What is security misconfiguration and how to mitigate?

• A. A document describing password strength requirements.
• B. Incorrectly configured systems or services. Mitigate with secure baselines, automated checks, and continuous configuration monitoring.
• C. A feature design pattern.
• D. A performance tuning practice.

Answer: (B)

Security misconfiguration happens when systems, services, or applications are set up in a way that introduces vulnerabilities because the default, weak, or improperly tuned settings are left in place. This is about how something is configured, not about a policy document, a design pattern, or performance tuning. The idea is that incorrect or insecure configurations create easy entry points for attackers, such as default credentials, unnecessary services running, overly permissive access controls, exposed debug information, or insecure defaults.

The best description captures this setup issue and points to practical ways to fix it: secure baselines to establish hardened, approved configurations; automated checks to enforce those settings consistently; and continuous configuration monitoring to detect drift and respond quickly. In practice, you would implement secure baseline configurations for operating systems, applications, and network devices, use configuration management tools to maintain consistency across many systems, run automated scanners to catch misconfigurations, and monitor for changes that could weaken security. Additional steps include disabling unused services, enforcing least privilege, rotating and protecting credentials, and ensuring error messages do not reveal sensitive information. This combination directly addresses how misconfigurations arise and how to reduce their risk in a repeatable, scalable way.