As delivered by manufacturers and resellers, the default configurations for operating
systems and applications are normally geared to ease-of-deployment and ease-of-use -
not security. Basic controls, open services and ports, default accounts or passwords,
older (vulnerable) protocols, pre-installation of unneeded software; all can be
exploitable in their default state.