The default configuration of ICS components is typically designed to ensure that the components work properly and can be put into operation easily. Security mechanisms often play a subordinate role in this regard. All services, protocols, and connections are usually activated and remain active in the default setting even if they are not used. Preset authorisations often remain unchanged, as well.

For attackers, it is easy to take over and manipulate such ICS components. It is also possible for an attacker to exploit an insecure system configuration in order to use the ICS component as a starting point for additional attacks. As a result, critical information may be leaked or the entire operation of the organisation in question may be impaired.