Security Misconfiguration

Security misconfiguration is the most commonly seen vulnerability category. It includes:

• Unnecessary features enabled
• Default accounts and passwords
• Overly informative error messages
• Missing security headers
• Outdated software
• Unprotected files and directories

Prevention

• Automate the hardening process
• Use minimal platform configurations
• Review and update configurations regularly
• Implement infrastructure as code for consistency
• Run security scanners against configurations