Manage Default Accounts on Enterprise Assets and Software
Description
Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
Apple device management platform for macOS and iOS endpoint configuration, security, and software deployment
Jamf · Per-device subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Exploitation of Default Administrator Credentials
ConfidentialityAttackers use widely known default credentials (admin/admin, root/root, sa/blank) to gain administrative access to systems, applications, and network devices.
Automated Botnet Attacks on Default Accounts
AvailabilityInternet-facing systems with active default accounts are compromised by automated botnets that systematically attempt default credential combinations across common platforms.
Privilege Escalation via Vendor Backdoor Accounts
IntegrityUndocumented or unmanaged pre-configured vendor accounts with elevated privileges are discovered by attackers, providing a persistent backdoor path to administrative access.
Vulnerabilities (When Safeguard Absent)
Active Default Accounts with Known Credentials
Default accounts shipped by vendors remain active and unchanged, providing publicly documented credentials that any attacker can use for immediate system access.
No Process to Identify and Manage Pre-Configured Accounts
Without a process to discover and manage default accounts during deployment, vendor-supplied accounts persist unnoticed throughout the system's lifecycle.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |