A security misconfiguration is an error that occurs when security controls are inaccurately configured or left insecure. It puts systems and data at risk. And any poorly documented configuration changes, default settings, or technical issues in any system component could lead to a misconfiguration.
Simply put, therefore, a security misconfiguration is any error in how a device has been set up to work.
Other interesting terms…
Read More about “Security Misconfiguration”
There are various ways a security misconfiguration can happen. And we’ll discuss some of them here.
What Actions Typically Lead to a Security Misconfiguration?
Some faulty security practices can lead to a security misconfiguration, including:
- Leaving defaults as-is: Software and systems typically provide users with default passwords so you can set them up or install them onto your computer. But they always remind you to change the default settings to ensure that only you can use them or change how they work. Insecurities may also stem from using default settings in certificates.
- Continuing to use deprecated protocols and encryption: Protocols, including those meant for encryption, are retired for a reason—they no longer meet the current security demand. That said, continued usage of defunct applications can lead to security misconfigurations and their nasty effects.
- Leaving databases open: There’s a reason why user access limitations are set—to restrict unauthorized people from getting their hands on data they’re not supposed to see. If anyone in an organization can access databases that contain confidential data, any attacker who compromises their accounts can, too.
- Enabling directory listing: While maintaining a directory makes data more accessible to users, the practice also leaves everything open for anyone, including threat actors, to see.
- Showing error messages with sensitive information: Revealing too much information may make error fixing easier but also tells everyone else, including attackers, how to get to their target.
- Misconfiguring cloud settings: Errors left unaddressed in cloud service settings, including those mentioned above, can also lead to a security misconfiguration.
- Enabling unnecessary features: These features include internal-only pages, ports, and command injection. Internal-only pages mustn’t be publicly accessible or viewable. Ports that aren’t in use should remain closed, especially if attackers typically abuse them. And not all users should be allowed to use commands on resources. All these translate to security misconfigurations.
The following diagram summarizes the factors that typically lead to a security misconfiguration.
What Can You Do to Avoid the Nasty Repercussions of a Security Misconfiguration?
There are several ways to prevent the occurrence of security misconfigurations, including:
- Learning all about an application’s behavior: You can’t fix any error if you don’t know every nook and cranny of an application. Not knowing how one component works with all others can lead to security misconfigurations that leave your data and systems open to threats.
- Maintaining visibility throughout your network: Without a bird’s-eye view of your entire network, ideally from a single dashboard, you can’t pinpoint where an error originates. If you can’t do that, you may waste time looking everywhere before you can finally address the issue. While inspecting all areas, attackers could already gain a foothold in your network and compromise your systems and data.
- Locking down critical infrastructure: Once you’ve identified the source of the problem, your next step is to lock down all critical systems. No one should be allowed access to them, as the incident could just be a means to misdirect your attention. While fixing the issue, threat actors could be siphoning off your confidential data.
- Implementing smart policies: You may not know it, but your organization may already suffer from security misconfigurations. You can’t, after all, control all the applications or shadow IT your employees use. That’s where microsegmentation comes in handy. By separating your network into smaller segments and assigning teams to each, you may avoid issues that stem from misconfiguration. These teams will be responsible for strict access governance implementation. By limiting who has access to particular systems and data and how they can use them, you also limit the risk of compromise.
—
Security misconfigurations can lead to dire consequences, such as the theft of sensitive data, as in NASA’s case, which resulted from an authorization misconfiguration in the organization’s database. Another example is a massive distributed denial-of-service (DDoS) attack akin to the Mirai incident that resulted from errors in how the devices turned bots were set up.
