A5 Security Misconfiguration

Some developer/administrator leaves setting of OS or application on default mode which is not secure at all. Poorly configured security controls could allow malicious user to change your website, obtain unauthorized access, compromise files, or perform other unintended action.

What to configure:

• OS
• Web/App Server
• DBMS
• Applications
• Third party framework

Impact on Security:

1. Attack on Confidentiality
2. Attack on Integrity
3. Attack on Availability

Possible Mitigation:

1. Keep OS updated
2. Keep third party application up to date.
3. Change default username and password.
4. Disable directory listings if they are not necessary, or set access controls.
5. Delete unnecessary files such as configuration or install file.
6. Use strong encryption for anything sensitive.