Security measures are not always activated in the standard configurations of ICS components. This means unauthorised persons may be able to access them with ease. The operation of insecurely configured components can also be a threat to the security of other components in a given environment, such as when access data for these components can be read or the components are in a trust relationship with other systems.

For example, default passwords could be used, clear text protocols could be implemented for system management, services that are not required could be operated, unsecured interfaces such as USB or FireWire ports could be used, or security functions could be disabled.