Configuration Security Audits Stink. But Don't You Dare Skip Them!

In evaluating endpoint posture and network integrity, configuration audits are essential. At the same time, conducting an effective audit is easier said than done. But before unpacking all the dos and don’ts of a good configuration security audit, let's take a step back and ask why. Why should you undertake to audit the security of your endpoint configurations in the first place? 

The answer, of course, is to prevent undue risk exposure. And when it comes to risk, misconfigurations have an outsized impact.

Whether brought on by baseline drift (as devices fall out of line with the golden image over time), changes in the risk landscape (as new software, new attack vectors, and new adversary tactics are introduced), inadequate policies, enforcement shortfalls, or general blindspots, a good security audit will undertake to both reveal and reconsider your risky configurations. 

So, what exactly is a misconfiguration? 

Misconfigurations, Defined

Simply put, misconfigurations occur when systems or devices are set up or managed incorrectly – leading to compromised security. These aren't software bugs that can be addressed by software providers; they're human slip-ups during deployment and/or operation.

Misconfigurations are tricky to pin down as they’re subjective; they’re less about the technology itself and more about how it’s used. As a result, configuration security can be something of a moving target. It depends – among other things – on the particulars of your stack and dependencies, your specific use cases, your business requirements, and your appetite for risk. So, what might be a glaring oversight in one environment could be entirely acceptable in another. 

Because misconfigurations are so context-specific, they can be hard to define and hard to prevent. There’s seldom any sort of objective fix. Which is why, historically, vendors have shied away from the issue – preferring instead to focus on more straightforward problems. So operators are typically left to their own devices (literally), trying to lockdown threat vectors with little more than their moxy and manual best efforts. 

The results have not been great. 

A staggering 73% of organizations are said to house critical misconfigurations. In fact, looking at the whole of the attack surface, one in every three security incidents can be traced back to an insecure configuration. And those misconfiguration-triggered incidents are typically more expensive than others – accounting for 80% of ransomware attacks and costing organizations up to 9% of their annual revenue. 

Let that sink in for a moment.

As a rule, misconfigurations will belong to one of the following four categories:

• Setup & operations errors

• Running unnecessary programs, open ports, excessive privileges, missed patch cycles, etc.

• Problematic default settings

• Leaving default credentials or adding risk through the use of unnecessary protocols, permissions, and services.

• Unapplied policies

• Incorrect group policy execution, ineffective scripts, fragmented visibility and controls (opening gaps across different operating systems, versions, and device types — IT, OT, IOT), and out-of-process device integration (for example, with M&As).

• Non-patchable vulnerabilities

• Patches may not be an option due to zero-days, deprecation, or required functionality.

And with no way to quickly and reliably deploy or update or remove any software package on any device, operators have no choice but to find and face misconfigurations in a fragmented and patchwork manner. It’s a highly intensive and error-prone endeavor that is often kicked down the road for lack of available time and resources. And in the meantime, more and more operating risk accumulates.

Part of the struggle comes from the fact that configuration security cuts across multiple departments and platforms. IT, Security, Operations, and Infrastructure all have their own requirements and perspectives. With so many hands involved, it can be hard to keep track of exactly who’s done what, what hasn’t been done at all, what connects to what, and where each team or teammate has ownership. 

As a result, things can fall through the cracks. And with interdependencies imperfectly mapped – if at all – operators are reluctant to make changes for fear of breaking things.     

The Importance of Regular System Audits

When devices, servers, or services aren't correctly configured, they become low-hanging fruit for bad actors to pluck.

Real companies have already faced real consequences: the Target 2013 breach is a harrowing example in which cybercriminals leveraged access to a vendor portal to steal credit card information from millions of customers. Attackers gained entry through Fazio Mechanical, a third-party refrigeration vendor that lacked adequate security. Once inside, the attackers leveraged the stolen credentials to access a vulnerable web application, likely uploading a backdoor script disguised as a legitimate file.

Malware was then installed on Target’s point-of-sale systems, compromising 40 million credit and debit card numbers and 70 million personal records. Despite prior investments in monitoring systems like FireEye, internal alerts were missed due to Target’s ineffective response chain – delaying the detection until external credit card companies flagged fraudulent activity. 

Target’s initial failure to respond rapidly resulted in reputational and operational damage, costing the company around $252 million in recovery efforts and enhanced security measures. 

The breach impacted Target’s customer loyalty and profit margins, with a 46% earnings drop in Q4 2013 and lasting damage to its brand following an $18.5 million settlement across 47 states. 

Target introduced EMV chip technology to address previous oversight, improved network segmentation, hired a new CISO, and adopted third-party risk management practices. Now, more than ten years after the fact, the breach still serves as a powerful reminder of the need for proactive, multi-layered security strategies.

The Pain and Costs of Audits

While a “quick” system audit is the dream, conducting total system reviews at the frequency and level of detail needed to be effective is no small feat. Manual audits may require downtime, disrupting operations, or temporarily limiting user access. 

Even when lockout isn’t an issue, it can be challenging to balance resource restrictions with the demands of thorough security assessments. Factor in the exorbitant costs of purchasing, building, or maintaining devoted auditing tools and the expenses quickly pile up. 

Naturally, the project management burden is also significant. In most cases, a dedicated team will be needed, pulling skilled personnel away from other projects and their usual tasks. To create a viable, phased plan of attack, even before anything is executed, a lot of resources will be put into the planning and strategy. the execution itself will stretch out for an extended period of time – to allow for monitoring, gap analysis, and context-aware change validation. And that's without assuming the need for any external consultancy or support.

We recommend that large organizations conduct configuration security audits every quarter, while smaller companies can get away with bi-annual assessments. Remember, the larger and more complex the network, the more there’ll be moving pieces that require frequent audits. 

Of course, audits should also follow any significant events to collect and assimilate any possible lessons learned, offer a fresh perspective, challenge assumptions, and strengthen any exposed weaknesses. 

And industries with higher risk profiles, like healthcare and finance, may require even more frequent evaluations to stay vigilant and comply with stringent regulations. 

At the end of the day, we need to be honest enough and smart enough to acknowledge that both these things are true:

1. Yes, audits are critical to close security gaps
2. And yes, they create friction in IT environments.

Accepting both those facts means it’s all about finding the balance. Calling on smart tools for specific purposes, you can minimize manual labor while still maintaining security. 

Configuration Security Audits: Not Fun But Neccessary

Configuration security audits are not just a best practice, but essential to safeguarding your organization. Despite that, they're often delayed and dialed down due to their taxing and unpleasant nature. But with such high stakes, that's a risk you can ill-afford to take 

A good audit is like eating broccoli. It's not always fun, but it's always good for you. And like broccoli, there are ways to make it more pleasant.  Smart tools that streamline processes can drastically reduce manual burdens. By investing in effective auditing solutions and fostering a culture of collaboration among IT, security, and operations teams, organizations can not only close security gaps but also enhance their overall resilience against emerging threats.

With diligence, foresight, and the right strategies in place, you can transform your auditing process into a powerful tool for ensuring a secure and resilient infrastructure. Embrace the journey, learn from the challenges, and fortify your defenses—because in the realm of cybersecurity, preparation is the key to survival.