CISA Top Ten Cybersecurity Misconfigurations

Modify the default configuration of applications and appliances before going live in production environment.
Change or disable vendor-supplied default usernames and passwords of services, software and hardware equipment.
If not required disable LLMNR and NetBIOS on WINDOWS Systems

Implement Authentication, Authorization, Accountability, and Auditing system for non-repudiation.
Audit user accounts and remove those that are inactive or unnecessary. Limit the number of users with identity and access management privileges.
Restrict the use of privileged accounts to perform general tasks. Only use service accounts with the permissions necessary for the services they need access.
Implement time-based access for privileged accounts. Disable unused services and implement ACLs and RBACs to protect services and applications.
Implement a Security Information and Event Management System for log aggregation, correlation, visualization, and alerting.

Leverage next-gen firewalls to perform deep packet filtering, stateful packet inspection, and application level packet inspection.
Setup network segmentation to isolate critical systems, functions, and resources.
Create Virtually Private Cloud instances to isolate essential cloud systems.

Implement and maintain an efficient patch management process. Update software and firmware regularly.
Automate the update process as much as possible.
Use the Common Vulnerability Scoring System for a qualitative measure of severity.
Evaluate the use of unsupported hardware and software. Discontinue or isolate legacy systems that are outdated.

Limit credential overlap across systems.
Deny domain users the ability to be in the local administrator group on multiple systems.
Use service accounts for system to system communication.

Disable the use of New Technology LAN Manager (NTLM) and other legacy authentication protocols on Windows systems.
Implement cloud-primary authentication solution using modern open standards such OpenID Connect.
Enforce phising-resitant Multifactor Authentication (MFA)

Implement system settings that prevent the ability to run applications downloaded from untrusted sources.
Use application control tools that restrict program execution by default; also known as allowlisting.
Block or prevent the execution of known vulnerability drives. Use read-only and minimal images for containers.
Constrain scripting languages from auto-executing to prevent malicious activities.

Comments