Default credentials must be removed from all network connected devices.
Control Type: Technical
Control Function: Preventive
Description: One of the first things that should be done when configuring network infrastructure is removing default credentials. This goes for routers, firewalls, switches, access points, and any other device that features a configuration panel. Every manufacturer will ship their hardware with basic default credentials configured. These are used for the initial setup of the device, and can usually be found on a tag at the bottom of the device, in a device manual, or online. Since these credentials are easily found, adversaries can quickly gain high level access to default network devices via a simple Google search. To mitigate this threat, administrators should enter the device's configuration panel, navigate to the administration page, and configure the device with a new default admin account and password. These credentials must follow the organization's password policy, and be stored in a secure location such as a password manager or credential vault.