Taking the first requirement in requirement 2,
2.1, this thing about default usernames and passwords,
I mean, it's a while since I've actually been a hands-on QSA assessor,
is this still a problem in the market?
Do people still have admin admin as their username
and password on their routers?
Well, it's still a problem in an increasingly narrow segment of device types,
right?
So for your kind of garden variety operating systems,
for network devices, things like that, at least common network devices,
I think a lot of the sort of default password troubles of the 90s and the
early part of the last decade has largely faded away,
but in appliances, purpose-specific devices,
so maybe even a security appliance that's providing maybe DLP or
cryptographic services or things like that,
there are still default users there,
and there are still default passwords that need to be changed.
And then maybe in certain kinds of software,
database software that maybe had some default or sample users or certain kinds
of application software that had default setup components,
there are still some users that you need to make sure get pruned
out or get the passwords changed or the like.
And as an assessor, how are you going to do that?
I mean, in my day, you used to run Metasploit across the whole network,
and it would try all default usernames and passwords it knew.
Right.
I mean, generally, I'm going to go look at the devices individually,
in part because I want to go look at those devices for a variety of reasons,
and the default users is just a part of it.
The security configuration of those devices for other
aspects is also relevant for the assessment.
And they tend to be the sort of corner case things that you want to look
at anyhow because they're not necessarily getting their user accounts
managed by Active Directory or LDAP or something,
and they're not necessarily getting software updates applied in the
sort of automated way that kind of the other stuff is.
So they tend to be the things that you have to go find that lurk in the shadows,
and you want to go find them lurking in the shadows for a variety of reasons,
so.