Which of the following findings from a database security audit presents the GREATEST risk of critical security exposures?

Unchanged default settings on a database system represent the greatest risk of critical security exposures. Database management systems often ship with well-known administrative accounts, default passwords, and insecure service configurations (e.g., network services enabled by default). These default configurations are publicly documented and are primary targets for automated attack tools that scan for vulnerable systems. A successful exploit provides an attacker with immediate, high-level privileges, potentially leading to a complete system compromise, data theft, or destruction. This finding indicates a fundamental failure in the system hardening process, creating a high-likelihood, high-impact vulnerability.

A. Legacy data has not been purged.

This is a data management and compliance issue that increases the impact of a data breach but does not directly create the vulnerability that allows unauthorized access.

B. Admin account passwords are not set to expire.

This is a significant weakness in password policy. However, the risk from publicly known default credentials (part of default settings) is more immediate and probable than the risk of a specific, non-expiring password being compromised.

D. Database activity logging is not complete.

This is a failure of a detective control. It severely hinders the ability to detect and respond to an incident but does not in itself create the vulnerability that leads to the initial compromise.

---

1. ISACA CISA Review Manual

27th Edition. Domain 5: Protection of Information Assets

Section 5.4.4

System Hardening. The manual emphasizes that a primary step in system hardening is changing default configurations and passwords. It states

"System hardening involves securing a system by reducing its surface of vulnerability... This is typically done by... changing default passwords

removing unnecessary software

services and drivers..." This identifies changing defaults as a foundational control to prevent initial compromise.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

"Security and Privacy Controls for Information Systems and Organizations." Control family CM (Configuration Management)

specifically control CM-6 (Configuration Settings). This control mandates the establishment and enforcement of secure configuration settings. The guidance consistently highlights the risk of using vendor-supplied defaults

as they are a well-known target for adversaries.

3. National Institute of Standards and Technology (NIST) Special Publication 800-123

"Guide to General Server Security." Section 3.1

"Initial Setup

" explicitly states: "Change all default passwords... Default passwords for operating systems and applications are widely known; not changing them is an invitation for a compromise." This directly supports that default settings

including passwords

are a primary and critical risk.

4. Whitten

A.

& Tygar

J. D. (1999). Why Johnny can't encrypt: A usability evaluation of PGP 5.0. In Proceedings of the 8th USENIX Security Symposium (pp. 169-184). While focused on usability

this seminal paper's principles apply here: security controls that are difficult to implement correctly (like remembering to change defaults) are often ignored

leading to widespread vulnerability. The "path of least resistance" for administrators is to leave defaults

which is the path of least resistance for attackers to exploit.