing easily discoverable credentials—rank as the top cloud misconfiguration causing data breaches, urging organizations to replace them before moving systems into production. - [00:03:26](https://www.youtube.com/watch?v=nwjROTpVpQQ&t=206s) **Managing Privilege Creep and Least Privilege** - The speaker explains that privilege creep occurs when permissions are granted but not revoked, emphasizing the principle of least privilege, the need to promptly remove unnecessary rights, maintain admin‑user separation, and avoid shared superuser credentials to reduce security risk. - [00:06:31](https://www.youtube.com/watch?v=nwjROTpVpQQ&t=391s) **Combined Monitoring and Segmentation Needs** - The speaker emphasizes using both host‑based and network‑based monitoring together with proper network segmentation to achieve full visibility and containment of malware propagation. - [00:09:40](https://www.youtube.com/watch?v=nwjROTpVpQQ&t=580s) **The Crucial Role of Automated Patching** - The speaker emphasizes upgrading outdated software and employing automated or regularly scheduled patch management to prevent known vulnerabilities from being exploited, even on systems that don’t contain sensitive data. - [00:12:43](https://www.youtube.com/watch?v=nwjROTpVpQQ&t=763s) **Moving Toward Passwordless Multi‑Factor** - The speaker advocates replacing single passwords with a multifactor, password‑less approach—combining biometrics, device possession, and cryptographic private keys (e.g., FIDO) to achieve stronger, less compromise‑prone authentication. ## Full Transcript
A system is only as secure as it's configured to be.
And according to the IBM 2023 cost of a data breach report,
the number three reason for data breaches was cloud misconfigurations.
It trailed just phishing and stolen credentials.
So if it turns out that misconfigurations are this common and this costly from a security standpoint,
it bears that we might take a closer look at the top five security misconfigurations,
according to the NSA and the Cybersecurity and Infrastructure Security Agency.
And stick around to the end. I'll throw in a bonus topic.
Okay. What came out at the very top of the list?
Number one, defaults.
It turns out I wrote a book 23 years ago called 'What Hackers Don't Want You to Know.'
And one of the chapters in that was called 'Defaults Are Dangerous.'
And it's still true 23 years later.
In fact, the default configuration for a lot of systems
will include credentials that can be easily discovered on the web.
You can just go do a search and find out that the default configuration for this particular operating system,
this middleware, this application has, for instance, an administrator ID that's set up and let's say it's called admin.
And the password for that ID is guess what, admin.
Well, that's fine for a default configuration.
If you're just setting the thing up, you've got to set it as something.
But this is not what you want to put in production.
So there's a case of a dangerous default, if you were to just leave it as is and put it into production.
Another thing, default services.
So, for instance, the system may be when you install it, have lots of different capabilities turned on.
There may even be some legacy services that you don't use anymore,
let's say Telnet and it's turned on on this particular web server and you don't use it.
Well, if you don't use it, turn it off.
Remove the service completely.
We don't want anything on that we don't need to have on.
And then another example would be default configuration parameters.
So for instance, maybe it uses a default self signed certificate in a web server because that's what you need just to get the thing up running,
but that's not intended to be used out on the worldwide Internet where all kinds of attacks can occur.
So we need to change these kinds of things in order to make sure that the system is secure.
We refer to all of these changes as hardening, hardening as a way where we're basically taking the system that is soft in its original configuration
and hardening by removing anything that's not necessary.
Number two on the list was improper separation between user and admin capabilities.
So here we're basically talkingabout managing privileges.
And privileges are something that are very important for us to focus on in security.
There's the well-heeled principle of least privilege,
that says someone should only have access to the extent that they need it in order to perform their job.
So, for instance, when somebody comes into the organization, I give them certain admin rights
and then maybe their job changes or shifts. I add more admin rights or more user rights,
and this continues to just increase and increase and we end up with what is referred to as privilege creep.
Privilege creep basically says, we're very good at giving capabilities. We're not so good at taking them away.
In principle, of least Privilege says we need to be equally good at both.
In fact, it's most important from a security standpoint that I take these things away the moment they're no longer needed,
because those could ultimately be used against us at some way, whether intentionally or unintentionally.
If a bad guy gets into your system and your system is overly privileged, then it could be leveraged against the organization.
We want to avoid that.
We also want to maintain that separation between administrative users and regular end users.
So we're a regular end user, maybe doesn't even need to be able to change the configuration on their actual system.
Maybe we want to turn it so that they can't even install software on their system.
All of that is done by the administrator and then pushed out to the user system.
So that's just one example of a security policy that we might want to implement.
Now, another thing that we might want to take a look at is a problem that very often occurs,
where we basically have a few administrators and their responsibility is to manage this particular system.
So what we do is we have them log in a super user and now they can do whatever they want to on that system.
So we share the password, the credentials across all of the administrators, and maybe there's a number of them out here.
What that means is any change that happens here,
I don't know who actually did it,
because any one of these guys could have said he could say, no, he did it and he could say, no, he did it, and there's no way to prove.
So this is a big problem.
We need a solution for this.
And in fact, we have one.
It's called Privileged Account Management Privilege Access Management System.
If we install something like this, then we put these users here,
and they're able to now, instead of logging directly in as the super user, they log into the palm system,
authenticate and prove that they are allowed to be on this system,
get the credentials for the system, log in, do their work, and then when they're done, they check these credentials back into the system.
And now this guy no longer has access.
If this guy needs access, then he comes and checks the credentials out.
The nice thing being, I always know who is responsible at any point in time.
And that way we don't overly share the admin capabilities.
You have them only for as long as you need them.
And that's the principle of least privilege.
Number three on the list is insufficient network monitoring.
Specifically referring to the internal environment.
So let's take out, for instance, here's a very simple network of only four systems.
Obviously, your environment would be more complicated than this.
Let's say I put some kind of host monitoring capability on these systems.
Well, that's good news, because now I can tell that these three hosts have been infected.
So those alarms I will get.
So I know what's infected, but I don't know how it got infected.
I don't know where it entered and where it's going to spread to.
Now, that's what the host based monitoring would give me if I had a network based monitoring. It would do just the reverse.
It would tell me, Well, the malware entered here and then it spread to this system in this system,
but it won't tell me all of the implications on each one of those systems.
So, in fact, what I really need in the best of all possible cases is both.
I need to monitor both the hosts and the network so that I get a complete picture. Because after all, you can't secure what you can't see.
So visibility is incredibly important in this case.
Number four on the list is network segmentation,
insufficient network segmentation specifically.
In other words, a lot of people create what is effectively we refer to this as a flat network.
A flat network is one that is more vulnerable because of a vulnerability that happens here, can spread rapidly.
As you seen as you've seen here in the first part of this,
But if I add something like, let's say firewalls, firewalls, give me more control.
So control increases.
So if I added, let's say, a firewall here to separate,
then maybe I can block the spread of whatever this malware or this attack,
so that something that happens here doesn't necessarily spread to all the other systems.
So flat networks are very efficient, but more dangerous, and we have less control over what happens in them.
Another thing we probably want to consider as we're separating networks is look to separate based upon zones of trust.
Systems that are more vulnerable, systems that are more sensitive would be in their own zone.
Systems, maybe, for instance, in some organizations you have a large I.T. sort of environment,
and then you might have an OT, operational technology or Internet of Things or maybe a guest network.
And it would make sense to provide some separation between those two,
because the vulnerabilities here you don't want to spread into here.
Number five on the list of top misconfigurations is poor patch management.
Patches are the things that we apply in order to fix broken aspects of software.
It turns out that all software has bugs.
If you don't believe me, just run some software for a little bit of time and you'll discover some.
Also, it turns out that a certain percentage of those bugs will necessarily be security vulnerabilities.
So that means unpatched software has bugs.
And some of those will be security vulnerabilities.
It turns out the problem even gets worse when you consider vulnerabilities over time.
The older software gets, the more vulnerabilities it will have if you have not patched it.
And in fact, if it gets really old, there's a point where the vendor or the producer of the software won't be providing patches for it either.
That creates a real problem as we end up now with this thing gets even more vulnerable over time.
So what should you do about this?
Well, one thing clearly is if you've got old software, you should upgraded.
You should get to the latest versions of that software because, again, it's a pain a lot of people don't want to do it.
But if you don't, this is what's sitting here and the bad guys know about it.
These vulnerabilities have been published.
If for no other reason than once the patch came out, it was explained.
So now the bad guys know what they can attack.
We need to make sure our stuff is upgraded.
What else do we need to do?
Well, the best thing when it comes to patching is automated patch management.
That way it happens as fast as we can do it,
or very nearly at that speed, and we're not reliant on manual.
If you're going to be reliant on manual, then you need at least
need to have some sort of regular schedule, some sort of patch cycle,
where you're looking and saying every so often we're going to go out and make sure we have the latest software on any important system.
And by the way, the ones that don't contain sensitive data
can also come back to bite you because they can be an attack point.
Someone gets into those and then leverages from that point to get into the more sensitive systems.
So we have to be careful about all of these,
and we've also got to look at the whole landscape.
I've got to look at operating systems.
I need to make sure that all of the apps related to those are also patched.
I even need to look at firmware, and this is one that's often overlooked because it's a little bit harder to figure out.
So ideally we want it automated.
Secondly, have a regular schedule, but in all cases, make sure you're on the latest level.
Congratulations.
You've made it this far, so you deserve a bonus.
The bonus topic.
Poor credential hygiene.
In other words, bad passwords is what this mostly boils down to.
Passwords are a big problem for us.
In fact, we found that more than 35% of cloud security incidents, according to the 2023 X-Force Cloud Threat Landscape report,
more than 35 were due to compromised credentials.
These were valid credentials that somebody got a hold of and misused.
So we want to do something to make this better.
That's a significant number,
and that's something that is coming back to bite us on a regular basis.
As I've said before, when it comes to passwords,
this is the important thing to remember.
Not so much complexity, but length.
Length is strength when it comes to passwords.
The longer your password in general, the harder it is to crack.
Now, if you add some complexity to it, then that's good.
Like adding numbers and special characters in mixed cases.
But that often adds more confusion for the user and doesn't always necessarily make it harder to crack.
Length is strength when it comes to passwords, at least 15 characters at a minimum.
We should be doing longer than that. Really.
So thinking in terms of past phrases,
how about something that's even better than that?
How about multifactor authentication?
Because the password is a single factor of authentication, something you know.
Let's combine it with something you have and something you are or some version of those things.
So multifactor authentication will be stronger.
If it's done properly, then a single password would be by itself even a very well-chosen password.
How about this?
A well-chosen password, plus a biometric.
Even better still, but even better still than all of that.
Let's get rid of the passwords.
Let's do multifactor authentication and use a passwordless authentication protocol like FIDO.
I did a video on this recently.
Something like FIDO would allow us to get rid of passwords entirely.
We use stronger cryptographic methods like private keys
that are stored on the user's device and therefore are not subject to being sniffed and things like that because they're not sent over the Internet.
So if we could do something where we totally eliminate the password, then the credentials are much harder to be compromised.
So something like multifactor authentication, I use my face to unlock my phone.
That's something I am.
The phone is something I have.
And then whatever the private key I'm using with, this is something that is known.
And therefore all of those things together give us three factors
in one single shot.
This would be a far better solution and hopefully we can reduce this number substantially.
those who fail to learn from history, are destined to repeat it.
So make sure you learn from these common mistakes
so that you don't have to relive the consequences.