What is security by default in a TA context?

• A. Customizable by users after deployment.
• B. Systems start with secure configurations and minimal access; TA enforces secure baselines and secure-by-default settings.
• C. Systems are deployed with full administrator access to speed setup.
• D. Security features are optional and disabled by default.

Answer: (B)

Security by default means the system starts in a hardened, secure state with minimal services and the least privilege needed, and the Trusted Agent enforces secure baselines and secure-by-default settings. This approach reduces the attack surface from the moment of deployment and keeps configurations aligned with security policies through automated baseline enforcement, preventing drift and unintentional exposure.

This is the best fit because it ensures defenses are in place out of the box, so the system is protected from the start rather than requiring additional steps to secure it after deployment. It also promotes consistency across deployments, which is crucial for reliable security posture.

The other options undermine this principle: letting users customize after deployment can reintroduce insecure configurations; deploying with full administrator access defeats the purpose of minimization and control; making security features optional or disabled by default leaves the system vulnerable from the outset.