1
00:00:00,000 --> 00:00:01,380
In this lesson, we're going to discuss

2
00:00:01,380 --> 00:00:03,960
changing default configurations.

3
00:00:03,960 --> 00:00:04,830
Now, whenever you install

4
00:00:04,830 --> 00:00:06,540
a new piece of hardware or software,

5
00:00:06,540 --> 00:00:08,130
there are certain default configurations

6
00:00:08,130 --> 00:00:09,630
that they're going to utilize.

7
00:00:09,630 --> 00:00:11,700
These defaults or factory settings

8
00:00:11,700 --> 00:00:14,070
are usually not configured with security in mind,

9
00:00:14,070 --> 00:00:16,440
but instead, they're configured to allow a new user

10
00:00:16,440 --> 00:00:17,520
to more quickly install

11
00:00:17,520 --> 00:00:19,890
and use the new piece of hardware or software.

12
00:00:19,890 --> 00:00:21,916
Unfortunately, if you leave these default configurations

13
00:00:21,916 --> 00:00:23,550
in factory settings,

14
00:00:23,550 --> 00:00:26,340
this is going to pose a big security risk for your systems

15
00:00:26,340 --> 00:00:28,560
that a malicious threat actor can exploit.

16
00:00:28,560 --> 00:00:29,670
So, let's take a look at

17
00:00:29,670 --> 00:00:31,050
some of these default configurations

18
00:00:31,050 --> 00:00:32,549
that we should consider modifying,

19
00:00:32,549 --> 00:00:35,700
including default passwords, unneeded ports and protocols,

20
00:00:35,700 --> 00:00:38,040
and closing extra open ports on your system

21
00:00:38,040 --> 00:00:40,770
to create a stronger security posture on your devices

22
00:00:40,770 --> 00:00:43,980
instead of relying on those default configuration settings.

23
00:00:43,980 --> 00:00:46,470
Now, first we have default passwords.

24
00:00:46,470 --> 00:00:48,180
Default passwords or credentials

25
00:00:48,180 --> 00:00:50,100
are preset authentication details

26
00:00:50,100 --> 00:00:51,720
that are provided by manufacturers

27
00:00:51,720 --> 00:00:54,660
for initial access to a device or piece of software.

28
00:00:54,660 --> 00:00:57,060
For example, if you purchase a new small office,

29
00:00:57,060 --> 00:00:59,430
home office wireless router and access point,

30
00:00:59,430 --> 00:01:02,130
it's going to come pre-configured with a default password,

31
00:01:02,130 --> 00:01:05,129
so you can access the web-based configuration dashboard.

32
00:01:05,129 --> 00:01:08,040
Now, commonly used default passwords for devices like these

33
00:01:08,040 --> 00:01:10,170
often include usernames and password combinations

34
00:01:10,170 --> 00:01:13,440
like admin - admin, or administrator - password,

35
00:01:13,440 --> 00:01:16,800
or admin for the username and blank for the password.

36
00:01:16,800 --> 00:01:19,260
Since these default passwords are published in the manual

37
00:01:19,260 --> 00:01:22,080
and in the manufacturer's online knowledge base articles,

38
00:01:22,080 --> 00:01:23,610
it is critical that you immediately

39
00:01:23,610 --> 00:01:25,920
change these default credentials when you power on

40
00:01:25,920 --> 00:01:27,420
and begin to set up the device

41
00:01:27,420 --> 00:01:29,880
to prevent unauthorized access to your network.

42
00:01:29,880 --> 00:01:32,460
If your system supports multi-factor authentication,

43
00:01:32,460 --> 00:01:33,597
you should also configure that

44
00:01:33,597 --> 00:01:35,040
inside of your administrative

45
00:01:35,040 --> 00:01:36,600
web-based configuration portal,

46
00:01:36,600 --> 00:01:38,670
so that way it remains better protected.

47
00:01:38,670 --> 00:01:40,920
Now, if you can only use a username and password

48
00:01:40,920 --> 00:01:42,690
to secure that administrative dashboard,

49
00:01:42,690 --> 00:01:44,430
you should select a long, strong,

50
00:01:44,430 --> 00:01:46,260
unique, and complex password

51
00:01:46,260 --> 00:01:48,570
to provide the best level of protection possible.

52
00:01:48,570 --> 00:01:50,460
Remember, the longer and more complex

53
00:01:50,460 --> 00:01:51,960
the password that's being used,

54
00:01:51,960 --> 00:01:53,790
the harder it's going to be for a brute force tool

55
00:01:53,790 --> 00:01:55,950
to crack that administrative password.

56
00:01:55,950 --> 00:01:57,840
Additionally, your administrative password

57
00:01:57,840 --> 00:02:00,660
should also be rotated about once every 90 days

58
00:02:00,660 --> 00:02:02,760
to ensure your devices remain protected.

59
00:02:02,760 --> 00:02:04,140
Since we want to use long, strong,

60
00:02:04,140 --> 00:02:05,670
and complex passwords though,

61
00:02:05,670 --> 00:02:07,680
we should also rely on a password manager

62
00:02:07,680 --> 00:02:09,479
to create and store all these passwords

63
00:02:09,479 --> 00:02:12,420
to ensure they remain secure and that we don't forget them.

64
00:02:12,420 --> 00:02:14,820
Second, you should disable any unneeded ports

65
00:02:14,820 --> 00:02:16,650
and protocols on your systems.

66
00:02:16,650 --> 00:02:18,360
Now, every device comes with a wide range

67
00:02:18,360 --> 00:02:20,190
of ports and protocols that are enabled,

68
00:02:20,190 --> 00:02:21,720
and many of these are not actually needed

69
00:02:21,720 --> 00:02:23,190
for your specific use case

70
00:02:23,190 --> 00:02:25,560
or your organization's operational needs.

71
00:02:25,560 --> 00:02:27,810
Remember, each active and open port

72
00:02:27,810 --> 00:02:30,060
is going to act as a potential opening for an attacker

73
00:02:30,060 --> 00:02:32,070
to gain access into your systems.

74
00:02:32,070 --> 00:02:34,290
So, you should always conduct a thorough audit

75
00:02:34,290 --> 00:02:36,210
of the ports and protocols being used,

76
00:02:36,210 --> 00:02:37,710
and you should disable any of them

77
00:02:37,710 --> 00:02:39,630
that you determined are unnecessary.

78
00:02:39,630 --> 00:02:41,340
By minimizing the number of active ports

79
00:02:41,340 --> 00:02:42,510
and running protocols,

80
00:02:42,510 --> 00:02:45,060
you'll be able to significantly reduce your attack surface

81
00:02:45,060 --> 00:02:47,100
and the probability of a successful attack

82
00:02:47,100 --> 00:02:49,590
being conducted against your organization.

83
00:02:49,590 --> 00:02:51,570
Also, if you see that a particular port

84
00:02:51,570 --> 00:02:55,680
or protocol is being used like SMTP or HTTP,

85
00:02:55,680 --> 00:02:57,210
you can see that there's also a secure

86
00:02:57,210 --> 00:02:59,370
and encrypted version that might be available too.

87
00:02:59,370 --> 00:03:01,710
And in those cases, you should shift your services

88
00:03:01,710 --> 00:03:03,000
from the insecure version

89
00:03:03,000 --> 00:03:05,220
to the encrypted and more secure version.

90
00:03:05,220 --> 00:03:08,880
So for example, instead of using HTTP over port 80,

91
00:03:08,880 --> 00:03:12,660
you should use HTTPS over port 443 instead,

92
00:03:12,660 --> 00:03:16,830
or instead of using SMTP to send your emails over port 25,

93
00:03:16,830 --> 00:03:21,830
you can use SMTPS over port 587, or port 465 instead.

94
00:03:22,290 --> 00:03:25,260
Third, you should check for any open ports on your devices.

95
00:03:25,260 --> 00:03:26,940
Now, many of our devices are going to have

96
00:03:26,940 --> 00:03:29,070
ports open by default and these are ports

97
00:03:29,070 --> 00:03:31,320
that we might not ever use in the real world.

98
00:03:31,320 --> 00:03:33,780
For example, I've read across several devices

99
00:03:33,780 --> 00:03:37,140
that have port 22, 23, 80, and 443

100
00:03:37,140 --> 00:03:40,110
open by default when you first power on the device.

101
00:03:40,110 --> 00:03:41,670
Now, this is because the manufacturer

102
00:03:41,670 --> 00:03:43,710
wants to provide maximum compatibility,

103
00:03:43,710 --> 00:03:46,200
so they've opened two ports for each service.

104
00:03:46,200 --> 00:03:50,130
In the example of Port 22 for SSH and port 23 for Telnet,

105
00:03:50,130 --> 00:03:52,260
this allows for remote access to the device,

106
00:03:52,260 --> 00:03:53,880
but as a security professional,

107
00:03:53,880 --> 00:03:56,010
we would never ever want to use Telnet,

108
00:03:56,010 --> 00:03:57,750
because it's completely insecure

109
00:03:57,750 --> 00:03:59,310
and sends all of our communications

110
00:03:59,310 --> 00:04:00,930
in an unencrypted format.

111
00:04:00,930 --> 00:04:03,030
So, we should close port 23

112
00:04:03,030 --> 00:04:05,670
to prevent Telnet from being used on this system.

113
00:04:05,670 --> 00:04:08,130
Similarly, if you only need port 443

114
00:04:08,130 --> 00:04:09,750
for secure web communications,

115
00:04:09,750 --> 00:04:11,700
you can go ahead and close port 80

116
00:04:11,700 --> 00:04:14,100
to prevent anyone from using this less secure version

117
00:04:14,100 --> 00:04:16,350
of the hypertext transfer protocol.

118
00:04:16,350 --> 00:04:18,060
So remember, whenever you install

119
00:04:18,060 --> 00:04:19,769
a new device or piece of software,

120
00:04:19,769 --> 00:04:20,603
you should take the time

121
00:04:20,603 --> 00:04:22,380
to change the default configurations,

122
00:04:22,380 --> 00:04:24,690
including the default passwords or credentials,

123
00:04:24,690 --> 00:04:26,190
understanding which ports and protocols

124
00:04:26,190 --> 00:04:27,480
are currently being used

125
00:04:27,480 --> 00:04:30,540
and the closing of any excessive open ports on your device.

126
00:04:30,540 --> 00:04:32,370
By understanding that devices usually come

127
00:04:32,370 --> 00:04:34,140
as a one-size-fits-all setup,

128
00:04:34,140 --> 00:04:35,730
we can now recognize that it's important

129
00:04:35,730 --> 00:04:37,380
to change our default configurations

130
00:04:37,380 --> 00:04:40,110
to meet our own unique needs and security posture.

131
00:04:40,110 --> 00:04:42,660
After all, the process of enhancing security doesn't

132
00:04:42,660 --> 00:04:45,300
necessarily demand high levels of technical expertise.

133
00:04:45,300 --> 00:04:48,000
And instead, simple actions like changing a password

134
00:04:48,000 --> 00:04:49,830
or closing a port can be our first

135
00:04:49,830 --> 00:04:51,240
and most formidable line of defense

136
00:04:51,240 --> 00:04:52,860
against a potential threat.

137
00:04:52,860 --> 00:04:54,720
Remember, being proactive is always

138
00:04:54,720 --> 00:04:56,040
better than being reactive.

139
00:04:56,040 --> 00:04:57,600
So, you need to take these small steps

140
00:04:57,600 --> 00:05:00,450
to better protect your systems and the data they contain.