# What is Security Misconfiguration?

> Security misconfiguration is a security-relevant setting or operational state that is missing, incorrect, inconsistent, excessively permissive, or unsuitable for its intended environment.

- Canonical URL: https://yellowcube.eu/glossary/security-misconfiguration/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It can occur in applications, frameworks, identities, cloud services, networks, hosts, containers, databases, devices, or management systems, and may expose data or functions, weaken another control, or create a condition that a threat can exploit.

Examples include unchanged default credentials, public storage, excessive permissions, enabled sample or debug features, verbose errors, missing security directives, exposed management interfaces, disabled logging, and inconsistent settings between environments. The correct configuration depends on architecture, purpose, data, threats, and operational constraints.

### Key points

- **Establish intent:** Define tested, version-specific baselines and policy for each environment, including required services, interfaces, permissions, logging, encryption, error handling, and approved exceptions.
- **Control change:** Use accountable review, repeatable deployment, least-privilege administration, protected configuration stores, and separation between development, test, and production credentials.
- **Verify state:** Assess effective settings and resource relationships, compare them with intended baselines, detect drift, prioritize by exposure and consequence, remediate safely, and confirm the correction persists.
- **Important limitation:** Not every vulnerability is a misconfiguration; correctly configured software can contain design or implementation weaknesses. A failed configuration check is also not proof of exploitability, while incomplete visibility or an unsuitable baseline can miss material risk.

### Related terms

[Vulnerability](<https://yellowcube.eu/glossary/vulnerability/>) · [Vulnerability scanning](<https://yellowcube.eu/glossary/vulnerability-scanning/>) · [Cloud security posture management (CSPM)](<https://yellowcube.eu/glossary/cloud-security-posture-management/>) · [Infrastructure as code (IaC) security](<https://yellowcube.eu/glossary/infrastructure-as-code-security/>) · [Cloud security](<https://yellowcube.eu/glossary/cloud-security/>)

### Sources

[OWASP Top 10:2025 A02 Security Misconfiguration](https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/) · [NIST SP 800-70 Rev. 5: National Checklist Program for IT Products](https://csrc.nist.gov/pubs/sp/800/70/r5/final) · [NIST SP 800-53 Rev. 5 Release 5.2.0](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.