Chapter 22 — Secure configuration
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Default risks"]
N2["22.2 Baselines"]
N3["22.3 Checking"]
N4["22.4 Change control"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Default risks"]
N2["22.2 Baselines"]
N3["22.3 Checking"]
N4["22.4 Change control"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Default risks]
|
v
[22.2 Baselines]
|
v
[22.3 Checking]
|
v
[22.4 Change control]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) explain why default settings are risky; (2) apply configuration baselines; (3) check configurations regularly.
22.1 Default risks
Systems arrive configured for convenience. Default passwords, unnecessary services and permissive settings help installation but also help attackers. Aisha finds that a synthetic Ashfield branch router still uses its factory administrator password, which is published in the manufacturer's manual. Anyone on the branch network could log in and change its settings. She recommends changing all default passwords during installation as a standard step, recorded in the installation checklist so it cannot be skipped. The IT manager changes the router password the same afternoon and checks the other branch routers.
22.2 Baselines
A configuration baseline lists the secure settings every system of a type should have. Aisha drafts a baseline for Ashfield's desktop computers: automatic updates on, disk encryption enabled, screen lock after five minutes, standard user accounts for staff and unnecessary software removed. She bases it on published guidance and adapts it to Ashfield's needs. Dr. Carrow notes that baselines turn security knowledge into repeatable settings that do not depend on each technician's memory. The IT manager reviews the draft and approves it for all new desktop installations.
22.3 Checking
Settings drift as people change them for convenience or troubleshooting. Aisha writes a small script that reads synthetic configuration exports and reports which computers differ from the baseline. She finds a handful with screen lock disabled, mostly at one branch where staff found it annoying during busy periods. She discusses this with the branch manager, who agrees to a longer timeout rather than none. She learns that understanding why settings drift helps fix the cause. The script runs monthly and emails the IT manager a short list.
22.4 Change control
Configuration changes should be planned, approved and recorded. Aisha finds that Ashfield's IT staff make firewall changes without records, so nobody can later explain why a rule exists. She proposes a simple change log: what changed, why, who approved it and how to reverse it. Dr. Carrow explains that change records also help during incidents, because investigators can quickly see whether a recent change caused a problem or opened a gap. The IT manager adopts the change log the following week and records the reason for each existing rule he can still explain.
Worked example
Aisha finds a default router password, drafts a desktop baseline, checks drift with a script and introduces a change log for firewall changes.
Synthetic case. Configurations are synthetic.
Errors and limits
Default passwords published in manuals give attackers easy access.
Exercises
- EX064 — Router problem. What was wrong with the branch router? Rubric: 3 = factory default password;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX065 — Baseline item. Name one desktop baseline setting. Rubric: 3 = disk encryption enabled;; 2 = one;; 1 = vague;; 0 = none.
- EX066 — Screen lock fix. What compromise is agreed for screen lock? Rubric: 3 = a longer timeout;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 22 (chapter 22 of 40)
← Chapter 21 · Course chapter index · Chapter 23 →
Continue to the next authored lesson.