The NSA and CISA identified ten common cybersecurity misconfigurations: default configurations of software and applications, improper separation of user/administrator privileges, insufficient internal network monitoring, lack of network segmentation, poor patch management, bypass of system access controls, weak or misconfigured multifactor authentication methods, insufficient access control lists on network shares and services, poor credential hygiene, and unrestricted code execution.

Organizations can mitigate cybersecurity misconfigurations by removing default credentials, hardening configurations, disabling unused services, implementing access controls, regularly updating and automating patch management, and auditing administrative accounts and privileges. These actions help strengthen the overall security posture.

Software manufacturers can enhance cybersecurity by adopting secure-by-design principles, embedding security controls into product architecture from the start, eliminating default passwords, providing high-quality audit logs, and mandating multifactor authentication for privileged users. These practices help reduce the prevalence of common misconfigurations and improve security outcomes for customers.