Misconfiguration Vulnerability
- •
def
- •
a weakness introduced by incorrect system or service configuration, rather than a flaw in the software itself
- •
- •
common examples
- •
open permissions — e.g., June 2017, 14 million Verizon records were exposed after a third party left an Amazon S3 bucket open
- •
unsecured admin accounts — e.g., an easy-to-guess root/administrator password; mitigated by disabling direct root login (use
su/sudoinstead) and limiting how many accounts have elevated access
- •
- •
related