Is it really as bad as some say? People are not changing default passwords and thus hackers control their machines if remote access is enabled in some way.
i think it is VERY BAD – as people are really looking for ways to make bad decisions:
https://superuser.com/questions/106917/remote-desktop-without-a-password
My apologies to this person who maybe innocently was trying to make some administration easier for him, but the lack of security knowledge is apparent. One should NOT even think of creating a scenario where there is a blank password on a machine (ever – even worse for remote access).
If this machine was connected to a Credit Card Machine now you are in PCI compliance violation.
Ok, we know not to have default or blank passwords…
Or is it that people don’t need to change the default password as the system is not remote accessible?
Even then the default password should be changed, because physical access needs to thought of, and is not 100% foolproof.
Or is it that people think the system is not remote accessible but it really is in some way?
The last scenario may be likely if the level of sophistication is not good.
And the hackers are looking for these machines as a post from last year notes the Verizon data breach Investigations Report http://oversitesentry.com/why-are-there-cyber-security-issues/
Mentions that Remote Command Execution was found on scanned machines more than at other times.
Human error is one of the main reasons for security failures. in 2014 IBM ‘s Cyber Security Intelligence index notes “95% of all security incidents involve human error”
So how does a stakeholder (the board, CEO, exec team) make sure that human error is minimized (as it will likely never be 100% gone). It is to obvious to most: Bring in outside help to get a second or third opinion, and perform tests to see where human error can be minimized. The CISA (Certified Information Systems auditor) would review the potential risks and set up an audit to methodically find security issues.
Contact us to discuss