Application Security Testing

Security Misconfiguration: Impact, Examples and Prevention

LEARN MORE

What is a Security Misconfiguration?

Security misconfiguration occurs when security settings are not adequately defined in the configuration process or maintained and deployed with default settings.

This might impact any layer of the application stack, cloud or network. Misconfigured clouds are a central cause of data breaches, costing organizations millions of dollars.

Vulnerabilities are generally introduced during configuration. Typical misconfiguration vulnerabilities occur with the use of the following:

Defaults—including passwords, certificates and installation
Deprecated protocols and encryption
Open database instances
Directory listing—this should not be enabled
Error messages showing sensitive information
Misconfigured cloud settings
Unnecessary features—including pages, ports and command injection

What’s covered in this article:

Why Security Misconfigurations Occur
The Impact of Security Misconfigurations
9 Common Types of Security Misconfiguration
Security Misconfiguration Example
How You Can Prevent Security Misconfigurations
Security Misconfiguration Protection with Neuralegion

1. Why Security Misconfigurations occur

A misconfiguration may take place for a variety of reasons. Today’s network infrastructures are intricate and continually changing—organisations might overlook essential security settings, such as network equipment that could still have default configurations.

Even if an organisation has secured configurations for its endpoints, you must still regularly audit security controls and configurations to identify configuration drift. New equipment is added to the network, systems change and patches are applied—all adding to misconfigurations.

Developers may develop network shares and firewall rules for ease, while building software keeping them unchanged. Sometimes, administrators permit configuration modifications for troubleshooting or testing purposes, but these don’t return to the initial state.

Employees often temporarily disable an antivirus if it overrides particular actions (such as running installers) and then fail to remember to re-enable it. It is estimated that over 20% of endpoints have outdated anti-malware or antivirus.

2. The Impact of Security Misconfigurations Attacks

Security misconfigurations can be the result of relatively simple oversights, but can expose an application to attack. In certain instances, misconfiguration may leave information exposed, so a cybercriminal won’t even need to carry out an active attack. The more code and data exposed to users, the bigger the risk for application security.

For example, a misconfigured database server can cause data to be accessible through a basic web search. If this data includes administrator credentials, an attacker may be able to access further data beyond the database, or launch another attack on the company’s servers.

In the case of misconfigured (or absent) security controls on storage devices, huge amounts of sensitive and personal data can be exposed to the general public via the internet. Generally, there is no way of discovering who might have accessed this information before it was secured.

Directory listing is another common issue with web applications, particularly those founded on pre-existing frameworks like WordPress. Users browse and access the file structure freely, so they can easily discover and exploit security vulnerabilities.

If you cannot block access to an application’s structure, attackers can exploit it to modify parts of or reverse-engineer the application. This might be hard to control if an application is meant for delivery to mobile devices. As OWASP notes, switching to mobile applications weakens an organisation’s control over who can view or modify the code. This is because the business and presentation layers of the applications are deployed on a mobile device and not on a proprietary server.

3. 9 Common Types of Security Misconfiguration

The following are common occurrences in an IT environment that can lead to a security misconfiguration:

Default accounts / passwords are enabled—Using vendor-supplied defaults for system accounts and passwords is a common security misconfiguration, and may allow attackers to gain unauthorised access to the system.
Secure password policy is not implemented—Failure to implement a password policy may allow attackers to gain unauthorised access to the system by methods such as using lists of common username and passwords to brute force a username and/or password field until successful authentication.
Software is out of date and flaws are unpatched—Failure to update software patches as part of the software management process may allow attackers to use techniques such as code injection to inject malicious code that the application then executes.
Files and directories are unprotected—Leaving files and directories unprotected may allow attackers to use techniques such as forceful browsing to gain access to restricted files or areas in the server directory.
Unused features are enabled or installed—Failure to remove unnecessary features, components, documentation, and samples makes the application susceptible to misconfiguration vulnerabilities, and may allow attackers to use techniques such as code injection to inject malicious code that the application then executes.
Security features not maintained or configured properly—Failure to properly configure and maintain security features makes the application vulnerable to misconfiguration attacks.
Unpublished URLs are not blocked from receiving traffic from ordinary users—Unpublished URLs, accessed by those who maintain applications, are not intended to receive traffic from ordinary users. Failure to block these URLs can pose a significant risk when attackers scan for them.
Improper / poor application coding practices—Improper coding practices can lead to security misconfiguration attacks. For example, the lack of proper input/output data validation may lead to code injection attacks which work by injecting code that the application executes.
Directory traversal—allows an attacker to access directories, files, and commands that are outside the root directory. Armed with access to application source code or configuration and critical system files, a cybercriminal can change a URL in such a way that the application could execute or display the contents of arbitrary files on the server. Any device or application that reveals an HTTP-based interface is possibly vulnerable to a directory traversal attack.

4. Security Misconfiguration Examples: Real Life Misconfiguration Attacks

Here are a few real- life attacks that caused damage to major organisations, as a result of security misconfigurations:

NASA authorisation misconfiguration attack – NASA because vulnerable to a misconfiguration in Atlassian JIRA. An authorisation misconfiguration in Global Permissions enabled exposure of sensitive data to attackers.
Amazon S3 – many organisations experienced data breaches as a result of unsecured storage buckets on Amazon’s popular S3 storage service. For example, the US Army Intelligence and Security Command inadvertently stored sensitive database files, some of them marked top secret, in S3 without proper authentication.
Citrix legacy protocols attack – Citrix used an IMAP-based cloud email server and became the target of IMAP-based password-spraying. IMAP is an insecure, legacy protocol, and attackers exploited it to get access to cloud-based accounts and SaaS applications. Using multi factor authentication (MFA) could have stopped the attack.
Mirai (未来) botnet – Mirai was a mega-scale botnet that infected network devices like CCTV cameras, DVD devices and home routers. The botnet exploited a misconfiguration in these devices – the use of insecure default passwords. The botnet was used to carry out DDoS attacks of unprecedented magnitude, which brought down websites like Twitter, Reddit, and Netflix.

5. How Can You Safeguard Against Security Misconfiguration?

The initial step you need to take is to learn the features of your system, and to understand each key part of its behaviour.

To achieve this, you must have a real-time and accurate map of your whole infrastructure. This demonstrates communication and flows over your data centre environment, both on-premises or in a hybrid cloud.

When you understand your systems, you can mitigate risks resulting from security misconfiguration by keeping the most essential infrastructure locked. Permit only some authorised users to access the ecosystem.

Here are some efficient ways to minimise security misconfiguration:

Establish a hardening process that is repeatable, so that it’s fast and simple to deploy correctly configured new environments. The production, development, and QA environments must all be configured in the same way, but with distinct passwords used in every environment. Automate this process to easily establish a secure environment.
Install patches and software updates regularly and in a timely way in every environment. You can also patch a golden image and deploy the image into your environment.
Develop an application architecture that offers effective and secure separation of elements.
Run scans and audits often and periodically to identify missing patches or potential security misconfigurations.
Ensure a well-maintained and structured development cycle. This will facilitate the security testing of the application in the development phase.
Train and educate your employees on the significance of security configurations and how they can affect the general organisation’s security.
Encrypt data-at-rest to prevent data from exploitation.
Apply genuine access controls to both files and directories. This will help offset the vulnerabilities of files and directories that are unprotected.
If using custom code, utilise a static code security scanner before you integrate the code into the production environment. Security professionals must also perform manual reviews and dynamic testing.
Utilise a minimal platform free from excess features, documentation, samples and components. Don’t install or remove unused features or insecure frameworks.
Review cloud storage permissions, including S3 bucket permissions. Incorporate updates and reviews of all security configurations for all updates, security patches and notes into your patch management process.
Put in place an automated process. This makes certain that security configurations are applied to all environments.

6. Security Misconfiguration Protection with Neuralegion

NeuraLegion’s Nexploit automates the detection of security misconfiguration and hundreds of other vulnerabilities. The reports come with zero false-positives and clear remediation guidelines for the whole team. Nexploit’s integration with ticketing tools like Jira helps you keep track of all the findings and assigned team members.