Build and Maintain a Secure Network and Systems
2
Apply Secure Configurations to All System Components
Default configurations shipped by vendors are often insecure and well-known to attackers. This requirement mandates that all system components are hardened by changing defaults, removing unnecessary services, and applying secure configuration standards before deployment into the CDE.
Control Intent
Eliminate vulnerabilities introduced by default vendor configurations, unnecessary services, and insecure settings on all system components within or connected to the cardholder data environment.
Common Failures
- Default administrative passwords left unchanged on network devices, databases, or application servers
- Unnecessary services such as Telnet, FTP, or SNMP v1/v2 running on production systems in the CDE
- Missing or outdated system component inventory, leading to untracked devices in scope
- Lack of documented configuration standards, with each system configured ad-hoc without a baseline
- Running multiple primary functions on a single server without justification or additional controls