NSA and CISA Reveal Top 10 List – Security Misconfigurations

It is not news that the majority of breaches are not caused by sophisticated attackers figuring out how to bypass robust defenses.

For example, one of the largest attacks in the U.S., the Equifax breach, was caused by Equifax failing to patch a known bug, for which there was an available patch, even after DHS warned them that the bug was under active exploit.

With that in mind, here is the NSA’s top 10 list. This comes from simulated attacks that the NSA conducts on government and civilian infrastructure called red and blue teaming.

1. Default configurations of software and applications – like, for example, not changing default passwords
2. Improper separation of user and administrator permissions – allowing users (and technical teams) to operate with elevated permissions for non-admin functions increases risk of attackers exploiting vulnerabilities
3. Insufficient internal network monitoring – what you don’t know about, you cannot stop
4. Lack of network segmentation – the most well known case of this was the Target breach where a compromised account of a refrigeration repair vendor allowed hackers to access the credit card system because they were on the same network
5. Poor patch management – see above, Equifax
6. Bypass of system access controls – if you can bypass a control, why is it there
7. Weak or misconfigured Multi-factor authentication – hackers are good at trying to bypass MFA so if you don’t implement it correctly, it won’t help much
8. Insufficient access controls on network shares and services – if anyone can access data, so can the hackers
9. Poor credential hygiene – one of the most popular passwords we see in breached password lists is 12345678
10. And, last, unrestricted software execution – this often allows hackers to execute malware that they bring with them

If you think you may suffer from any of these and are not sure how to close the gap, please contact us.

Credit: Bleeping Computer

by