PR.PS-01.239
Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
Explanation
Default configurations in software often prioritize usability over security, potentially leaving systems vulnerable to attacks. This review process should identify and modify insecure default settings such as default credentials, unnecessary open ports, excessive permissions, or enabled but unneeded features that expand the attack surface.
Evidence could include a formal configuration review checklist or procedure document, screenshots of configuration management tools, or documentation showing before/after configuration settings with security-focused changes highlighted during recent software deployments.
Implementation Example
Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software
ID: PR.PS-01.239
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Configuration management practices are established and applied
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
- Does your organization have a process to identify, uninstall, and remove unauthorized software and services that pose security risks?