A company has just completed a security audit and received initial results from the auditor. The results show that the ethical hacker was able to gain access to the company servers by exploiting…

Discretionary Access Controls (DAC) allow object owners to grant permissions, which can lead to inconsistent security and over-permissioning, making it less effective for enterprise-wide hardening than RBAC.

Disabling unnecessary accounts, including guest accounts or dormant administrator accounts, removes potential unauthorized entry points for attackers, thereby reducing the attack surface by eliminating unmonitored or weakly secured user identities.

Changing default passwords is a basic security practice, but the exploitation described suggests broader issues related to account management and permissions beyond just default passwords.

Installing antivirus software is crucial for endpoint protection against malware but does not directly address the exploitation of non-hardened VMs and hosts related to account access and permissions.

Implementing Role-Based Access Controls (RBAC) ensures that users and services only have the minimum necessary permissions to perform their functions, adhering to the principle of least privilege. This restricts an attacker's lateral movement and impact if an account is compromised, significantly hardening the environment.