"Secure By Default"

• Only critical services & daemons on by default

  • Enabled at admin's discretion
  • Admin has full control

• Opposite of "kitchen sink" installation

  • Unnecessary work to shut down unneeded services
  • Hard on novice admins
  • What you don't know will hurt you
  • "Four years without a remote hole in the default install!"