A7: Security Misconfiguration

00:00

Hi, everyone. Welcome back to the course in this video. We're to talk about the seventh item on the AWAS. FBI Security Top 10 list security, Miss Configuration.

00:10

So we're gonna talk about some of the causes of these security Miss Configurations as well as ways we can prevent or mitigate against them.

00:18

So let's talk through some of the causes. Well, one major cause on both security Miska Fishery Miss Configurations for AP eyes as well as your more generalized security, Miss Configurations around things in the cloud are unpatched systems

00:34

as well as unprotected directories and files. Also not hardening images. Right. So going back to patching and making sure we have the latest versions of software making sure that we're protecting her files and directories. That's all part of the hardening aspect of it.

00:50

Extort Exposed storage is another big area

00:53

leaving unnecessary features enabled. If you just think about your own operating system, let's see you run like Windows 10. There are so many features on Windows 10 that you don't actually need to use it, right? These are just extra things that all increase your attack surface. So when we talk about hardening systems, if you're not familiar with security terminology. We're just talking about

01:12

making it a secure as we can. So patching

01:15

any vulnerabilities that we have, as well as removing all these unnecessary features we don't actually need for the application to function.

01:23

So how do we prevent against some of these things? We can harden or patch the systems and and make sure that the process is repeatable. We don't just want to do it tomorrow. We want to do it on a consistent schedule so we can make sure we mitigate this

01:40

using an automated process to locate any type of configuration flaws in the application,

01:45

disabling the unnecessary features as I mentioned,

01:49

and also things like restricting the administrative access and then defining and enforcing all the outputs, including errors.

01:56

So in this video, we just talked about some of the causes of security, Miss Configurations. A good example of security, Miss configuration was the Equifax struts breach. So if you're here in the U. S. You know about the Equifax breach? It happened. It affected, I think, roughly half of Americans. Their data was stolen in the Equifax breach.