Introduction: It’s Not the Hackers — It’s the Holes We Leave Open
When people hear “cybersecurity breach,” they often imagine elite hackers bypassing firewalls with custom malware. In reality, most breaches happen because of simple, avoidable misconfigurations.
Whether you’re a start-up or an enterprise, these 10 missteps are commonly found during assessments — and they leave the door wide open.
1. Remote Desktop Protocol (RDP) Open to the Internet
Exposing RDP directly to the internet is one of the most common and dangerous misconfigurations. Attackers constantly scan for open RDP ports (like 3389) and brute-force them.
Fix: Use a VPN or remote access gateway, and enable MFA.
2. Default or Weak Administrative Credentials
Printers, switches, routers, CMSs — many are left with default logins. Even in 2025, this is still a top attack vector.
Fix: Change all default passwords immediately and enforce strong password policies.
3. Overly Permissive Firewall Rules
“Allow all” outbound traffic or poorly segmented zones can let malware move freely once inside.
Fix: Implement least privilege for network rules and regularly review firewall configurations.
4. Unrestricted File Shares and Network Drives
Shared folders with “Everyone: Full Control” permissions are a goldmine for attackers, especially for ransomware.
Fix: Apply proper access controls, monitor shares, and disable anonymous access.
5. Outdated and Unpatched Software
Old software versions, unpatched plugins, or legacy systems are key targets for attackers exploiting known CVEs.
Fix: Apply patches promptly and prioritise based on risk (not just CVSS scores).
6. Lack of Multi-Factor Authentication (MFA)
Credential theft is rampant, and without MFA, attackers can easily access cloud email, VPNs, or admin portals.
Fix: Enforce MFA — at minimum for admins, remote access, and email.
7. Misconfigured Cloud Storage (e.g., AWS S3, Azure Blob)
Public buckets or misapplied policies can expose sensitive data to the world — no hacking required.
Fix: Use cloud security posture management (CSPM) tools and apply least-privilege IAM policies.
8. Excessive Privileges for Users and Service Accounts
Users often have more access than they need. Compromised accounts with high privileges are a major risk.
Fix: Review roles and permissions regularly and apply least privilege.
9. Missing or Misconfigured Logging
If you’re not logging the right events — or not logging at all — incidents can go undetected for weeks.
Fix: Enable and centralise logging, especially for authentication, changes, and security events.
10. No Backup or Insecure Backup Configuration
Ransomware can wipe out local backups. Worse, backups that aren’t tested or protected may fail when needed most.
Fix: Implement offsite or immutable backups and test recovery procedures regularly.
Conclusion: Misconfigurations Are the New Insider Threat
Attackers don’t need zero-days when companies give them open doors.
These ten misconfigurations are not just technical flaws — they’re operational risks. By addressing them proactively, organisations can drastically reduce their exposure to real-world attacks.