Cyber attacks have become indispensable today. Cyber hackers can attack any website, and as a result, the data of the attacked website as well the members of the website are damaged. However, there are many different vulnerabilities in website vulnerabilities, and the reasons for these vulnerabilities, security measures to prevent them, etc. such situations are different from each other. Today we will learn about a vulnerability type, what is this vulnerability type, why it originates and how to prevent it, etc. we will learn the subjects.
What is Security Misconfiguration
Security Misconfiguration, its Turkish equivalent means wrong security configuration. Security Misconfiguration is a web security vulnerability found in OWASP TOP 10. As only 42% of all companies in the world are sensitive to this vulnerability, it is in 7th place of the OWASP TOP 10 list.
For this ranking changes every year, there is no exact order. Well, let's get to know this vulnerability a little more, it is very important to ensure web security while making a website. These securities must be passed through some processes such as configuring if necessary, but it is very risky to use the components (database, server, etc.) in web security with their default (initial state). Because there may be many vulnerabilities in the first version, and these vulnerabilities can be a base for cyberattacks.
As an example of this, the first version of Redis, which is the default version, has vulnerabilities, first of all the server IP address is found, and then it can capture cookies by breaking the server's password.
These attacks vary according to the wrong configurations in web security. For example, if there is a wrong configuration in the database server of a website, the attack will occur from there, or if the cookie_http only available in the first version of Javascript is active, the attack may come from there. Briefly, where these attacks will come from vary the errors found in the configuration.
What Causes Security Misconfiguration Attacks?
Outdated software, use of systems.
Unused and unnecessary of features be active.
Incorrect configuration/commands in the source codes of the website.
Reasons Like be the most popular.Also, these problems mostly occur in parts such as network services, web server, database, storage.
Precautions Against Security Misconfiguration Attacks
Follow and use the current versions of the software or applications used.
Turn off unused or unnecessary features.
Received error messages from the website into consideration.
Finally, pass the website penetration tests provided that once a year it will protect you from these attacks.
We can liken Security Misconfiguration attacks to Zero-Day attacks. However, the only difference from Zero-Day attacks is clear where the attack could come from. Above, we explained where Security Misconfiguration attacks come from most, In Zero Day, it is not clear, but all kinds of attack can be damage the website, and to prevent this, it is necessary to regularly check whether the website is safe or don't safe, such as security tests.
Source:https://www.turkhackteam.org/siber-guvenlik/1980852-security-misconfiguration-saldirisi-nedir.html
What is Security Misconfiguration
Security Misconfiguration, its Turkish equivalent means wrong security configuration. Security Misconfiguration is a web security vulnerability found in OWASP TOP 10. As only 42% of all companies in the world are sensitive to this vulnerability, it is in 7th place of the OWASP TOP 10 list.
For this ranking changes every year, there is no exact order. Well, let's get to know this vulnerability a little more, it is very important to ensure web security while making a website. These securities must be passed through some processes such as configuring if necessary, but it is very risky to use the components (database, server, etc.) in web security with their default (initial state). Because there may be many vulnerabilities in the first version, and these vulnerabilities can be a base for cyberattacks.
As an example of this, the first version of Redis, which is the default version, has vulnerabilities, first of all the server IP address is found, and then it can capture cookies by breaking the server's password.
These attacks vary according to the wrong configurations in web security. For example, if there is a wrong configuration in the database server of a website, the attack will occur from there, or if the cookie_http only available in the first version of Javascript is active, the attack may come from there. Briefly, where these attacks will come from vary the errors found in the configuration.
What Causes Security Misconfiguration Attacks?
Outdated software, use of systems.
Unused and unnecessary of features be active.
Incorrect configuration/commands in the source codes of the website.
Reasons Like be the most popular.Also, these problems mostly occur in parts such as network services, web server, database, storage.
Precautions Against Security Misconfiguration Attacks
Follow and use the current versions of the software or applications used.
Turn off unused or unnecessary features.
Received error messages from the website into consideration.
Finally, pass the website penetration tests provided that once a year it will protect you from these attacks.
We can liken Security Misconfiguration attacks to Zero-Day attacks. However, the only difference from Zero-Day attacks is clear where the attack could come from. Above, we explained where Security Misconfiguration attacks come from most, In Zero Day, it is not clear, but all kinds of attack can be damage the website, and to prevent this, it is necessary to regularly check whether the website is safe or don't safe, such as security tests.
Source:https://www.turkhackteam.org/siber-guvenlik/1980852-security-misconfiguration-saldirisi-nedir.html
