Most organisations think secure configuration means installing security software and walking away. But Cyber Essentials requires active management of how your devices are set up from day one. Default configurations are designed for ease of use, not security.
Here’s how to configure your systems properly without breaking daily operations.
Start with default account cleanup
Every new device ships with accounts you don’t need. Guest accounts, unused admin accounts and vendor test accounts create unnecessary attack surfaces.
Windows systems: Disable the built-in Guest account and any unused Administrator accounts. Check for vendor-specific accounts that came with pre-installed software.
Network devices: Change default usernames where possible. Many routers ship with “admin/admin” or similar combinations that attackers know by heart.
Cloud services: Remove sample users, demo accounts, and any accounts created during initial setup testing.
Document which accounts you’re keeping and why. If you can’t explain why an account exists, remove it.
Change every default password
Default passwords are public knowledge. Security researchers publish lists of common defaults and attackers use these in automated tools.
Network equipment priorities: Start with firewalls, routers, and switches. These protect everything else on your network.
Application defaults: Check database admin accounts, service accounts and any software that creates users during installation.
IoT devices: Printers, CCTV cameras and other connected devices often have unchangeable default passwords. If you can’t change them, consider whether they need network access or put them on a separate network (VLAN).
Create unique passwords for each device. Don’t use variations of the same base password across multiple systems.
Remove unnecessary software and services
Every installed program increases your attack surface. Unused software still gets security updates, still has vulnerabilities and still provides attack vectors.
Pre-installed bloatware: New computers come loaded with trial software, games and utilities most organisations never use. Remove everything that isn’t essential for business operations.
Background services: Check what’s running automatically. Many programs install background services that start with Windows even when the main application isn’t needed.
Browser extensions: Remove or disable extensions that aren’t actively used. Keep only what people actually need for their work.
Network services: Disable unused protocols like Telnet, FTP, or remote desktop services unless specifically required.
Make this part of your standard build process. Create clean system images without unnecessary components.
Set up device unlocking properly
Device unlocking credentials are your first line of defence when someone gains physical access to equipment.
Minimum requirements: At least 6 characters for device unlock. If device unlock also provides system access, use full password requirements (8+ characters minimum).
Brute-force protection: Configure throttling so failed attempts trigger increasing delays. Lock devices after 10 unsuccessful attempts where possible.
Biometric options: Fingerprint and face recognition work well for device unlock. They’re faster than passwords and harder for observers to steal.
PIN complexity: If using PINs, avoid obvious patterns like 1234 or repeated digits. Don’t use birthdays or other personal information.
Mobile devices: Use your mobile device management system to enforce unlock requirements across all company phones and tablets.
Disable auto-run features
Auto-run features execute code automatically when files are accessed or storage devices are connected. This is exactly how malware spreads.
Windows AutoPlay: Disable automatic execution for all removable media. Users should manually choose what happens when they insert USB drives or CDs.
Email attachments: Configure email clients to require user approval before opening attachments, especially executable files.
Downloaded files: Disable automatic execution of downloaded files. Users should verify what they’re opening before running it.
Macro settings: Set Microsoft Office to disable macros by default. Enable them only when specifically needed for trusted documents.
Script execution: Configure systems to require administrator approval for running scripts unless they’re part of approved business applications.
Create configuration management processes
Secure configuration isn’t a one-time task. You need processes to maintain security settings over time.
Standard build documentation: Document exactly how each type of device should be configured. Include security settings, required software and account setup.
Configuration monitoring: Use tools to check that devices maintain required security settings. Alert when configurations drift from standards.
Change approval process: Require approval before modifying security configurations. Document business justification for any changes.
Regular reviews: Schedule quarterly reviews of device configurations. Check for new accounts, installed software and changed security settings.
New device process: Create checklists for configuring new equipment. Don’t rely on memory or informal processes.
Handle different device types
Servers: Focus on disabling unnecessary network services and removing unused software. Servers should run only what’s required for their specific function.
Workstations: Balance security with usability. Users need to install some software, but control what can be installed automatically.
Mobile devices: Use mobile device management to enforce security settings. Separate personal and business data where possible.
IoT devices: Many can’t be reconfigured. Focus on network segmentation to limit their access if compromised.
Common implementation mistakes
Assuming defaults are secure: They’re designed for compatibility, not security. Always review and modify default settings.
Making changes without testing: Test configuration changes on a small group before rolling out company-wide.
Ignoring user impact: Overly restrictive settings that prevent people from working will be circumvented.
Not documenting changes: You need records of what was changed, when, and why for compliance and troubleshooting.
Monitoring and maintenance
Configuration management is ongoing. Systems change, software updates and new vulnerabilities are discovered.
Set up automated monitoring where possible. Use configuration management tools to track changes and alert when systems drift from approved settings.
Schedule regular audits to verify that your documented configurations match what’s actually deployed.
When done properly, secure configuration becomes part of your standard operating procedures rather than an additional burden.
