6. Security Misconfigurations

6. Security Misconfigurations: Security Misconfiguration is like buying a new safe and leaving its factory default passcode (admin/admin) active, or leaving structural blueprint

Security Misconfiguration is like buying a new safe and leaving its factory default passcode (admin/admin) active, or leaving structural blueprint pages taped to the front door.

2 Analogies: Security Misconfigurations

Factory Default Passcode

Verbose Stack Trace Leaks

2 Reasonings: Why It Is Common

Out-of-the-Box Convenience

2 LEGO Analogies: Configuring LEGO Pieces

Which of the following is a classic example of a Security Misconfiguration?

Leaving default admin/admin credentials active

Displaying detailed stack traces and debugging logs to public web clients

Leaving unused ports and sample developer tools exposed

Default passwords, open debug endpoints, and verbose error pages all represent failure to secure configure systems.

What should be displayed on error pages in a production environment?

The raw SQL query and Java exception stack trace