From the course: Complete Guide to Application Security

Unlock this course with a free trial

Join today to access over 25,600 courses taught by industry experts.

Configuration security

Configuration security

From the course: Complete Guide to Application Security

Start my 1-month free trial Buy for my team

Configuration security

“

- [Instructor] Application security isn't just about writing secure code. It's about making sure your app and its environment are configured in a way that maximizes security. This is where security misconfigurations come into play. Misconfigurations can be anything from leaving unnecessary features enabled, keeping default accounts with their original passwords, or even having network ports open that shouldn't be. These might seem like small oversights, but they can be an open invitation to attackers. Think of it like this. You wouldn't leave your front door wide open with a sign that says, "Welcome, come on in," right? That's essentially what some of these misconfigurations allow attackers to do. To give you an idea of how widespread this issue is, misconfigurations map to about 20 CWEs, and a staggering 90% of applications tested in recent studies had at least one misconfiguration flaw. One common example is overly verbose error messages. These can leak sensitive information, like…

Contents