Which of the following is a configuration vulnerability?

Security misconfiguration occurs when security settings are not adequately defined in the configuration process or maintained and deployed with default settings. This might impact any layer of the application stack, cloud or network. Misconfigured clouds are a central cause of data breaches, costing organizations millions of dollars. 

Vulnerabilities are generally introduced during configuration. Typical misconfiguration vulnerabilities occur with the use of the following:

• Defaults—including passwords, certificates and installation
• Deprecated protocols and encryption
• Open database instances
• Directory listing—this should not be enabled 
• Error messages showing sensitive information
• Misconfigured cloud settings
• Unnecessary features—including pages, ports and command injection 

This is part of an extensive series of guides about Network Security.

In this article:

• Why Do Security Misconfiguration Occur?
• Impact of Security Misconfigurations
• 9 Common Types of Security Misconfiguration
• Security Misconfiguration Example
• How Can You Prevent Security Misconfiguration?
• Security Misconfiguration Protection with Bright

Why Do Security Misconfiguration Occur?

A misconfiguration may take place for a variety of reasons. Today’s network infrastructures are intricate and continually changing—organizations might overlook essential security settings, such as network equipment that could still have default configurations. 

Even if an organization has secured configurations for its endpoints, you must still regularly audit security controls and configurations to identify configuration drift. New equipment is added to the network, systems change and patches are applied—all adding to misconfigurations. 

Developers may develop network shares and firewall rules for ease, while building software keeping them unchanged. Sometimes, administrators permit configuration modifications for troubleshooting or testing purposes, but these don’t return to the initial state. 

Employees often temporarily disable an antivirus if it overrides particular actions (such as running installers) and then fail to remember to re-enable it. It is estimated that over 20% of endpoints have outdated anti-malware or antivirus.

Impact of Security Misconfigurations Attacks

Security misconfigurations can be the result of relatively simple oversights, but can expose an application to attack. In certain instances, misconfiguration may leave information exposed, so a cybercriminal won’t even need to carry out an active attack. The more code and data exposed to users, the bigger the risk for application security. 

For example, a misconfigured database server can cause data to be accessible through a basic web search. If this data includes administrator credentials, an attacker may be able to access further data beyond the database, or launch another attack on the company’s servers.  

In the case of misconfigured (or absent) security controls on storage devices, huge amounts of sensitive and personal data can be exposed to the general public via the internet. Generally, there is no way of discovering who might have accessed this information before it was secured. 

Directory listing is another common issue with web applications, particularly those founded on pre-existing frameworks like WordPress. Users browse and access the file structure freely, so they can easily discover and exploit security vulnerabilities. 

If you cannot block access to an application’s structure, attackers can exploit it to modify parts of or reverse-engineer the application. This might be hard to control if an application is meant for delivery to mobile devices. As OWASP notes, switching to mobile applications weakens an organization’s control over who can view or modify the code. This is because the business and presentation layers of the applications are deployed on a mobile device and not on a proprietary server. 

9 Common Types of Security Misconfiguration

The following are common occurrences in an IT environment that can lead to a security misconfiguration:

1. Default accounts / passwords are enabled—Using vendor-supplied defaults for system accounts and passwords is a common security misconfiguration, and may allow attackers to gain unauthorized access to the system.
2. Secure password policy is not implemented—Failure to implement a password policy may allow attackers to gain unauthorized access to the system by methods such as using lists of common username and passwords to brute force a username and/or password field until successful authentication.
3. Software is out of date and flaws are unpatched—Failure to update software patches as part of the software management process may allow attackers to use techniques such as code injection to inject malicious code that the application then executes.
4. Files and directories are unprotected—Leaving files and directories unprotected may allow attackers to use techniques such as forceful browsing to gain access to restricted files or areas in the server directory.
5. Unused features are enabled or installed—Failure to remove unnecessary features, components, documentation, and samples makes the application susceptible to misconfiguration vulnerabilities, and may allow attackers to use techniques such as code injection to inject malicious code that the application then executes.
6. Security features not maintained or configured properly—Failure to properly configure and maintain security features makes the application vulnerable to misconfiguration attacks.
7. Unpublished URLs are not blocked from receiving traffic from ordinary users—Unpublished URLs, accessed by those who maintain applications, are not intended to receive traffic from ordinary users. Failure to block these URLs can pose a significant risk when attackers scan for them.
8. Improper / poor application coding practices—Improper coding practices can lead to security misconfiguration attacks. For example, the lack of proper input/output data validation may lead to code injection attacks which work by injecting code that the application executes.
9. Directory traversal—allows an attacker to access directories, files, and commands that are outside the root directory. Armed with access to application source code or configuration and critical system files, a cybercriminal can change a URL in such a way that the application could execute or display the contents of arbitrary files on the server. Any device or application that reveals an HTTP-based interface is possibly vulnerable to a directory traversal attack. Learn more in our detailed guide to directory traversal

Security Misconfiguration Examples: Real Like Misconfiguration Attacks

Here are a few real life attacks that caused damage to major organizations, as a result of security misconfigurations:

• NASA authorization misconfiguration attack – NASA because vulnerable to a misconfiguration in Atlassian JIRA. An authorization misconfiguration in Global Permissions enabled exposure of sensitive data to attackers.
• Amazon S3 – many organizations experienced data breaches as a result of unsecured storage buckets on Amazon’s popular S3 storage service. For example, the US Army Intelligence and Security Command inadvertently stored sensitive database files, some of them marked top secret, in S3 without proper authentication.
• Citrix legacy protocols attack – Citrix used an IMAP-based cloud email server and became the target of IMAP-based password-spraying. IMAP is an insecure, legacy protocol, and attackers exploited it to get access to cloud-based accounts and SaaS applications. Using multi factor authentication (MFA) could have stopped the attack.
• Mirai (未来) botnet – Mirai was a mega-scale botnet that infected network devices like CCTV cameras, DVD devices and home routers. The botnet exploited a misconfiguration in these devices – the use of insecure default passwords. The botnet was used to carry out DDoS attacks of unprecedented magnitude, which brought down websites like Twitter, Reddit, and Netflix.

Related content: Learn more about these and other attacks in our guide to misconfiguration attacks

How Can You Safeguard Against Security Misconfiguration?

The initial step you need to take is to learn the features of your system, and to understand each key part of its behavior. 

To achieve this, you must have a real-time and accurate map of your whole infrastructure. This demonstrates communication and flows over your data center environment, both on-premises or in a hybrid cloud.  

When you understand your systems, you can mitigate risks resulting from security misconfiguration by keeping the most essential infrastructure locked. Permit only some authorized users to access the ecosystem. 

Here are some efficient ways to minimize security misconfiguration: 

• Establish a hardening process that is repeatable, so that it’s fast and simple to deploy correctly configured new environments. The production, development, and QA environments must all be configured in the same way, but with distinct passwords used in every environment. Automate this process to easily establish a secure environment.
• Install patches and software updates regularly and in a timely way in every environment. You can also patch a golden image and deploy the image into your environment.
• Develop an application architecture that offers effective and secure separation of elements.
• Run scans and audits often and periodically to identify missing patches or potential security misconfigurations. 
• Ensure a well-maintained and structured development cycle. This will facilitate the security testing of the application in the development phase. 
• Train and educate your employees on the significance of security configurations and how they can affect the general organization’s security.
• Encrypt data-at-rest to prevent data from exploitation.
• Apply genuine access controls to both files and directories. This will help offset the vulnerabilities of files and directories that are unprotected.  
• If using custom code, utilize a static code security scanner before you integrate the code into the production environment. Security professionals must also perform manual reviews and dynamic testing.  
• Utilize a minimal platform free from excess features, documentation, samples and components. Don’t install or remove unused features or insecure frameworks. 
• Review cloud storage permissions, including S3 bucket permissions. Incorporate updates and reviews of all security configurations for all updates, security patches and notes into your patch management process.
• Put in place an automated process. This makes certain that security configurations are applied to all environments. 

Security Misconfiguration Protection with Bright

Bright automates the detection of security misconfiguration and hundreds of other vulnerabilities. The reports come with zero false-positives and clear remediation guidelines for the whole team. Bright’s integration with ticketing tools like Jira helps you keep track of all the findings and assigned team members.

Secure your app with every build

Sign up for a FREE Bright account.

Try Bright Bright for free – Register for a free Bright account

See Our Additional Guides on Key Network Security Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of network security.

Cloud security solutions

Authored by NetApp

• Understanding Cloud Security Challenges
• Cloud Security Architecture for IaaS, PaaS and SaaS
• Cloud Ransomware: Solving 3 Key Challenges

OIDC

Authored by Frontegg

• Authentication Clash: OIDC vs SAML
• User Management Encounter: OIDC vs OAuth2

Network Firewall

Authored by Cato

• Firewall Security: Understanding Your Options
• What is a UTM Firewall and What Is Beyond It?

Vulnerabilities

Deserialization Vulnerability: Everything You Need to Know

What is Deserialization Vulnerability? Deserialization vulnerability, often referred to as insecure deserialization, is a widespread and dangerous form of data theft & security breaches. However,

Read More »

November 27, 2022 No Comments

Vulnerabilities

7 SSRF Mitigation Techniques You Must Know

What is SSRF?  Server-side request forgery (SSRF) attacks allow an attacker to trick server-side applications into allowing access to the server or modifying files. SSRF

Read More »

November 15, 2022 No Comments

News

Turning Left: How Bright Reinvented the DAST Wheel

Dynamic Application Security Testing (DAST) tools have been around for decades. However, what was once the dominant market solution is becoming obsolete. Primarily, this shift

What are configuration vulnerabilities?

What is a security configuration vulnerability? flaw in your security settings, like failing to auto-encrypt your files, could leave your entire network and every device connected to it vulnerable to an attack.

Which of the following computing platforms is highly vulnerable to attacks?

Windows Computers Were Targets of 83% of All Malware Attacks in Q1 2020. AV Test shows that Windows computers are the most vulnerable to malware attacks and are targeted more than any other operating system.

Which of the following is an attack vector used by threat actors to penetrate a system?

Key takeaways. Hackers steal information, data, and money from people and organizations by investigating known attack vectors and attempting to exploit vulnerabilities. The three most common attack vectors used by hackers are phishing emails, malware, and unpatched vulnerabilities.

Which of the following is the most common method for delivering malware?

By far the most common method for hackers and state-sponsored hacking organizations to spread malware is through phishing emails. Hackers have become incredibly skilled at crafting emails that trick employees into clicking on links or downloading a file that contains malicious code.