Top Ten Cybersecurity Misconfigurations and Recommended Mitigations
The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have shared the top ten cybersecurity misconfigurations and the tactics, techniques, and procedures used by malicious actors to exploit these misconfigurations.
Cyber threat actors search for and exploit unpatched vulnerabilities in software and operating systems to gain initial access to internal networks, but there are often much easier ways to breach defenses. Organizations of all sizes make mistakes that leave holes in their defenses that are easy to exploit, and poor cybersecurity practices can be exploited once initial access has been gained to move freely inside networks undetected.
The NSA and CISA identified the top ten cybersecurity misconfigurations through their red and blue team assessments and incident response activities. These misconfigurations were found in organizations of all sizes, even large enterprises with mature cybersecurity postures.
- Default configurations of software and applications
- Improper separation of user/administrator privilege
- Insufficient internal network monitoring
- Lack of network segmentation
- Poor patch management
- Bypass of system access controls
- Weak or misconfigured multifactor authentication (MFA) methods
- Insufficient access control lists (ACLs) on network shares and services
- Poor credential hygiene
- Unrestricted code execution
Network defenders are encouraged to address these commonly exploited misconfigurations and software manufacturers have been urged to take ownership of improving security outcomes of their customers by embracing secure-by-design and-default tactics. The NSA/CISA cybersecurity advisory includes mitigations for network defenders against these common misconfigurations and recommendations for software manufacturers to reduce the prevalence of these misconfigurations and ease the burden on their customers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
