An organization installed a new application server for IP phones. An automated process fetched user credentials from the Active Directory server, and the application will have access to on-premises and cloud services. Which security threat should be mitigated first?

Default accounts pose the most immediate threat in newly deployed systems. When an application server is first installed, it often comes with default administrative accounts that are well-known to attackers. Since this server automatically fetches AD credentials and has access to multiple environments, compromising a default account would give attackers immediate access to sensitive credentials and broad network access. This threat exists from the moment of installation and should be addressed before considering other security measures.

A. Aligning access control policies - Important but secondary to eliminating default accounts which provide immediate attack vectors.
B. Exfiltration during data transfer - Relevant for operational security but not the first priority during initial deployment.
D. Data exposure from backups - Backups wouldn't exist yet for a newly installed server.

1. NIST SP 800-123 "Guide to General Server Security" Section 4.1.2 - Default account management

2. CIS Controls v8, Control 5.2 "Use Unique Passwords for All Enterprise Assets"

3. RFC 2196 "Site Security Handbook" Section 4.3 - System configuration guidelines

4. ISO/IEC 27002:2022 Section 8.5 - Secure authentication

5. SANS Institute "Securing New System Deployments" - Initial hardening procedures