Security Misconfiguration.

What Is Security Misconfiguration?

Security misconfiguration means a system, application or service has settings that leave it open to attack. The product may be fine, but the way it was set up is not. OWASP lists it as A05 in its Top 10 for 2021 and says it moved up from sixth place, reasoning that more software is highly configurable.

What Does a Misconfigured System Look Like?

OWASP gives four example scenarios. Sample applications with known flaws are left on a production server. Directory listing is not disabled, so an attacker can list directories and find files. The server returns detailed error messages such as stack traces. A cloud service has default sharing permissions open to the internet, so sensitive data in cloud storage can be reached.

NSA and CISA name default configurations of software and applications as the first item on their list of the most common misconfigurations in large organizations. The same list includes lack of network segmentation, poor patch management and weak or misconfigured multifactor authentication.

Which ATT&CK Techniques Match Common Misconfigurations?

The NSA and CISA advisory ties its misconfigurations to MITRE ATT&CK. Five examples are below.

Why Are Misconfigurations Easy for Attackers to Use?

OWASP reports that 90 percent of applications were tested for some form of misconfiguration. NSA and CISA base their list on assessments of networks and call these systemic weaknesses in many large organizations. A misconfiguration needs no special exploit, so it can be easy for an attacker to use once found. So a single unchanged default can undo other protections around it.

Which Hardening Steps Reduce Misconfiguration?

OWASP and CISA point to similar steps. These are paraphrased.

• Use a repeatable hardening process, so each new environment is locked down the same way.
• Keep a minimal platform with unused components removed.
• Review and update configurations as part of patch management.
• Check automatically that settings are effective in every environment.
• Change or disable vendor-supplied default usernames and passwords during installation.

OWASP also lists segmentation among its preventive measures. CISA adds advice to establish a baseline of normal network activity and investigate deviations from it. The misconfiguration detection use case covers checking settings across exposed systems.

Is a Misconfiguration the Same as a Vulnerability?

Not quite. A vulnerability is usually a flaw in the product itself, which a patch can often fix. A misconfiguration is a setting choice, which the owner has to correct. Both can lead to the same result, and a vulnerability management program often covers both.

Is Security Misconfiguration the Same as a Default Credential Problem?

No. Default credentials are one common kind of misconfiguration. OWASP and CISA both give them as an example, but the wider term also covers open permissions, unneeded features and verbose errors.

Related Terms

See also vulnerability management, attack surface and cloud security.

Related Pages in the Knowledge Hub

• Misconfiguration detection
• Attack surface reduction

Sources

• top10.owasp.org: OWASP A05:2021 overview, example scenarios and prevention list.
• CISA: NSA and CISA list of top ten cybersecurity misconfigurations and mitigations.
• MITRE ATT&CK: Default Accounts.
• MITRE ATT&CK: Exploit Public-Facing Application.
• MITRE ATT&CK: Multi-Factor Authentication Request Generation.
• MITRE ATT&CK: Credentials In Files.
• MITRE ATT&CK: SMB/Windows Admin Shares.