In this series of articles, we walk you through the OWASP Top 10 — the ten most common, and most dangerous, types of cyber attack. There’s still plenty of confusion about how these threats actually work and what you can do about them. And when you go looking for answers, you often land on articles the average reader can’t follow. That’s no insult — there’s simply a shortage of clearly written content on these topics. At Rootsec, we’re here to change that, with easy-to-understand explanations and no avalanche of jargon. In this article, we tackle the question: what is security misconfiguration?

What is security misconfiguration?

Security misconfiguration is exactly what it sounds like: a system, application, or service that has been set up incorrectly — often left on its default settings — leaving an opening that an attacker can walk straight through. In the current OWASP Top 10 (2021), this category sits at A05: Security Misconfiguration. It’s worth noting that the 2021 edition also folded the former XML External Entities (XXE) category into A05, since XXE is, at heart, just another form of insecure configuration. So when we talk about misconfiguration today, we’re talking about a broad and very common family of weaknesses.

What makes this one so dangerous is how ordinary it is. A misconfiguration rarely requires a clever, custom-built exploit. More often, an attacker simply finds a server, a cloud bucket, or an admin panel that was never locked down properly — and helps themselves. A well-known example is the 2019 breach at Teletext Holidays, where around 530,000 customer call recordings and data files were left unsecured on a cloud server. No sophisticated hacking was needed; the data was simply sitting there, exposed, because the storage had been configured incorrectly.

This is not a rare problem. As organisations moved more of their systems into the cloud, the number of incidents caused by misconfiguration rose sharply — one widely cited figure put the year-on-year increase in exposed records at over 400%. The convenience of cloud services is real, but so is the ease with which a single wrong setting can put sensitive data on public display.

What causes security misconfiguration?

The root cause is usually not exotic technology — it’s everyday human oversight, compounded by systems that ship with insecure defaults. The most common culprits include:

  • Unpatched systems — software left running with known vulnerabilities that a fix already exists for.
  • Default credentials — usernames and passwords like admin / admin that were never changed after installation.
  • Unencrypted files and data — sensitive information stored or transmitted in the clear.
  • Outdated applications — old software versions that are no longer maintained or supported.
  • Unsecured devices — servers, databases, and IoT devices exposed to the internet without proper protection.
  • Misconfigured web applications and cloud services — storage buckets, databases, and dashboards left open to the public.
  • Weak or missing firewall rules — gaps that allow traffic in that should have been blocked.

Behind almost all of these sits the same theme: a lack of clear ownership and a lack of clear policy. When no one is explicitly responsible for hardening a system, or when there’s no agreed standard for how things should be configured, mistakes slip through — and they tend to stay unnoticed until someone exploits them.

How can security misconfiguration be prevented?

The good news is that this is one of the more preventable items on the OWASP Top 10. It’s far less about expensive technology and far more about discipline and process. A few practical steps go a long way:

  • Set clear security policies. Define how systems, applications, and cloud services should be configured — and make someone accountable for it.
  • Map your infrastructure. You can’t secure what you don’t know you have. Keep an up-to-date inventory of your systems, services, and the data they hold.
  • Harden defaults and apply least privilege. Change default credentials, switch off features you don’t use, and give people and systems only the access they genuinely need.
  • Patch and update consistently. Keep operating systems, applications, and dependencies current so known vulnerabilities don’t linger.
  • Raise awareness across your team. Many misconfigurations come down to a single rushed decision. Regular security awareness training helps your people spot and avoid these mistakes.
  • Hold third parties to the same standard. If a supplier or vendor manages part of your environment, make sure their configurations are as secure as your own.

Because misconfigurations are easy to introduce and easy to miss, it pays to check your environment from the outside in — the same way an attacker would. A vulnerability assessment (VAPT) systematically scans your systems for exposed services, weak settings, and missing patches, while a hands-on penetration test goes a step further and confirms whether those gaps can actually be exploited. Together, they turn “we think we’re configured securely” into “we know we are.”

At Rootsec, it has always been our goal to make information security simple — and this series is part of that mission.

Not sure whether a misconfiguration is leaving your data exposed? Let Rootsec find it before an attacker does. Book a free consultation.