Thread by @Glenn_Mallo

🚨 Most breaches don’t start with zero-days.
They start with simple misconfigurations.
NSA + CISA’s Top 10 offenders 👇
#CyberTuesday 🧵

1️⃣ Default settings left in place = handing out spare keys.
Fix: Change defaults, disable unused accounts.

2️⃣ Privilege creep — too many admin rights, not enough oversight.
Fix: Enforce least privilege.

3️⃣ No internal monitoring. If your logs don’t talk, attackers walk right in.
Fix: Enable & review logs.

4️⃣ Flat networks — one breach = full access.
Fix: Segment your network.

5️⃣ Patch delays. Waiting months = attacker’s playground.
Fix: Patch promptly, automate updates.

6️⃣ Access control workarounds. “Just this once” = shadow IT.
Fix: Enforce MFA + RBAC.

7️⃣ Weak MFA configs. SMS MFA can be phished.
Fix: Use phishing-resistant MFA (FIDO2, PKI).

8️⃣ Open network shares. Anyone can see everything.
Fix: Tighten ACLs.

9️⃣ Poor credential hygiene. Weak/reused passwords = free entry.
Fix: Password managers + rotation.

🔟 Unrestricted code execution. Letting anything run anywhere = chaos.
Fix: Application allow-listing.

💡 NIST 800-171 call these out.
Misconfigs = not just operational risk, but compliance gaps.

Which one do you see most in the wild? 👇

Full list + fixes here:


#Cybersecurity #NIST #BuildQualityIncsoonline.com/article/362370…

@threadreaderapp please unroll