Emerging threats
Default settings: Why configuring your systems correctly is crucial
When there’s a cyber security incident, technology is often the first to take the blame, but it’s important to know that many weaknesses manifest in networks, systems, devices and software because they haven’t been deployed and configured correctly, or in some cases, they are still set to a default configuration.
In the 2022 DCMS Cyber Security Breaches Survey, it came to light that only 9% of respondents have changed or updated firewall or system configurations following a breach. Worryingly, the number or organisations proactively looking at their configuration is probably even lower.
While checking your systems and networks regularly with vulnerability scans and penetration tests are a vital element of your cyber security programme, what about the configuration of your systems and the tools you use? It’s kind of like checking your bicycle to make sure the seat is the right height and tyres have the right pressure, so you’ll be safe when riding it.
So, what is the solution for mitigating the risk associated with deploying new technology in your organisation? PGI’s Head of Cyber Operations, Chris Preece looks at why build and configuration reviews should be part of your implementation process.
What is a configuration assessment?
In a nutshell, when a security consultant is undertaking a configuration review, they are looking at the configuration settings of a system/ device/piece of software and reviewing it against industry best practice security settings to ensure that your infrastructure doesn’t have any holes that an attacker could exploit.
Whether we’re looking at a laptop, switch, a cloud network, a router or a Firewall, PGI’s red team will provide you with the information you need to ‘harden’ your infrastructure against vulnerabilities and cyber threats.
Why is configuration important?
Maybe you’ve seen a news article about a data leak a cloud service? These types of breaches can often occur due to a misconfiguration which threat actors can take advantage of; such as a cloud service that is being used for storing customer data not being configured correctly for the purpose, allowing anyone—both internally and externally—to access it.
If you go to a search engine and look up “data breach AWS s3” you’ll see plenty of examples of how misconfigurations have resulted in sensitive data being accessed by unauthorised persons. As an example, back in 2019, the personal information of more than 100 million of US bank, Capital One’s credit card applicants were leaked from their cloud-based storage by a software engineer who had developed a tool to scan AWS accounts to find those that are misconfigured.
Configuration reviews are a good starting point in reducing the attack surface of your systems, and helping to protect against common attack techniques. It also makes use of the regularly updated industry researcher findings, which contribute to the security best practice we align reviews with.
What are the types of configuration reviews?
If something can be configured (and even if you’re not sure!), we recommend reviewing it. We look at everything from servers, workstations, mobile devices and cloud environments to network devices. And within each of those categories, there are a wide range of variables such as manufacturer and operating system.
The assessments we are often engaged to do are for Gold Builds, which are pre-configured templates that enable your organisation to ensure a level of consistency across corporate device builds.
As an example, many organisations will create Gold Builds for specific deployments of desktops, laptops and servers.
In these cases, PGI is looking to restrict the opportunities for an attacker to get a foothold and escalate privileges on your network. There are common techniques they will use, and when the recommendations from the reviews are applied, it can significantly impede an attacker’s use of these techniques. The reviews will also check that patching is up-to-date, adding another layer of defence to deter any would-be attacker.
Gold Build templates, assessed against industry security best practice, provide high deployment efficiency and security assurance, reducing the risk of user error.
What about ‘working from anywhere’?
If people are working outside an office, we can ensure devices are configured to mitigate the risks associated with being connected to non-corporate networks. Perhaps you need to implement a cloud storage solution to enable your teams across different locations to work efficiently. Or maybe making sure that VPNs have been set up securely.
Don’t forget to change that default set up
Build and configuration reviews should be part of a holistic approach to security. Talk to our team about highlighting and demonstrating security opportunities that could be implemented to ‘harden’ your technical infrastructure and increase its resilience.
Contact us today to talk about how we can help.
Related Insights
Why AI won't be replacing the human-led penetration test in the near future
The world of cyber security has not escaped the shift brought about by rapid developments in AI. While these innovations are exciting and offer real benefits in terms of efficiency and scale, it's leading some to believe that it can replace human-led security testing all together.
Building a supply chain resilient to cyber threat
Recent high-profile cyberattacks, including those affecting Jaguar and Heathrow, have highlighted a critical truth: cyberattacks don’t just impact the targeted organisation—they can ripple through the entire supply chain.
The risk trade-offs of automated threat intelligence
If you’re considering an automated threat intelligence service, it’s important to first weigh up the benefits and limitations against the level of security your business needs.