Security Misconfiguration.

What is security misconfiguration?

Security misconfiguration means a system, application or service has settings that leave it open to attack. The product may be fine, but the way it was set up is not. OWASP lists it as A05 in its Top 10 for 2021 and says it moved up from sixth place, reasoning that more software is highly configurable.

What does it look like?

OWASP gives four example scenarios. Sample applications with known flaws are left on a production server. Directory listing is not disabled, so an attacker can list directories and find files. The server returns detailed error messages such as stack traces. A cloud service has default sharing permissions open to the internet, so sensitive data in cloud storage can be reached.

NSA and CISA name default configurations of software and applications as the first item on their list of the most common misconfigurations in large organizations. The same list includes lack of network segmentation, poor patch management and weak or misconfigured multifactor authentication.

Why does it matter?

OWASP reports that 90 percent of applications were tested for some form of misconfiguration. NSA and CISA base their list on assessments of networks and call these systemic weaknesses in many large organizations. A misconfiguration needs no special exploit, so it can be easy for an attacker to use once found. Reasoning from this, a single unchanged default can undo other protections around it.

How can you reduce it?

OWASP and CISA point to similar steps. These are paraphrased.

• Use a repeatable hardening process, so each new environment is locked down the same way.
• Keep a minimal platform with unused components removed.
• Review and update configurations as part of patch management.
• Check automatically that settings are effective in every environment.
• Change or disable vendor-supplied default usernames and passwords during installation.

OWASP also lists segmentation among its preventive measures. CISA adds advice to establish a baseline of normal network activity and investigate deviations from it.

Is a misconfiguration the same as a vulnerability?

Not quite. A vulnerability is usually a flaw in the product itself, which a patch can often fix. A misconfiguration is a setting choice, which the owner has to correct. Both can lead to the same result, and a vulnerability management program often covers both.

Is security misconfiguration the same as a default credential problem?

No. Default credentials are one common kind of misconfiguration. OWASP and CISA both give them as an example, but the wider term also covers open permissions, unneeded features and verbose errors.

Related terms

See also vulnerability management, attack surface and cloud security.

Related pages in the Knowledge Hub

• Misconfiguration detection
• Attack surface reduction

Sources

• top10.owasp.org: OWASP A05:2021 overview, example scenarios and prevention list.
• CISA: NSA and CISA list of top ten cybersecurity misconfigurations and mitigations.