V-222661
Application Security and Development Security Technical Implementation Guide
Title
Unnecessary built-in application accounts must be disabled.
Description
<VulnDiscussion>Default passwords and properties of built-in accounts are often publicly available. Anyone with necessary knowledge, internal or external, can compromise an application using built-in accounts. Built-in accounts are those that are added as part of the installation of the application software. These accounts exist for many common Commercial Off-the-Shelf (COTS) or open source components of enterprise applications (e.g., OS, web browser or database software).</VulnDiscussion><Fals...
Fix Text (Documentation Requirement)
Disable unnecessary built-in userids, use other strong authentication when possible and use strong passwords if accounts are necessary for application operation.