The OWASP list of Top 10 Web Application Vulnerabilities, updated 2021, declared security misconfiguration as the 5th most critical AppSec risk. As per the research, over 90% of applications reported misconfiguration, with an average incident rate of 4%. One of the reasons it is gaining popularity among cyber attackers is it doesn’t just affect web assets but every component that requires configuration.
According to OWASP, applications are vulnerable to security misconfiguration if they lack sufficient hardening or have improperly configured cloud service permissions. Additional concerns include redundant features, default settings and passwords, visible error handling information, and misconfigured or disabled security features.
It is important to ensure application frameworks and servers have secure settings and that all software components are up to date. The servers should send security directives or headers to clients. OWASP offers recommendations to avoid security misconfiguration issues—these include implementing repeatable, automated security hardening processes, segmenting the application architecture, and keeping the platform minimal.