Skip to content
Kodesec × Integrated-Systems.ai
KODESEC
Book a call

A02 · OWASP Top 10 · 3 min

Security misconfiguration. A strong lock, left on factory settings.

Nothing is "hacked". Something was simply left in an unsafe state: a default password, a public folder, an error screen that says too much.

I run a

In 10 seconds

Sound software, set up unsafely.

What it is

Software, servers and cloud services come with hundreds of settings. Misconfiguration is when they're left unsafe: factory passwords, public folders, features nobody turned off.

Why you care

No clever hacking is needed. Automated tools scan the internet all day for these slips, and one setting can expose your names, addresses, phone numbers and purchase history. OWASP, the industry's list of web risks, puts it at number two.

What to do

Name an owner for your settings, ask for a written checklist, and have them reviewed on a schedule.

For your business

What's at stake for you.

I run a

Who is affected

Your customers, and anyone who trusts you with their details.

What could leak

Names, addresses, phone numbers and purchase history.

Ask this first

“Who owns our settings today, and is there a written list of how things were set up?”

Where it hides

Pick a place where settings matter.

Each one can be perfectly built and still be left open.

yourbusiness.com/admin/login
What's here
The screens where staff or vendors manage your website, shop or systems.
What goes wrong
Still on the factory password, a shared login, or open to the whole internet with no second step.
Ask your team
Have all factory passwords been changed? Is every admin login protected by a second step, such as an app code?
Developers call it
Default credentials, exposed admin interfaces

What it costs

Easy for them. Expensive for you.

Found fast

Scanners look for exactly these slips around the clock. It's found, not guessed.

All at once

One public folder or default login can expose everything behind it.

Takeover

A default admin login hands over control: pages changed, payments redirected.

Cleanup

Investigation, telling people, and legal duties that vary by country and sector.

For an online shop: one public folder or factory login could expose names, addresses, phone numbers and purchase history.

Does this apply to you?

Tick what's true. Get your questions.

First

So the questions fit you

What kind of business do you run?

A real case

It happens to well-funded teams.

Capital One, 2019

A strong system with one setting wrong.

What it cost
In 2020 the US Office of the Comptroller of the Currency fined the bank $80 million, citing weaknesses in how it managed risk and controls around its move to the cloud.
The lesson
The software wasn't the problem. One setting was wrong in a system with a huge number of them. Someone has to own those settings and check them.
Read the full story and sources

An attacker reached customer data held in Capital One's cloud account. According to US court filings, the way in was a misconfigured web application firewall, the tool meant to filter attacks. The bank said about 100 million people in the US and 6 million in Canada were affected.

In 2020 the US Office of the Comptroller of the Currency fined the bank $80 million, citing weaknesses in how it managed risk and controls around its move to the cloud.

Also: in 2021, researchers at UpGuard reported that default settings in Microsoft Power Apps portals left about 38 million records from dozens of organisations publicly readable. Microsoft later changed the default. Sources: US Department of Justice, US OCC, UpGuard.

Your part

Three decisions that are yours.

  1. 01Own the settingsName one person accountable for how your website, hosting and cloud accounts are set up.
  2. 02Demand a baselineEvery new system gets a written secure-settings checklist, checked before it goes live.
  3. 03Review on a scheduleHave someone independent check the settings after setup, after big changes, and regularly after that.
For your developer: the technical layer
  • Harden to a published baseline (for example CIS Benchmarks) and remove default accounts, sample apps and unused services.
  • No debug mode or verbose errors in production. Log details privately.
  • Storage private by default, with public access blocked at the account level.
  • Least-privilege cloud roles, with a second step on every admin login.
  • Test and staging environments kept separate, protected, and free of real customer data.
  • Define infrastructure as code and scan it automatically, so settings can't drift unnoticed.

Remember

Three things to keep.

  • Secure software can still be left in an unsafe state. Settings need an owner.
  • Attackers need no skill for these. Tools find them automatically.
  • Make "safe" the default: a checklist for every new system and a regular independent review.

What OWASP says

The essentials, slide by slide.

A02 · owasp top 10 · 01/04

OWASP Top 10 · A02

security misconfiguration

Source: OWASP Top 10:2025 (CC BY 3.0) ↗

OWASP is a non-profit that publishes the industry's standard list of web risks. Safety measures adapted from the OWASP Top 10:2025 (CC BY 3.0). The people and businesses in the examples are made up.