In this lesson, we're going to discuss
changing default configurations.
Now, whenever you install
a new piece of hardware or software,
there are certain default configurations
that they're going to utilize.
These defaults or factory settings
are usually not configured with security in mind,
but instead, they're configured to allow a new user
to more quickly install
and use the new piece of hardware or software.
Unfortunately, if you leave these default configurations
in factory settings,
this is going to pose a big security risk for your systems
that a malicious threat actor can exploit.
So, let's take a look at
some of these default configurations
that we should consider modifying,
including default passwords, unneeded ports and protocols,
and closing extra open ports on your system
to create a stronger security posture on your devices
instead of relying on those default configuration settings.
Now, first we have default passwords.
Default passwords or credentials
are preset authentication details
that are provided by manufacturers
for initial access to a device or piece of software.
For example, if you purchase a new small office,
home office wireless router and access point,
it's going to come pre-configured with a default password,
so you can access the web-based configuration dashboard.
Now, commonly used default passwords for devices like these
often include usernames and password combinations
like admin - admin, or administrator - password,
or admin for the username and blank for the password.
Since these default passwords are published in the manual
and in the manufacturer's online knowledge base articles,
it is critical that you immediately
change these default credentials when you power on
and begin to set up the device
to prevent unauthorized access to your network.
If your system supports multi-factor authentication,
you should also configure that
inside of your administrative
web-based configuration portal,
so that way it remains better protected.
Now, if you can only use a username and password
to secure that administrative dashboard,
you should select a long, strong,
unique, and complex password
to provide the best level of protection possible.
Remember, the longer and more complex
the password that's being used,
the harder it's going to be for a brute force tool
to crack that administrative password.
Additionally, your administrative password
should also be rotated about once every 90 days
to ensure your devices remain protected.
Since we want to use long, strong,
and complex passwords though,
we should also rely on a password manager
to create and store all these passwords
to ensure they remain secure and that we don't forget them.
Second, you should disable any unneeded ports
and protocols on your systems.
Now, every device comes with a wide range
of ports and protocols that are enabled,
and many of these are not actually needed
for your specific use case
or your organization's operational needs.
Remember, each active and open port
is going to act as a potential opening for an attacker
to gain access into your systems.
So, you should always conduct a thorough audit
of the ports and protocols being used,
and you should disable any of them
that you determined are unnecessary.
By minimizing the number of active ports
and running protocols,
you'll be able to significantly reduce your attack surface
and the probability of a successful attack
being conducted against your organization.
Also, if you see that a particular port
or protocol is being used like SMTP or HTTP,
you can see that there's also a secure
and encrypted version that might be available too.
And in those cases, you should shift your services
from the insecure version
to the encrypted and more secure version.
So for example, instead of using HTTP over port 80,
you should use HTTPS over port 443 instead,
or instead of using SMTP to send your emails over port 25,
you can use SMTPS over port 587, or port 465 instead.
Third, you should check for any open ports on your devices.
Now, many of our devices are going to have
ports open by default and these are ports
that we might not ever use in the real world.
For example, I've read across several devices
that have port 22, 23, 80, and 443
open by default when you first power on the device.
Now, this is because the manufacturer
wants to provide maximum compatibility,
so they've opened two ports for each service.
In the example of Port 22 for SSH and port 23 for Telnet,
this allows for remote access to the device,
but as a security professional,
we would never ever want to use Telnet,
because it's completely insecure
and sends all of our communications
in an unencrypted format.
So, we should close port 23
to prevent Telnet from being used on this system.
Similarly, if you only need port 443
for secure web communications,
you can go ahead and close port 80
to prevent anyone from using this less secure version
of the hypertext transfer protocol.
So remember, whenever you install
a new device or piece of software,
you should take the time
to change the default configurations,
including the default passwords or credentials,
understanding which ports and protocols
are currently being used
and the closing of any excessive open ports on your device.
By understanding that devices usually come
as a one-size-fits-all setup,
we can now recognize that it's important
to change our default configurations
to meet our own unique needs and security posture.
After all, the process of enhancing security doesn't
necessarily demand high levels of technical expertise.
And instead, simple actions like changing a password
or closing a port can be our first
and most formidable line of defense
against a potential threat.
Remember, being proactive is always
better than being reactive.
So, you need to take these small steps
to better protect your systems and the data they contain.