Secure by default

Security by default, in software, means that the default configuration settings are the most secure settings possible, which are not necessarily the most user-friendly settings. In many cases, security and user-friendliness are evaluated based on both risk analysis and usability tests. This leads to the discussion of what the most secure settings are. As a result, the precise meaning of "secure by default" remains undefined.

In a network operating system, this typically means first and foremost that there are no listening INET(6) domain sockets after installation; that is, no open network ports. This can be checked on the local machine with a tool like netstat and remotely with a port scanner such as nmap. As a general rule, a secure network is only as secure as the least secure node in the entire network.

If a program uses secure configuration settings by default, the user will be better protected. However, not all users consider security and may be obstructed by secure settings. A common example is whether or not blank passwords are allowed for login. Not everyone can, or is willing to, type or memorize a password.

Another way to secure a program or system is through abstraction, where the user has presented an interface in which the user cannot (or is discouraged to) cause (accidental) data loss. This, however, can lead to less functionality or reduced flexibility. Having user control preferences does not typically cause this but at the cost of having a larger part of the user interface for configuration controls.

Some servers or devices that have an authentication system, have default usernames and passwords. If not properly changed, anyone who knows the default configuration can successfully authenticate. For non-unique defaults, this practice would violate the principle of 'security by default'.

Operating systems

OpenBSD claims to be the only operating system that is fully secure by default. This, however, does not mean it is inherently the most secure operating system. This is because that depends on the definition of an operating system. There are many operating systems that are not capable of networking with other systems, and when considering the amount of network-based security compromises today, one can argue such an operating system is more secure. OpenBSD is a network operating system.

Ubuntu is a Linux distribution aimed at desktop users that hides the administrative account by default and only allows the first user to gain administrative privileges for certain system tasks (such as installing system updates, and managing disk drives). macOS does not hide this account, but users with limited rights can still fully utilise the system.

Microsoft Windows and Linspire have been criticized for allowing the user to have administrative privileges without warning—a potential threat to the system. Windows Vista and subsequent versions of Windows attempt to remedy this situation through its User Account Control system.

See also

• Security-focused operating system
• Usability
• Default (computer science)
• Secure by design
• Authentication

This article is part of a series on
Information security
Related security categories
Internet security Cyberwarfare Computer security Mobile security Network security
Threats
Computer crime Vulnerabilities Eavesdropping Malware Spyware Ransomware Trojans Viruses Worms Rootkits Bootkits Keyloggers Screen scrapers Exploits Backdoors Logic bombs Payloads Denial of service Web shells
Defenses
Computer access control Application security Antivirus software Secure coding Secure by default Secure by design Secure operating systems Authentication Multi-factor authentication Authorization Data-centric security Encryption Firewall Intrusion detection system Mobile secure gateway Runtime application self-protection (RASP)

This article "Secure by default" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Secure by default. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---