Cyber Essentials Explained Part 2 of 5
Secure Configuration: Locking Down Every Device You Own
Reducing Your Attack Surface
Every device your organisation uses – from the laptop on your receptionist’s desk to the server running your accounts software – arrives with a default configuration designed for broad compatibility, not security.
Features are switched on, ports are open, example accounts exist, and sample data may be present. Left unchanged, these defaults are a gift to attackers.
Secure Configuration, the second Cyber Essentials control, is about systematically removing everything you do not need and hardening what remains.
Why Default Configurations Are Dangerous
When a manufacturer ships a device or an operating system, they make choices designed to help the widest possible range of users get started quickly. That means enabling features speculatively, using simple default credentials, and accepting connections broadly.
An attacker who knows the make and model of your device also knows its defaults – and can find exploit code for common weaknesses within seconds.
The 2016 Mirai botnet attack, which took down large parts of the internet by hijacking security cameras and routers, succeeded almost entirely because millions of devices were still using their factory default usernames and passwords. The same problem exists inside corporate networks today.
Secure configuration is the practice of starting from a minimal, locked-down baseline and only enabling what you actually need.
What Cyber Essentials Requires
The Cyber Essentials assessment looks for evidence that:
- Default passwords on all accounts, particularly administrator and root accounts, have been changed.
- Unnecessary software, services, and features have been removed or disabled.
- Auto-run and auto-play features are disabled, preventing malware from executing automatically from USB drives or removable media.
- An application firewall or similar control is in place to restrict what software can run.
- Administrative accounts are only used for administrative tasks – not for general daily use.
The scope includes all devices in scope for your certification: user computers, servers, network devices, and any cloud or virtual machines you operate.
Implementation Advice
Small Business (Up to ~50 employees)
For a small business, this control is largely about establishing good habits and working through a checklist for each device you use. It does not require expensive tooling – it requires discipline.
Practical steps:
- Change default passwords immediately. This applies to routers, switches, printers, CCTV systems, smart TVs in meeting rooms, and any other networked device. Every device should have a unique, strong password stored in a password manager. Shared default credentials across all your devices mean one breach compromises everything.
- Remove software you do not use. Go through the installed applications on your devices and uninstall anything that is not actively needed. Every installed application is a potential vulnerability surface. Pay particular attention to old versions of Java, Flash (which should be long gone), Adobe Reader, and other browser plugins.
- Disable unused features and services. On Windows, services like Remote Desktop, Telnet, and IIS (web server) are sometimes installed but not needed. On macOS, check Sharing preferences and disable Remote Login, Remote Management, and File Sharing unless genuinely required.
- Use standard user accounts for daily work. Administrator accounts should be used only when installing software or changing system settings. For everything else – email, browsing, document editing – use a standard (non-admin) account. This massively limits the damage malware can do if it infects a device.
- Disable AutoRun/AutoPlay. This prevents malicious code on USB drives from executing automatically. On Windows, search for AutoPlay in Settings and set it to “Take no action” for all media types.
- Keep accounts clean. Remove user accounts for people who have left. Ensure nobody is sharing accounts. Review who has administrator access on each machine.
- Apply the same standards to any cloud services. If you use Microsoft 365, review admin accounts and disable any sample or legacy accounts. Turn off features you do not use.
Helpful resources:
- NCSC Small Business Guide: Secure Your Devices
- NCSC Guidance on Passwords
- CIS Benchmarks – free PDF downloads are available for Windows and macOS.
Larger Organisation (50+ employees)
At scale, manually checking and configuring individual devices is impractical. Secure configuration becomes an automated, policy-driven process – and the gap between “we think devices are configured correctly” and “we can prove devices are configured correctly” is where the real work happens.
Practical steps:
- Define and document a configuration baseline. A baseline is your agreed-upon “gold standard” for how a device should be configured. The CIS Benchmarks provide excellent starting points for Windows, macOS, Linux, common browsers, and many other platforms. Choose the appropriate level – Level 1 is usually the right starting point for most organisations – and document your exceptions with business justifications.
- Enforce baselines through Group Policy or MDM. Windows environments should use Group Policy Objects (GPOs) to enforce settings centrally. For mixed environments including macOS and mobile devices, a Mobile Device Management (MDM) platform such as Intune or Jamf can push configuration profiles and enforce compliance. This moves you from “we told people to configure their devices correctly” to “the system enforces correct configuration automatically.”
- Use privileged access management (PAM). Administrative accounts should be separate from daily-use accounts, have time-limited access where possible, and use multi-factor authentication. Consider a PAM solution such as CyberArk, BeyondTrust, or similar for privileged access to critical systems.
- Control software installation. Use application allow-listing or, at minimum, restrict local administrator rights so users cannot install software without approval. Windows Defender Application Control (WDAC) or AppLocker can enforce this technically.
- Harden server configurations. Servers require additional attention: disable unnecessary roles and features, remove sample websites and databases, change default service account passwords, and ensure services run with the minimum necessary privileges.
- Conduct configuration compliance scanning. Tools such as Microsoft Secure Score, Tenable.io, or Qualys can scan your estate and report on configuration drift – devices that have drifted away from your baseline. Aim to make this reporting continuous rather than periodic.
- Manage cloud configuration. IaaS environments such as AWS, Azure, and GCP require the same discipline. Use Cloud Security Posture Management (CSPM) tools or the built-in security centre features of your cloud provider to detect misconfigured resources. A misconfigured S3 bucket or storage account has caused some of the largest data breaches of the past decade.
- Include end-of-life software tracking. Software that is no longer receiving updates, such as Windows 7, end-of-life versions of Office, or legacy server operating systems, should be tracked and prioritised for replacement. Operating an EOL system in scope for Cyber Essentials will fail the assessment.
Helpful resources:
- CIS Benchmarks
- NCSC End User Device Security Guidance
- Microsoft Secure Score
- NCSC Cloud Security Guidance
Common Mistakes to Avoid
- Treating this as a one-time task. New devices are added, software is installed, and updates change settings. Configuration management must be ongoing.
- Forgetting printers and networked devices. Printers, scanners, and similar devices are often ignored but can have web interfaces, default credentials, and stored documents. Include them in scope.
- Keeping “just in case” software. If you are not using it, remove it. Legacy software with known vulnerabilities is one of the most common ways attackers gain a foothold.
- Assuming cloud services are configured securely by default. They are not. The shared responsibility model means the cloud provider secures the infrastructure; you are responsible for what you put on it and how it is configured.
What is Next
Once your devices are locked down with sensible configurations, the question becomes: who can access them, and what can they do?
That is the focus of our next post: User Access Control – ensuring the right people have the right access, and no more.
