If anyone sets up a new desktop machine, a new SQL Server instance, a new Elastisearch instance, or any other platform, you need to ensure there is default security. That was a problem recently with a financial company that had a default Elasticsearch instance up with no authentication required. When I look at the install directions, security isn't mentioned. There is a secure settings page, but that's not authentication. It's not until you look way down the setup instruction list that you find configuring security. Even then this mentions "you can password-protect your data", which isn't a good option to have.

This should be built in with a "you must" protect your data. SQL Server used to allow a blank password, but there was plenty of outcry about this and setup changed to either require Windows Auth only, which inherently has some secure settings for accounts, or mixed security where a password must be entered for the only default account. That's how many software programs work these days, and really how all should work.

I'm still amazed by people that don't put a password (code, fingerprint, etc.) on a mobile phone. I'm surprised that we have any data store platform that doesn't require some security. As much as I find Google Drive sometimes a pain, I am glad that I can't put files in there and open them to the general public. At least, I haven't figured out how to do this. I constantly need to add specific people to access files.

All data files/software/stores/platforms/etc. need to be secured. Containers, buckets, any file shares should be limited in some way. Any platform ought to require user accounts and not allow access to all data by default. Really, privileged accounts ought to separate configuration  and security from data access. I'd like to see "sa" allowed to work the instance and create databases and move files, but not allowed to access data.

We need better default security, and more importantly, we need to believe that we need better default security. That's for all data, including backups, search services, and anything else that can access a database. Leaving data open to anyone that might stumble upon the URL is a mistake that has no excuse these days.