# security# OWASP 2025
How configuration can affect systems in practice. How to mitigate it.
October 14th, 2026
Ranked second in OWASP 2025, Security Misconfiguration refers to errors caused by humans when configuring applications, systems, cloud services… thereby exposing security vulnerabilities.
Lack of security hardening in any component of the system, or improperly configured permissions on cloud services.
Leaving default credentials on the server.
Improperly configuring security properties in application systems and application frameworks.
Failing to disable unnecessary features on the server (leaving unnecessary ports open….).
Displaying overly detailed errors and providing too much information about the system and server to the client.
The server does not send security headers or sets their values too loosely.
There should be tasks to review security configurations and permissions on servers, systems, applications, and cloud services.
Establish an automated process for setting up environments and configuring different environments such as dev, staging, test, and production. Automation helps minimize the effort required when setting up a new environment. Configurations across environments should be similar, but they should use different credentials for authentication and access.
Disable all unnecessary features on the server / platform.
Set security header values properly.
Establish an automated process to verify the effectiveness of security configurations in the system. If automation is not possible, at least have someone manually review them annually.
Add a centralized configuration to prevent overly detailed errors and excessive information from being displayed to the client.
Use identity federation, short-lived credentials, and role-based access mechanisms provided by systems instead of hardcoding or using secrets and static keys in the codebase and configuration files.
Establish clear security boundaries between components and tenants in the system, ensuring isolation when deploying to production to minimize damage if one component is compromised and prevent it from affecting other components.
Use security groups / access control lists provided by cloud services to restrict access to the system to valid IP addresses and ports only.