Security Misconfiguration

HighData ProtectionA05:2021 – Security Misconfiguration

Insecure default configurations, incomplete setups, open cloud storage, verbose error handling, or misconfigured HTTP headers expose the application to attack.

Immediate Response

1Remove public access from misconfigured storage buckets immediately.
2Change all default credentials on all systems, databases, and services.
3Disable or restrict access to management ports and admin panels.
4Suppress verbose error messages in production environments.

All playbooks

1Harden all HTTP security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options.
2Review and disable all unnecessary services, ports, and features.
3Apply the principle of least privilege to all service accounts and IAM roles.
4Automate configuration baseline checks using CIS Benchmarks.

Long-term Prevention

1Adopt Infrastructure as Code (IaC) and enforce security in IaC templates (e.g., tfsec, Checkov).
2Deploy a Cloud Security Posture Management (CSPM) tool for continuous misconfiguration detection.
3Implement configuration drift detection in CI/CD pipelines.
4Regularly run CIS benchmark assessments and remediate findings.

Attack vectors

Publicly accessible cloud storage buckets (S3, GCS, Azure Blob)
Default credentials left on databases, admin panels, or devices
Verbose error pages exposing stack traces and framework versions
Unnecessary enabled features, ports, services, or accounts

Indicators of compromise

Public S3 buckets or storage containers flagged by cloud security posture tools
Default credentials accepted on admin interfaces
HTTP response headers containing framework or server version information
Open management ports (e.g., 22, 3389, 27017) exposed to the internet

Tooling

CheckovtfsecAWS ConfigScoutSuiteMozilla Observatory