What is Security Misconfiguration? | Secure Code Warrior

The term security misconfiguration is a bit of a catchall that includes common vulnerabilities introduced due to the application's configuration settings, instead of bad code. The most common ones normally involve simple mistakes that can have big consequences for organizations that deploy apps with those misconfigurations.

Some of the most common security misconfigurations include not disabling debugging processes on apps before deploying them to the production environment, not letting applications automatically update with the latest patches, forgetting to disable default features, as well as a host of other little things that can spell big trouble down the road.

The best way to combat security misconfiguration vulnerabilities is to eliminate them from your network before they are deployed to the production environment.

In this episode, we will learn:

• How hackers find and exploit common security misconfigurations
• Why security misconfigurations can be dangerous
• Policies and techniques that can be employed to find and fix security misconfigurations.

How do Attackers Exploit Common Security Misconfigurations?

There are a lot of common security misconfigurations. The most popular ones are well-known in hacker communities and are almost always searched for when looking for vulnerabilities. Some of the most common misconfigurations include, but are not limited to:

• Not disabling default accounts with well-known passwords.
• Leaving debugging features turned on in production that reveal stack traces or other error messages to users.
• Unnecessary or default features left enabled, such as unnecessary ports, services, pages, accounts, or privileges.
• Not using security headers, or, using insecure values for them.

Some misconfigurations are well-known and trivial to exploit. For example, if a default password is enabled, an attacker would only need to enter that along with the default username to gain high-level access to a system.

Other misconfigurations require a bit more work, such as when debugging features are left enabled after an app is deployed. In that case, an attacker tries to trigger an error, and records the returned information. Armed with that data, they can launch highly targeted attacks that may expose information about the system or the location of data they are trying to steal.

Why are Security Misconfigurations so Dangerous?

Depending on the exact security misconfiguration being exploited, the damage can range from information exposure to complete application or server compromise. Any security misconfiguration provides a hole in defenses that skilled attackers can leverage. For some vulnerabilities, such as having default passwords enabled, even an inexperienced hacker can exploit them. After all, it doesn't take a genius to look up default passwords and enter them!

Removing the Threat Posed by Security Misconfigurations

The best way to avoid security misconfigurations is to define secure settings for all apps and programs being deployed across an organization. This should include things like disabling unnecessary ports, removing default programs and features not used by the app, and disabling or changing all default users and passwords. It should also include checking for and dealing with common misconfigurations, such as always disabling debugging mode on software before it hits the production environment.

Once those are defined, a process should be put in place, one that all apps go through before they are deployed. Ideally, someone should be put in charge of this process, given sufficient power to enforce it, and also responsibility should a common security misconfiguration slip through.

More Information about Security Misconfigurations

For further reading, you can take a look at the OWASP list of the most common security misconfigurations. You can also put your newfound defensive knowledge to the test with a free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.

Ready to thwart a security misconfiguration right now? Head to our platform and challenge yourself [Start Here]