Retaining default configurations of software and applications is the most common of 10 security risks highlighted by the US National Security Agency (NSA) and Infrastructure Security Agency (ISA).

The two agencies have issued a joint cybersecurity advisory (CSA) in which the 10 most common network misconfigurations are listed. That list is:

1. Default configurations of software and applications.
2. Improper separation of user/administrator privilege.
3. Insufficient internal network monitoring.
4. Lack of network segmentation.
5. Poor patch management.
6. Bypass of system access controls.
7. Weak or misconfigured multifactor authentication (MFA) methods.
8. Insufficient access control lists (ACLs) on network shares and services.
9. Poor credential hygiene.
10. Unrestricted code execution.

The report concludes that the list illustrates a trend of “systemic weakness in many large organizations”. It also says that the findings underline “the importance of software manufacturers embracing secure-by-design principles to reduce the burden on network defenders.”

And it carries a recommendation to those responsible for defending corporate networks to implement a number of mitigatory measures. These are:

• Remove default credentials and harden configurations.
• Disable unused services and implement access controls.
• Update regularly and automate patching, prioritizing patching of known exploited vulnerabilities.
• Reduce, restrict, audit, and monitor administrative accounts and privileges. 

The secure-by-design and-default tactics the report advises software mannufacturers to adopt include:

• Embedding security controls into product architecture from the start of development and throughout the entire software development lifecycle (SDLC).
• Eliminating default passwords.
• Providing high-quality audit logs to customers at no extra charge.
• Mandating MFA, ideally phishing-resistant, for privileged users and making MFA a default rather than opt-in feature.