Secure configuration

Devices and software are often insecure by default, optimised for ease of setup rather than security. Secure configuration means deliberately hardening them before use.

What this covers

• Remove or disable software, apps, and user accounts that aren't needed.
• Change all default passwords, on devices, accounts, and software, before deployment.
• Set devices to auto-lock after a short period of inactivity, requiring a password, PIN, or biometric to unlock.
• Disable auto-run features that let removable media or downloaded files execute automatically without a user actively choosing to run them.
• Use a password, PIN, or biometric method to unlock every device, including phones and tablets used for work.

The theme running through this control is the same as boundary firewalls: don't leave the manufacturer's convenient defaults in place, because attackers know exactly what those defaults are.