12+ yr exp in security default/dev/test/guest accounts+passwords with easy to guess credentials exposing servers and services to the internet when not needed

12+ yr exp in security default/dev/test/guest accounts+passwords with easy to guess credentials exposing servers and services to the internet when not needed (memcached, hadoop, mongo, etc) Insecure Direct Object Reference Not blocking known hostile entities (known bad ASNs, known bad netblocks)